Introduction
Halcore Digital Technology Limited (“Halcore”, “we”, “us”, “our”) is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share, and protect your information when you use Toyyib (the “Platform”).
This Policy is issued in compliance with the Nigerian Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation 2019 (NDPR), the Federal Competition and Consumer Protection Act 2018, and other applicable Nigerian law. Halcore intends to register as a Data Controller with the Nigeria Data Protection Commission (NDPC) in due course and is committed to operating in full compliance with the NDPA 2023 in the interim.
By using the Platform, you consent to the processing of your personal data as described in this Policy.
1. Who We Are
Halcore Digital Technology Limited is the Data Controller for personal data processed through Toyyib. You can contact us at [email protected] for privacy matters and data protection requests. Our website is www.halcore.app & www.toyyib.app and we are based in Lagos, Nigeria.
2. What Data We Collect
Data you provide directly includes:
- your full name and email address for account registration
- your password which is stored as a cryptographic hash and never in plain text
- payment method details which are processed exclusively by CBN-licensed payment gateways and never stored on our servers
Data we collect automatically includes:
- your device type and operating system for platform optimisation
- your IP address for security and fraud prevention
- usage data including features accessed, session duration, and in-app searches for product improvement
- crash reports and error logs for debugging
Data generated through your use of the Platform includes:
- for all users — stocks you search and view
- for paid subscribers — your watchlist, portfolio holdings, purification calculations, compliance report history, and billing activity
We do not collect sensitive personal data as defined under Section 30 of the NDPA 2023 unless you explicitly provide it.
3. Why We Process Your Data
We process your data:
- to create and manage your account
- to provide free compliance status access to all users
- to deliver premium features to paid subscribers
- to process subscription payments
- to send service notifications and compliance alerts
- to provide customer support
- to improve the Platform
- to detect and prevent fraud and security threats
- to comply with applicable Nigerian law
Where we send marketing communications, we do so only with your consent, which you may withdraw at any time.
4. Lawful Basis
We process your data under the following lawful bases in accordance with Section 25 of the NDPA 2023:
- performance of contract for account management, service delivery, and billing
- legitimate interest for security monitoring and platform improvement
- consent for marketing communications
- legal obligation for regulatory compliance
6. How Long We Keep Your Data
- Account data is kept for the duration of your account plus two years.
- Payment and transaction records are kept for seven years in accordance with Nigerian tax and financial record requirements.
- Usage and analytics data is kept for two years.
- Compliance reports and purification records are kept for three years or until account deletion, whichever is later.
- Support records are kept for two years.
On expiry, data is securely deleted or irreversibly anonymised.
7. How We Protect Your Data
We protect your data through:
- encryption of data in transit using TLS and at rest using AES-256
- passwords stored as cryptographic hashes only
- payment card data handled exclusively by PCI-DSS compliant processors
- strict access controls limiting data access to authorised personnel
- regular security assessments
In the event of a data breach likely to risk your rights, we will notify you and the NDPC without undue delay and in accordance with Section 41 of the NDPA 2023.
8. Your Rights
Under the NDPA 2023 and NDPR 2019, you have the right:
- to access the personal data we hold about you
- to correct inaccurate data
- to request deletion of your data subject to our legal retention obligations
- to restrict or object to certain processing
- to receive your data in a portable format
- to withdraw consent for marketing at any time
To exercise any of these rights, contact [email protected]. We will respond within thirty days. You also have the right to lodge a complaint with the Nigeria Data Protection Commission at www.ndpc.gov.ng.
10. Children
The Platform is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has registered, contact us at [email protected] and we will delete the data promptly.
11. International Transfers
Where data is transferred outside Nigeria to service providers, we ensure appropriate safeguards are in place in compliance with Section 43 of the NDPA 2023, including contractual clauses requiring equivalent data protection standards.
12. Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices, legal obligations, or Platform features. All updates will be published on our Privacy Policy page at www.toyyib.app/privacy, which is the authoritative and most current version of this Policy at all times. We encourage you to check this page periodically. Where changes are material, we will notify you via email or in-app notification before they take effect. Continued use of the Platform after any update constitutes your acceptance of the revised Policy.
13. Contact
- For all enquiries: [email protected]
- Website: www.halcore.app www.toyyib.app
- Lagos, Nigeria
To escalate a complaint: Nigeria Data Protection Commission — www.ndpc.gov.ng | Federal Competition and Consumer Protection Commission — www.fccpc.gov.ng
Toyyib Privacy Policy | Halcore Digital Technology Limited | Version 1.0 | Effective Date: 20 July 2026
Compliant with the Nigerian Data Protection Act 2023 | NDPR 2019 | FCCPA 2018