🍯 Privacy Policy

1. Introduction

Welcome to Honeysub ("we," "our," or "us"). Honeysub is a registered bill payment company operating in Nigeria, providing convenient services including instant airtime top-up, data subscription, electricity bill payments, cable TV subscriptions (DSTV, GOTV, Startimes), exam PIN purchases (WAEC, NECO, NABTEB), and other utility services.

We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

2. Information We Collect

2.1 Personal Information

We collect the following types of personal information:

2.2 Automatically Collected Information

When you access our services, we automatically collect:

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages visited, time spent on pages, click patterns, navigation paths
• Location Data: General geographic location based on IP address
• Cookies and Similar Technologies: Session data, preferences, authentication tokens

2.3 Information from Third Parties

We may receive information from:

• Payment processors (Paystack) for transaction verification
• Service providers (DSTV, GOTV, Startimes, PHCN, telecommunications companies)
• Fraud prevention and security service providers
• Analytics and marketing service providers

3. How We Use Your Information

We use your personal information for the following purposes:

4. Information Sharing and Disclosure

We may share your information with the following categories of recipients:

4.1 Service Providers

• Telecommunications Companies: MTN, Airtel, Glo, 9mobile for airtime and data services
• Utility Providers: PHCN, EKEDC, IKEDC, and other electricity distribution companies
• Cable TV Providers: MultiChoice (DSTV, GOTV), Startimes for subscription services
• Examination Bodies: WAEC, NECO, NABTEB for PIN purchases
• Payment Processor: Paystack for secure payment processing

4.2 Business Partners

• API providers and technology partners who help us deliver services
• Cloud hosting and data storage providers
• Analytics and performance monitoring services
• Customer support and communication platforms

4.3 Legal and Regulatory Requirements

We may disclose your information when required by law or in response to:

• Court orders, subpoenas, or other legal processes
• Requests from government authorities or regulatory bodies
• Enforcement of our terms of service or protection of our rights
• Investigation of fraud, security issues, or illegal activities
• Protection of the safety and rights of our users and the public

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and the choices you may have regarding your information.

5. Payment Processing Paystack Integrated

5.1 Paystack Payment Gateway

All payment transactions on Honeysub are processed through Paystack, a PCI-DSS compliant payment gateway. We do not store your complete payment card details on our servers.

5.2 Payment Information Security

5.3 Transaction Information

We collect and store the following transaction information:

• Transaction amount and currency
• Transaction date and time
• Transaction status (successful, failed, pending)
• Last four digits of payment card (for reference only)
• Payment method used (card, bank transfer, USSD)
• Transaction reference numbers

5.4 Payment Refunds

Refunds are processed according to our refund policy. When a refund is initiated, your payment information is handled securely through Paystack's refund API. Refund timeframes depend on your financial institution and typically take 5-10 business days.

6. Data Security

We implement industry-standard security measures to protect your personal information from unauthorized access, disclosure, alteration, and destruction.

6.1 Technical Security Measures

• Encryption: SSL/TLS encryption for data transmission, AES-256 encryption for data at rest
• Access Controls: Role-based access control (RBAC) and multi-factor authentication (MFA)
• Secure Servers: Firewalls, intrusion detection systems, and regular security audits
• Data Backup: Regular encrypted backups stored in secure, geographically distributed locations
• Security Monitoring: 24/7 monitoring for suspicious activities and security threats

6.2 Organizational Security Measures

• Employee training on data protection and security best practices
• Confidentiality agreements with employees and contractors
• Regular security assessments and penetration testing
• Incident response procedures and data breach notification protocols
• Vendor security assessments for third-party service providers

6.3 Your Security Responsibilities

6.4 Data Breach Notification

In the unlikely event of a data breach that affects your personal information, we will notify you within 72 hours via email and/or SMS, and provide information about the breach, the data affected, and the steps we are taking to address the situation.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

When we no longer need your information, we securely delete or anonymize it in accordance with our data retention policy and applicable laws.

8. Your Rights and Choices

You have the following rights regarding your personal information:

8.1 Access and Portability

• Right to Access: Request a copy of the personal information we hold about you
• Right to Data Portability: Receive your data in a structured, commonly used format

8.2 Correction and Deletion

• Right to Rectification: Request correction of inaccurate or incomplete information
• Right to Erasure: Request deletion of your personal information (subject to legal obligations)

8.3 Restriction and Objection

• Right to Restriction: Request limitation of processing of your information
• Right to Object: Object to processing of your information for certain purposes

8.4 Marketing Communications

• Opt-Out: Unsubscribe from marketing emails by clicking the unsubscribe link
• SMS Preferences: Reply "STOP" to marketing SMS messages
• Account Settings: Manage communication preferences in your account dashboard

8.5 Exercising Your Rights

To exercise any of these rights, please contact us using the information provided in the Contact section. We will respond to your request within 30 days. You may be required to verify your identity before we process your request.

9. Cookies and Tracking Technologies

9.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our website. We use cookies and similar technologies to enhance your experience, analyze usage, and provide personalized content.

9.2 Types of Cookies We Use

9.3 Managing Cookies

You can control cookies through:

• Browser Settings: Most browsers allow you to refuse or delete cookies
• Cookie Preferences: Use our cookie consent banner to manage preferences
• Opt-Out Tools: Use industry opt-out tools for advertising cookies

Please note that disabling certain cookies may affect the functionality of our services and your user experience.

9.4 Other Tracking Technologies

We also use:

• Web Beacons: Small graphics to track page views and email opens
• Local Storage: Browser storage for improved performance
• Analytics Tools: Google Analytics and similar services (anonymized where possible)

10. Third-Party Services and Links

10.1 Third-Party Service Providers

We work with trusted third-party service providers, including:

• Paystack: Payment processing - Privacy Policy
• Cloud Hosting Providers: For secure data storage and service delivery
• Email Service Providers: For transactional and marketing communications
• SMS Gateways: For sending transaction notifications and alerts
• Analytics Providers: For usage analysis and service improvement

10.2 Third-Party Links

Our website may contain links to third-party websites and services. We are not responsible for the privacy practices or content of these third parties. We encourage you to read the privacy policies of any third-party sites you visit.

10.3 Social Media Integration

If we integrate social media features on our platform, these features may collect information about your visit and may set cookies. Your interactions with these features are governed by the privacy policies of the respective social media companies.

10.4 Data Processing Agreements

We maintain data processing agreements with our service providers to ensure they handle your information securely and in compliance with applicable data protection laws.

11. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18 years of age.

If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately. We will take steps to remove such information from our systems.

If we become aware that we have collected personal information from a child under 18 without parental consent, we will take immediate steps to delete that information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

12.1 Notification of Changes

When we make material changes to this Privacy Policy, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you via email to the address associated with your account
• Display a prominent notice on our website
• Request your consent for changes that require it under applicable law

12.2 Your Continued Use

Your continued use of our services after we post changes constitutes your acceptance of the updated Privacy Policy. If you do not agree to the changes, you should discontinue using our services and contact us to close your account.

12.3 Previous Versions

We maintain archived versions of our Privacy Policy. If you would like to review a previous version, please contact us.

13. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

14. Regulatory Compliance

Honeysub is committed to complying with applicable data protection laws and regulations, including:

• Nigeria Data Protection Regulation (NDPR) 2019
• Nigeria Data Protection Act (NDPA) 2023
• Payment Card Industry Data Security Standard (PCI-DSS)
• Central Bank of Nigeria (CBN) regulations on electronic payments
• General principles of international data protection standards

Our business is registered with the Corporate Affairs Commission (CAC) of Nigeria, and we operate in compliance with all applicable Nigerian laws and regulations governing bill payment services and electronic transactions.