Privacy Policy
This policy explains what personal data Plov collects, why, who we share it with, how long we keep it, and the rights you have under the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Commission's General Application and Implementation Directive 2025 (GAID). We have tried to write it in plain language.
1. Who we are
The data controller is Ingia Technologies Limited, Lagos, Nigeria ("Plov", "we", "us"), which operates Plov. Our Data Protection Officer can be reached at info@ingia.net (put "Data protection" in the subject).
For a bill you pay at a restaurant, the restaurant is a separate controller of its own records of the meal and the sale. We are responsible for what we hold about you in Plov.
2. What we collect
We collect only what we need to run Plov. Some of it you give us, some is created when you use Plov, and some comes from partners such as your sign-in provider.
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Mobile number (verified with a code we text you), email address, your language, and the identifier from Apple or Google if you sign in with them. | You, and Apple or Google when you choose them to sign in. |
| Credit and payments | Amounts you add, the one-time bank account details we show you for a transfer, your credit balance, each bill you pay (restaurant, table, bill amount, discount and amount paid), gifts you send or receive (amount, optional note, and the other person's phone number), and your reward tier, boosts and referrals. | You, the restaurant's till system, and our payments partner. |
| Location | Your device's location while the app is open, to show restaurants near you and to notice when you are inside a partner restaurant, so the app can open Pay. We do not track you in the background. | Your device, only if you allow it. |
| Camera | The camera is used to scan the code on your table. We do not keep the pictures. | Your device, only if you allow it. |
| Device and security data | Your device's push-notification token, device type, app version, IP address, and security and error logs. | Your device and our systems. |
| Restaurant owners and staff | Name, email or phone number, job title, which restaurant you work at, when you were last active, and, for owners, the restaurant's verified bank account for payouts and details of any funding agreement. | You, your restaurant owner, and our bank-verification partner. |
| Funding quote requests | Restaurant name, area, point-of-sale system, average monthly sales and a WhatsApp number, sent through the form on this website. | You. |
We do not collect or store full card numbers, card security codes or PINs. We do not knowingly collect sensitive personal data such as health, religion, or biometric data.
3. Why we use it, and our lawful basis
The NDPA requires a lawful basis for every use of personal data. Ours are:
| Purpose | Lawful basis |
|---|---|
| Creating and securing your account, verifying your number, and running your credit, bills, gifts and rewards. | Performance of our contract with you. |
| Settling bills with restaurants, paying restaurants, and keeping accurate financial records. | Performance of our contract, and our legal obligations (accounting, tax and financial regulation). |
| Preventing fraud, abuse and money laundering, enforcing our terms, rate-limiting and security monitoring. | Legitimate interests in keeping Plov safe, and legal obligations. |
| Assessing restaurants for funding. | Steps at the restaurant's request before a contract, and legitimate interests. Assessments are reviewed and approved by people, and no funding decision is made by a computer alone. |
| Showing nearby restaurants and noticing when you are at one. | Your consent, given through your device's permission. You can turn it off at any time in your device settings. |
| Marketing messages and promotional push notifications. | Your consent. You can withdraw it at any time. |
| Service messages (a receipt, a gift you received, a payout sent). | Performance of our contract. |
| Improving Plov from aggregate usage. | Legitimate interests, using data that does not identify you wherever we can. |
We do not sell your personal data. We do not use it to show you third-party advertising.
4. Who we share it with
We share personal data only as far as needed, and we require each provider that handles it for us to protect it and use it only on our instructions.
- Restaurants. The restaurant where you pay sees the table, the check number, the bill amount and the discount applied. We do not give restaurants your phone number. When you gift someone credit, you and the recipient each see the other's phone number.
- Payments and banking partners. They process transfers and payouts and verify bank accounts, and they have their own legal duties and privacy notices.
- Technology providers. Providers of our database and sign-in, application hosting, website hosting, text messages (SMS), and push-notification and email delivery.
- Apple and Google. If you sign in with them, and to deliver push notifications to your phone.
- Professional advisers, auditors and insurers, under duties of confidence.
- Regulators, courts and law enforcement when the law requires it or to protect people from harm.
- A buyer or investor if Plov is sold or restructured, who must honour this policy.
5. Transfers outside Nigeria
Some of our providers store or process data outside Nigeria, for example in the United Kingdom, the European Union or the United States. We transfer personal data abroad only where the NDPA allows it: to a country or organisation the Nigeria Data Protection Commission recognises as providing adequate protection, or with appropriate safeguards such as binding contract terms, or on another basis the Act permits. Ask us at info@ingia.net for details of the safeguards.
6. How long we keep it
We keep personal data only as long as we need it for the purpose we collected it, and then delete it or make it anonymous.
- Account details: while your account is open, and for a short period after you close it so we can deal with disputes.
- Financial records (top-ups, bills, payouts, the credit ledger): for the period Nigerian law requires, even after you close your account. These records cannot be altered, and we cannot delete them while a legal duty to keep them applies.
- Security logs: for a limited period, then we delete or anonymise them.
- Funding quote requests: only for as long as we need to deal with the request, and then we delete them, unless you become a partner restaurant.
7. How we protect it
We protect personal data with encryption in transit, access limited to the people who need it for their job, role-based permissions, rate limiting and monitoring against abuse, one-time codes for sign-in, and approvals by two different people for the most sensitive financial actions. Restaurant integration keys are stored only in hashed form. No system is perfectly secure, so please keep your phone and sign-in methods safe.
If a personal data breach is likely to put people's rights and freedoms at risk, we will tell the Nigeria Data Protection Commission within 72 hours of becoming aware of it. Where the risk to you is high, we will also tell you without undue delay, saying what happened, what data was involved, and what you can do.
8. Your rights
Under the NDPA you have the right to:
- be told how your personal data is used (this policy);
- access the personal data we hold about you, and get a copy;
- have inaccurate or incomplete data corrected;
- ask us to delete your data, where we no longer need it or have no lawful reason to keep it;
- ask us to restrict how we use your data in certain cases;
- object to uses based on our legitimate interests, and to direct marketing at any time;
- receive the data you gave us in a structured, commonly used, machine-readable format and have it passed to another provider (portability);
- withdraw consent you gave, without affecting what we did before you withdrew it; and
- not be subject to a decision based only on automated processing that significantly affects you.
You can delete your account yourself in the app (Settings, then Delete account); this page explains how and what happens to your data. To use any of these rights, email info@ingia.net from the address or contact the account uses, or write to us at the address above. We may need to check it is really you before acting. We answer without undue delay and within one month, and we do not charge unless a request is clearly unfounded or excessive. Some rights have limits: for example, we must keep financial records the law requires, and we may refuse a request if doing so would reveal someone else's personal data.
9. Children
Plov is for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, tell us and we will delete it.
10. Notifications and marketing
Receipts, security messages and notices about your credit are part of the service. We send marketing messages and promotional push notifications only with your consent. You can turn push notifications off in your device settings and opt out of marketing in the message or by writing to us.
11. Cookies and similar technology
This website uses no cookies, no advertising or analytics trackers, and no third-party fonts or scripts: its fonts are served from our own address, so your visit does not send your IP address to a font provider. The Plov dashboard for restaurants uses only the cookies it needs to keep you signed in. The Plov app stores your sign-in on your device, and asks your permission before using location, camera or push notifications.
12. Questions and complaints
Please contact our Data Protection Officer first at info@ingia.net, and we will try to put things right. You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng) and to go to court.
13. Changes to this policy
We will update this page when our practices change and show the new effective date at the top. If a change affects how we use your data in a way that needs your consent, we will ask for it.