RÍNLY PRIVACY POLICY

1.0 About This Privacy Policy

Rínly ("Rínly", "we", "us", or "our") is a digital platform that enables student associations and event organizers to collect dues and sell event tickets electronically respectively. This Privacy Policy explains how we collect, use, store, share, and protect personal data in connection with your use of our website, mobile applications, and related services (collectively, the "Platform").

By accessing or using the Platform in any way, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with how we handle personal data as described here, you should not use the Platform. This Policy should be read alongside our Terms of Service.

2.0 The Data We Collect About You

The data we collect depends on how you use the Platform.

2.1 If you are an Association or Event Organizer, we collect:

• Identity and contact data (name, email, phone number, role/title);
• Business or association details (association name, institutional affiliation, event details);
• Bank account and settlement information; and
• Any information you upload or provide about your Members or Attendees for the purpose of managing dues collection or ticket sales.

2.2 If you are a Member or Attendee, we collect:

• Identity and contact data (name, email address, phone number);
• Institutional data where relevant to the Association or event (such as course of study, level, or matriculation details), where this is requested by the Association or Event Organizer as part of registration; and
• Payment data necessary to process your dues or ticket payment (processed through our third-party payment processor — see Section 5.0).

2.3 Information we collect automatically:

Including your IP address, device identifiers, browser type, and information about how you use the Platform.

2.4 Information from third parties:

Including our payment processing partner and any identity verification services we use to comply with our legal obligations.

3.0 Cookies and How We Use Them

Cookies allow us to distinguish you from other users and improve your experience on the Platform. We use cookies to:

• Recognize and count visitors and understand how they move around the Platform;
• Remember your preferences and login state; and
• Where applicable, measure the performance of the Platform.

You can control or disable cookies through your browser settings, though this may affect certain features of the Platform.

4.0 How We Use Your Personal Data

We use personal data to:

• Register and manage Association, Event Organizer, Member, and Attendee accounts;
• Process dues payments and ticket sales, and maintain the Payment Registry;
• Enable Associations and Event Organizers to communicate with their own Members and Attendees;
• Generate the data exports described in Section 6.0;
• Detect and prevent fraud, and comply with chargeback and dispute processes;
• Improve and maintain the security of the Platform; and
• Comply with our legal and regulatory obligations, including under the Nigeria Data Protection Act 2023.

The lawful bases we rely on include your consent, the necessity of processing to perform our services to you, and our need to comply with applicable law.

5.0 How We Share Your Personal Data

We may share personal data with:

• Our payment processing partner, BudPay (a product of Bud Infrastructure Limited), in order to process dues and ticket payments, settle funds, and carry out fraud and compliance checks. BudPay processes this data under its own privacy policy in addition to this one;
• The Association or Event Organizer you are paying dues to or purchasing a ticket from, to the extent necessary for them to manage their membership or event (see Section 6.0 on CSV exports);
• Third-party service providers who support our infrastructure, such as hosting, analytics, and customer support providers, under confidentiality obligations consistent with this Policy;
• Regulators or law enforcement, where required by law or in connection with fraud prevention; and
• A successor entity, in the event of a merger, acquisition, or sale of business assets.

We do not sell personal data to third parties for their own marketing purposes, and we require any third party we share data with to use it only for the purposes we authorize.

6.0 CSV Data Export by Associations and Event Organizers

As part of the Platform, Associations and Event Organizers may download a CSV file containing information submitted by their Members or Attendees, which may include name, email address, phone number, course of study, level, and similar registration details.

6.1 This export feature exists to help Associations and Event Organizers manage their own membership or event administration, and is limited to data reasonably necessary for that purpose.

6.2 Once an Association or Event Organizer downloads this data, they act as an independent data controller for that data and are responsible for handling it in accordance with the Nigeria Data Protection Act 2023 and any other applicable law. Rínly is not responsible for how an Association or Event Organizer uses, stores, or discloses data after it has been exported from the Platform.

6.3 Associations and Event Organizers must only use exported data for legitimate purposes connected to their association or event — such as communicating with their own Members or Attendees — and must not sell, rent, or use it for unrelated marketing, nor retain it for longer than reasonably necessary.

6.4 By registering as a Member or Attendee and providing your information through the Platform, you acknowledge that the Association or Event Organizer you are transacting with may access and download the information you submit to them.

6.5 Associations and Event Organizers must notify Rínly immediately of any actual or suspected breach involving data they have exported from the Platform.

7.0 International Transfers

Where necessary to provide our services (including through BudPay or other infrastructure providers), your personal data may be transferred to and processed in a country other than Nigeria. Where this occurs, we take reasonable steps to ensure your data continues to receive an appropriate level of protection consistent with this Policy and applicable law.

8.0 Data Security

We implement reasonable technical and organizational measures to protect personal data against accidental loss, unauthorized access, alteration, or disclosure, including access controls, encryption where appropriate, and periodic security reviews. Payment card data is processed by BudPay in compliance with the Payment Card Industry Data Security Standard (PCI DSS); we do not store full card details on our own servers.

We limit access to personal data to employees, agents, and contractors who have a legitimate business need for it, and we have procedures in place to detect and respond to suspected data breaches, including notifying affected Users and applicable regulators where we are legally required to do so.

9.0 Data Retention

We retain personal data for as long as necessary to provide the Platform to you, comply with our legal and regulatory obligations, resolve disputes, and enforce our agreements. Where you close your account, we may retain certain records (such as transaction and payment history) for the period required by applicable law or by our payment processing partner.

10.0 Your Legal Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request erasure of your data, subject to our legal and record-keeping obligations;
• Object to or request restriction of certain processing; and
• Withdraw consent, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us using the details in Section 13.0. If your data was submitted to an Association or Event Organizer directly (for example, during event registration), you may also need to contact them directly regarding data they have already exported under Section 6.0.

11.0 Age Restriction

The Platform is directed at individuals aged 18 and above. We do not knowingly collect personal data from individuals under 18 without the involvement of a parent, guardian, or authorized institutional representative. If you believe a minor has provided us with personal data without appropriate consent, please contact us using the details in Section 13.0.

12.0 Changes and Updates to This Privacy Policy

We may update or amend this Privacy Policy from time to time. Any changes will be posted on this page, and material changes will be indicated by an updated "Last Updated" date. Continued use of the Platform after changes take effect constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically.

13.0 Contact Us

If you have questions about this Privacy Policy, or wish to exercise your legal rights in respect of your personal data, please contact us at:

• Email: rinlytechnologyservices@gmail.com
• Address: Camp Davies Road, Ipaja, Lagos, Nigeria