Privacy Notice
Prim Points: Privacy Notice
Version 1 - Effective date: October 2026
This notice explains how Euphr Technologies Limited, RC 7830048, 1 Dan Suleiman Street, Utako, Abuja (“Prim Points”, “we”, “us”) collects and uses personal information in the Prim Points rewards programme. It covers customers, Merchant contacts, and visitors to our website. We aim to follow the Nigeria Data Protection Act 2023 (“NDPA”).
Who is responsible: we are the data controller. Our contact for privacy matters is Data Protection Office, info@primpoints.com, WhatsApp 09061131423.
1. What information we collect
Customers
Your name (if you give it), mobile number, email (optional) and area, and the one-time codes we send you to check your number.
Your choices: which terms and which version you accepted, whether you agreed to messages about your points, whether you agreed to offers and news, and when.
Programme records: the Merchant, date, bill amount, cash paid, points earned and used, balances and expiry. If a Merchant is asked to prove a sale, a photo of your receipt.
Referral code, if you used one.
Messages you send us on WhatsApp, in the app or by email, and our replies.
Merchants and their contacts
Business name, contact name, phone, email, address, business registration number (if any), category, number of outlets and typical sale amount. For their staff: name, phone number, a PIN (stored in scrambled form) and the registered device used to record sales.
Records of agreements, onboarding checks and deposits made to the settlement reserve, including the bank’s records of payments received.
Bank payout details, which we collect through a secure process and not through our website or forms. If a Merchant connects a POS or payment provider, we also receive records of its sales (amount, time, terminal and reference) to confirm purchases. We never receive or store card numbers.
Website visitors
Technical information such as your IP address, device, browser and pages visited, through cookies and similar tools.
We do not ask for sensitive personal data such as health, religion or political views. We do not collect your BVN or NIN as a customer. If a law or our banking partner requires identity checks for Merchants, we will tell the Merchant what is needed and why.
2. Why we use it, and our lawful basis
Create your account and record your points
Why: To run the programme you joined
Lawful basis: Contract
Send confirmations, balance replies and expiry reminders by WhatsApp or SMS
Why: To keep you informed about your points
Lawful basis: Your consent, or contract where the message is necessary for the service.
Send offers and news
Why: Marketing
Lawful basis: Your consent. Optional, and you can withdraw at any time
Prevent fraud and misuse, confirm sales (using POS records and receipt photos when needed) and keep records for disputes
Why: To protect customers, Merchants and the reserve
Lawful basis: Legitimate interest
Settle with Merchants and reconcile the reserve with the bank
Why: To pay Merchants and keep points fully backed
Lawful basis: Contract and legitimate interest
Show each Merchant how the programme performs for them
Why: To run the Merchant relationship
Lawful basis: Contract and legitimate interest
Keep accounting, tax and regulatory records
Why: To meet legal duties
Lawful basis: Legal obligation
Improve the programme and our website
Why: To make it work better
Lawful basis: Legitimate interest, or consent for non-essential cookies
We do not make decisions about you using fully automated processing that has a legal or similarly significant effect.
3. Who we share it with
Merchants. A Merchant sees only its own customers’ phone numbers, purchases and points activity at that Merchant, and aggregate results. A Merchant may not sell this information or use it for unrelated marketing.
Our banking partner, Bank partner, for the settlement reserve, deposits, payouts and reconciliation. This is mainly Merchant and transaction information.
Service providers that help us run the programme, acting on our instructions: messaging providers (such as SMS and WhatsApp), POS or payment providers a Merchant chooses to connect, receipt-reading tools, cloud hosting and storage and spreadsheet tools (such as Google Workspace), website hosting, and form tools.
Professional advisers such as lawyers, accountants and auditors, under a duty of confidentiality.
Regulators, courts and law enforcement, where the law requires it.
A buyer or investor, if our business is restructured or sold. We would tell you, and the new owner would have to respect this notice.
We do not sell your personal information.
4. Transfers outside Nigeria
Some providers store or process information in other countries. When this happens we rely on safeguards the NDPA allows, such as contracts and security commitments, and we only share what is needed.
5. How long we keep it
Customer account details
Kept for: While your account is open, and [12] months after closure
Programme and transaction records (receipt photos for [12] months unless a dispute is open)
Kept for: [6] years, for accounting, dispute and legal purposes
Consent records (what you agreed to, when, which version)
Kept for: As long as the account exists and [6] years after, to prove your choices
Marketing preferences
Kept for: Until you withdraw consent, then a record that you opted out
Merchant records
Kept for: For the agreement and [6] years afterwards
Website technical data
Kept for: [12] months
After the period ends we delete or anonymise the information.
6. How we protect it
Access only for named staff who need it, with strong sign-in and regular access reviews. Cashier PINs and one-time codes are stored in scrambled form, and sales can be recorded only from registered devices.
Customer information is kept in controlled systems and not shared in open messaging groups.
An append-only record of programme activity, so changes can be traced.
Encryption in transit, and encryption at rest where our tools allow.
Bank details and identity documents are collected only through secure channels.
A process to respond to security incidents. If a breach is likely to put you at risk, we will tell you, and the NDPC, as the law requires.
No system is completely secure. Please protect your phone and do not share your account details.
7. Your rights
Under the NDPA you may:
Ask for access to the information we hold about you.
Ask us to correct anything that is wrong or incomplete.
Ask us to delete your information, where we no longer need it or the law allows.
Ask us to restrict or object to certain uses, including marketing.
Ask for a copy of your information in a common format, where the law gives you that right.
Withdraw consent at any time, as easily as you gave it. Reply STOP to a message, or contact us. Withdrawing does not affect what we did before.
Complain to us, or to the Nigeria Data Protection Commission.
We will reply within 30 days. We may need to check your identity first. Some records, such as accounting records, we must keep even if you ask us to delete them, and we will explain when this applies.
8. Messages
If you agreed to messages about your points, we will send confirmations and reminders to the number you gave us.
Offers and news are sent only if you agreed to them separately. You can say no and still join.
Every promotional message will tell you how to stop.
We reply with balances only to the registered phone number.
9. Children
Prim Points is for people aged 18 and over. We do not knowingly collect information from children. If you think a child has joined, contact us and we will delete the account.
10. Cookies and similar tools
Our website uses essential cookies where needed for it to work. We use Framer’s cookieless analytics to understand website traffic and improve our website. These analytics do not use cookies. We do not use analytics or advertising cookies. You can manage cookies through your browser settings.
11. Changes to this notice
We may update this notice. We will post the new version with its date and version number, and will tell you about significant changes through the contact details you gave us.
12. Contact us
Data Protection Office, info@primpoints.com, WhatsApp 09061131423, 1 Dan Suleiman Street, Utako, Abuja.
You may also contact the Nigeria Data Protection Commission (NDPC) at https://ndpc.gov.ng.
A rewards network for Nigerian businesses and their customers. Pilot in Abuja.
Euphr Technologies Limited, RC 7830048
Partner businesses only. Points have no cash value. Terms apply.
This site uses only essential cookies, which it needs to work. We don’t use analytics or advertising cookies.