Privacy notice

1.About this notice

This notice explains how EBITPOINT LTD handles personal information when you visit ebitpoint.com, create or use an ebitpoint account, or contact us. Our services are for customers in Ghana and Nigeria, and this notice describes the rights you have under Ghana's Data Protection Act, 2012 (Act 843) and the Nigeria Data Protection Act, 2023.

The GDPR data protection notice adds the detail: the legal basis for each use, our main service providers, each retention period, and how the GDPR and UK GDPR apply if you use ebitpoint from Europe or the United Kingdom.

2.Who is responsible for your information

3.Information we collect

We collect information you give us, information created when you use ebitpoint, and information from the services that help us run it.

We also keep a privacy-preserving fingerprint of the browsers you sign in from to limit sessions per device and to check that a referrer and the friend they invite are different people before a reward is paid.

Comparing faces involves processing measurements of your face, which some laws treat as biometric or sensitive information. The automated checks section explains how it is used.

4.How we use it

• To create and run your account, and to provide Buy, Sell, Swap, P2P, deposit and withdrawal services.
• To verify your identity, apply limits, review withdrawals, and prevent money laundering and fraud.
• To secure accounts with sign-in checks, session and activity records, rate limits, and security alerts.
• To answer support requests, including through Alma, our chat assistant.
• To send service and transaction notifications, and news and offers by email, which you can unsubscribe from at any time.
• To pay rewards and referrals under the Rewards programme terms, and to check them for abuse before they are paid.
• To keep records, handle disputes, and respond to lawful requests.

The legal basis for each of these is set out in the GDPR notice. If you do not give us information we need for our contract with you or our legal obligations, we may not be able to open or keep your account.

5.Cookies, analytics and advertising

Essential cookies support security, sign-in, your saved privacy choice, and your saved theme, country and language. They cannot be switched off.

Analytics is optional and off unless you turn it on. It covers Google Analytics site measurement, where configured, and our own first-party visitor count, which records the page visited, the referring site, the network address and the browser user agent. Turning Analytics off deletes the visitor identifier from this device.

Advertising is optional and off unless you turn it on. It covers Google Ads conversion measurement, advertising storage, advertising user data and advertising personalisation. When it is on, Google may receive information about your browser or device, the public page visited, and limited event labels for completed registration, starting a Buy or Sell flow, or creating a Buy or Sell order. We do not send names, contact details, account or order identifiers, amounts, wallet addresses, payment references, or form contents in these events.

You can change either choice at any time from Privacy choices in the footer of any page. Your new choice updates Google's consent signals and replaces the saved setting on this device. Neither choice changes transaction eligibility or pricing.

Each cookie, what it does and how long it lasts is listed in the GDPR notice.

6.Who we share it with

We do not sell personal information. Only authorised people at ebitpoint can see customer records. We share information only where it is needed:

• With service providers who run parts of ebitpoint for us: website hosting and file storage, database hosting, email and SMS delivery, crypto deposit addresses, reading the text on identity documents and checking photos for a face, live P2P order updates, the Alma chat assistant, Google sign-in and optional measurement, WhatsApp support, and blockchain data services.
• With your bank or Mobile Money provider, which receives the account number, account name and amount needed to pay you.
• With the other customer on a P2P order. They see your public name (your nickname, your @handle, or your first name and last initial), your profile photo if you added one, your trading record, and, if you are the seller, the payment details you chose for that order.
• In public, if you submit a review and it is approved. It shows your rating, your review, its date, which coin you bought or sold, and your first name and last initial.
• With professional advisers, with a buyer or successor if our business is reorganised or sold, and with courts, regulators, law enforcement or other authorities where the law requires it or where it is needed to protect our customers, our rights or others.

The GDPR notice describes our main providers, what they do, and the information they receive. Amazon Web Services (Amazon Rekognition) reads the text on identity documents and checks selfies for a face, and Anthropic reads the text on an identity document when Amazon Rekognition cannot. Ably carries live P2P order updates, which contain only identifiers, never names, amounts or messages.

7.Information processed outside Ghana and Nigeria

Our main database is hosted in the United States, and several of our providers are based there. Where the law requires safeguards for these transfers, we rely on the data processing terms our providers offer. Contact us if you would like to know more about the safeguards for a particular provider.

8.How long we keep it

We keep information only for as long as we need it for the purposes above, including security, record-keeping, handling disputes, and meeting legal obligations.

• Sign-in and confirmation codes expire within minutes, and password reset links after 30 minutes.
• Your name, contact details and sign-in details are kept while your account is open. When it is deleted they are removed, and only an anonymous account record remains.
• Support, sign-in and session records tied to your account are deleted when your account is deleted.
• Identity verification records and documents, including live check camera frames and face measurements, and your orders, deposits, withdrawals and swaps with the payout accounts and wallet addresses they used, are kept after your account is deleted, for anti-money-laundering record-keeping and other legal obligations.
• Read in-app notifications are kept for 18 months, and notification delivery records for 12 months.

Every retention period is listed in the GDPR notice.

9.Your rights and choices

Depending on the law that applies to you, you can ask us to:

• Give you access to your personal information and a copy of it.
• Correct information that is wrong or incomplete. You can change your phone number and country in Settings yourself.
• Delete your information. You can ask to delete your account from Settings, once its balance is zero and nothing is in progress. The request is processed after 30 days, and you can cancel it before then.
• Restrict how we use your information while a concern is resolved.
• Move information you gave us, in a structured, commonly used format.
• Stop using it for our legitimate interests, and stop sending you marketing at any time.

Where you gave consent, for example to Analytics, Advertising or browser notifications, you can withdraw it at any time. This does not affect what happened before.

To make a request, email info@ebitpoint.com with the subject line “Data protection”, or contact Support while signed in. We may need to confirm your identity first. We aim to respond within one month, and will tell you if we need longer. Making a request is free unless it is clearly unfounded or excessive.

If you are unhappy with how we handle your information, please contact us first so we can try to put it right. You can also complain to the Data Protection Commission in Ghana or the Nigeria Data Protection Commission.

10.How we protect it

• Connections to ebitpoint and to our database are encrypted in transit.
• Passwords and recovery codes are stored only as one-way hashes.
• Verification documents and chat attachments are stored privately and opened only through access-checked links.
• Access to customer data is limited to authorised people at ebitpoint, and access is recorded.

No online service can be completely secure, so protect your side too: use a unique password, secure your email account, and keep verification codes private. Never send your password, private key, recovery information, or one-time code to someone claiming to be support. If we become aware of a personal data breach that is likely to put you at risk, we will tell you and the relevant authorities as the law requires.

11.Automated checks and Alma

When you submit your identity documents, the text on your ID is read automatically and compared with the name on your account, and your selfie is checked for a face. Where the live camera check is offered, you follow prompts on screen, and the camera frames are compared with your selfie and ID photo. The measurements of your face, and your document, are also compared with those submitted on other ebitpoint accounts, so that one identity cannot be used to open several accounts.

Where automatic review is switched on, a submission that passes every check can be approved without waiting for a person, and a submission showing strong signs of a reused identity or a faked camera image can be declined automatically. Other submissions go to a person at ebitpoint. If your submission is declined, you can submit again, or contact Support and ask for a person to look at it.

Where our step-up check for large withdrawals is switched on, you may also be asked to complete a live face check that is compared with your verification selfie.

Some safeguards run automatically, such as transaction limits, waiting periods for new withdrawal addresses, and rate limits. If one of these stops an action and you think it is wrong, contact Support and we will review it.

Alma, our chat assistant, uses an AI model to answer questions. It cannot change your account, approve transactions or issue refunds, and you can ask Alma for a person at any time.

12.Updates to this notice

We will update this notice when the way we handle information changes. The current version and its update date are always shown on this page.