Privacy Policy
Last updated: 1 August 2026 · Compliant with the Nigeria Data Protection Act (NDPA) 2023 and NDPR
1. Who we are
MidPoint Technologies Ltd is the data controller for personal data processed through midpoint.ng and the MidPoint apps. Contact our Data Protection Officer at privacy@midpoint.ng.
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Account | Name, phone, email, city, password hash | To create and secure your account |
| Transaction | Item details, prices, delivery address, dispatch and dispute records | To operate escrow and resolve disputes |
| Verification (KYC) | BVN, date of birth, bank account number and resolved account name, CAC number for businesses | Legal obligation to verify identity before payout |
| Evidence | Photos, videos, chat screenshots you upload to a dispute | To adjudicate disputes fairly |
| Technical | Device, IP address, log data | Security, fraud prevention, service reliability |
3. How we handle your BVN
We collect your BVN only with your express, separately-recorded consent , and only to confirm that your payout account name matches your registered identity.
Verification is performed by our licensed payment partner, Paystack. Your BVN is transmitted securely to Paystack and is not stored in full on MidPoint systems — we retain only a verification reference, the match result, and the last four digits.
A BVN does not grant access to your account balance or transaction history, and cannot be used to debit your account.
We never share your BVN with buyers, sellers, or any third party other than our payment partner for this verification, or a regulator or court where legally compelled.
You may withdraw consent at any time by emailing privacy@midpoint.ng. Payouts will be suspended until you re-verify.
4. Legal bases
We process data to perform our contract with you (operating escrow), to comply with legal obligations (KYC, AML, tax), on the basis of your consent (BVN capture, marketing emails), and for our legitimate interests (fraud prevention, service improvement).
5. Who we share with
Payment and verification partners (Paystack), cloud hosting and communications providers, professional advisers, and regulators or law-enforcement where legally required. In a dispute, the evidence you submit is shared with the other party to the transaction so they can respond. We do not sell personal data.
6. Retention
Transaction and verification records are retained for a minimum of seven years to meet Nigerian financial record-keeping and tax obligations. Dispute evidence is retained for the life of the case plus seven years. Marketing preferences are retained until you opt out.
7. Your rights
Under the NDPA you may request access to your data, correction of inaccurate data, deletion (where we are not legally required to retain it), restriction of processing, portability, and withdrawal of consent. Email privacy@midpoint.ng; we respond within 30 days. You may also complain to the Nigeria Data Protection Commission.
8. Security
Data is encrypted in transit and at rest, access is restricted on a need-to-know basis, and we log administrative access. No system is perfectly secure; please use a strong, unique password and enable two-factor authentication.