Privacy policy

• Identity data: name, date of birth, address, BVN or NIN, and identity documents.
• Suitability data: your investor category, declared net annual income and declared crowdfunding running total.
• Transaction data: subscriptions, cancellations, refunds and instruments held.
• Household data where a family or household relationship is relevant to a lock-in exception.
• Technical data: device, browser and access logs used for security and audit.

To verify your identity, to enforce your statutory investment limit, to administer subscriptions and refunds through the custodian, to meet our reporting obligations to the Commission, and to detect and prevent identity theft and fraud.

Personal data is encrypted in transit and at rest. Access is restricted by role and logged. We operate an identity theft prevention programme and log security incidents. Records are retained for at least seven years in a non-alterable format and can be produced to the Commission within five working days.

• The independent custodian holding subscription monies.
• Identity verification and payment service providers acting on our instructions.
• The Securities and Exchange Commission and other regulators where required by law.
• Fundraisers, limited to the information they need to issue and administer your instrument.

You may request access to your personal data, ask us to correct it, object to processing, or request deletion where no legal retention obligation applies. Statutory retention obligations override a deletion request for the records they cover.

Data protection enquiries: privacy@pennytree.example (to be confirmed by PennyTree Compliance).