PRIVACY POLICY: WHO MADE THIS? (WMT)

PRIVACY POLICY: WHO MADE THIS? (WMT)

A WAWU Technology Ltd Product

Last Updated: 26 October 2026 Effective Date: 26 October 2026

1. INTRODUCTION AND SCOPE

This Privacy Policy explains how WAWU Technology Ltd ("WAWU," "we," "us," or "our") collects, uses, stores, shares, and protects personal data when you use the WHO MADE THIS? (WMT) mobile application, website (wawuafrica.com), and related services (collectively, the "Platform").

WMT is the creators and professionals monetization platform operated by WAWU. This Policy applies to all users of the Platform, including creators, professionals, businesses, and visitors.

This Policy is drafted to comply with the Nigeria Data Protection Act 2023 (NDPA), the NDPA General Application and Implementation Directive 2025 (GAID), the UK General Data Protection Regulation (UK GDPR) where applicable, and the privacy requirements of the Apple App Store and Google Play Store.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. Where processing is based on consent, you have the right to withdraw that consent at any time.

2. DEFINITIONS

Personal Data means any information relating to an identified or identifiable natural person.

Data Subject means the individual to whom personal data relates (you).

Data Controller means WAWU Technology Ltd, which determines the purposes and means of processing.

Data Processor means a third party that processes personal data on behalf of WAWU.

Processing means any operation performed on personal data, including collection, storage, use, disclosure, and deletion.

Sensitive Personal Data means data revealing racial or ethnic origin, political opinions, religious beliefs, health, genetic or biometric data, or data concerning a person's sex life.

3. DATA WE COLLECT

We collect the following categories of personal data:

Information You Provide Directly

We collect your identity data, including your full name, username, date of birth, and government-issued ID for verification purposes. We collect your contact data, including email address, phone number, and physical address. We collect your profile data, including profile photo, bio, discipline, and portfolio links. We collect your content data, including the music, designs, videos, photographs, written works, courses, and products you upload. We collect your financial data, including bank account details, wallet information, and payment history. We collect your verification data, including government-issued ID, biometric data for liveness checks, and self-attested documents. We also collect communication data, including messages, support tickets, feedback, and survey responses.

Information Collected Automatically

We collect device data, including device type, operating system, unique device identifiers, and mobile network. We collect usage data, including features accessed, time spent, pages viewed, and interactions. We collect approximate location data at the city or region level. We collect log data, including IP address, access times, error logs, and crash reports.

Information from Third Parties

We receive identity verification results from our KYC partners. We receive transaction confirmations and payment status from payment processors. If you sign in via Google, Apple, or other social login providers, we receive basic profile information. We may receive information from partners who refer you to the Platform, such as training programs and innovation hubs.

4. HOW WE USE YOUR DATA

We process personal data for the following purposes and lawful bases:

We create and manage your account on the basis of performance of a contract.

We verify your identity and prevent fraud on the basis of legal obligation and legitimate interest.

We enable you to sell products and services and receive payments on the basis of performance of a contract.

We process transactions and payouts on the basis of performance of a contract and legal obligation.

We provide customer support on the basis of performance of a contract and legitimate interest.

We improve and develop the Platform on the basis of legitimate interest.

We send service-related communications, including receipts and security alerts, on the basis of performance of a contract and legal obligation.

We send marketing communications only where you have given consent.

We comply with legal and regulatory obligations, including those of the NDPC, FCCPC, and tax authorities, on the basis of legal obligation.

We enforce our Terms of Service on the basis of legitimate interest.

We protect against security threats on the basis of legitimate interest and legal obligation.

We will only send you marketing communications where you have opted in. You can withdraw consent at any time by using the unsubscribe link in any email or by contacting us.

5. DATA SHARING AND DISCLOSURE

We do not sell your personal data. We share data only as described below.

Service Providers (Data Processors)

We engage trusted third parties to perform services on our behalf. These include payment processors, cloud hosting providers, identity verification partners, communication providers, analytics providers, and customer support platforms. All processors are contractually bound to protect your data and process it only on our instructions.

Partners

Where you engage with a partner through the Platform, including training providers, logistics partners, and streaming partners, we may share necessary data to facilitate the service. Partners are required to comply with applicable data protection laws.

Legal and Regulatory Disclosures

We may disclose personal data where required by law, court order, or a competent authority. This includes the Nigeria Data Protection Commission (NDPC), the Federal Competition and Consumer Protection Commission (FCCPC), law enforcement agencies, and tax authorities.

Business Transfers

In the event of a merger, acquisition, or sale of assets, personal data may be transferred. We will notify you of any such change and your rights.

With Your Consent

We may share data for other purposes where you have given explicit consent.

6. CROSS-BORDER DATA TRANSFERS

WAWU is incorporated in Nigeria. Where we transfer personal data outside Nigeria, we comply with Part VIII of the NDPA and Schedule 5 of the GAID.

We may transfer data to a country deemed adequate by the NDPC. We may use a Cross-Border Data Transfer Instrument (CBDTI), including approved contractual clauses, binding corporate rules, or codes of conduct. We may rely on derogations where you have given explicit consent after being informed of risks, where necessary for contract performance, for legal claims, or for vital interests.

Where we use international service providers, including cloud hosting, we ensure appropriate safeguards are in place, including standard contractual clauses approved by the NDPC.

Where UK data subjects are involved, we comply with UK international transfer requirements.

7. DATA SECURITY

We implement robust technical and organizational measures to protect personal data. These include encryption of data in transit (TLS/SSL) and at rest, access controls and role-based permissions, multi-factor authentication for administrative access, regular security audits and vulnerability assessments, employee training on data protection, and incident response and breach notification procedures.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the NDPC within 72 hours and inform you without undue delay where the breach is likely to result in high risk.

8. DATA RETENTION

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected.

We retain account data for the duration of your account plus seven years to meet legal and tax requirements.

We retain verification data for the duration of your account plus seven years for regulatory compliance.

We retain transaction records for seven years in accordance with financial regulations.

We retain content data until you delete it or close your account, then for a further 90 days.

We retain communication data for three years from the last interaction.

We retain usage and analytics data for two years, after which it is aggregated or anonymized.

When retention periods expire, we securely delete or anonymize the data.

9. YOUR RIGHTS

Under the NDPA and applicable laws, you have the following rights.

You have the right to be informed about what data we collect and how we use it.

You have the right to access a copy of your personal data.

You have the right to rectification of inaccurate or incomplete data.

You have the right to erasure, also known as the right to be forgotten, subject to legal retention obligations.

You have the right to restrict processing, limiting how we process your data.

You have the right to data portability, receiving your data in a structured, machine-readable format.

You have the right to object to processing based on legitimate interests.

You have the right to withdraw consent at any time where processing is based on consent.

You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise your rights, contact our Data Protection Officer at privacy@wawuafrica.com. We will respond within 30 days. We may need to verify your identity before processing your request.

You can delete your account from within the app (Settings > Account > Delete Account) or by contacting support@wawuafrica.com. Deleting your account removes your profile and content, subject to legal retention requirements.

10. CHILDREN'S PRIVACY

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child has provided personal data, we will delete it promptly. If you believe a child has provided data, contact us at privacy@wawuafrica.com.

11. COOKIES AND TRACKING TECHNOLOGIES

We use cookies, pixels, and similar technologies on our website and app to maintain your session and preferences, to analyze usage and improve the Platform, and to deliver relevant marketing where you have given consent.

You can manage cookie preferences through your browser settings. For app tracking, you can control permissions through your device settings.

12. THIRD-PARTY LINKS AND SERVICES

The Platform may contain links to third-party websites or integrate third-party services, including payment processors and streaming partners. This Privacy Policy does not apply to those third parties. We encourage you to review their privacy policies.

13. AUTOMATED DECISION-MAKING

We may use automated processes for identity verification, including automated checks against databases and biometric liveness detection, and for fraud detection, including automated monitoring for suspicious activity.

You have the right to request human review of automated decisions that significantly affect you. Contact privacy@wawuafrica.com.

14. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 14 days before they take effect. The "Last Updated" date at the top indicates when the Policy was last revised. Continued use of the Platform after changes constitutes acceptance.

15. CONTACT US

Data Controller: WAWU Technology Ltd Registered Address: 5 Ikoyi Crescent, Lagos, Nigeria

Data Protection Officer (DPO): Email: privacy@wawuafrica.com Phone: +234 705 072 2222

Support: Email: support@wawuafrica.com WhatsApp: +234 705 072 2222

Regulatory Authority: Nigeria Data Protection Commission (NDPC) Website: ndpc.gov.ng

16. APP STORE SPECIFIC DISCLOSURES

Apple App Store

This Privacy Policy is accessible via the App Store product page and within the app (Settings > Privacy Policy). Our App Privacy disclosures in App Store Connect are consistent with this Policy.

Google Play Store

This Privacy Policy is hosted at an active, publicly accessible, non-geofenced URL and is linked in Play Console and within the app. Our Data Safety declarations are consistent with this Policy.

17. SPECIAL PROVISIONS FOR CREATOR MONETIZATION

Financial Data

To enable you to receive payments, we collect bank account details and transaction information. This data is shared with licensed payment processors and is subject to financial regulatory retention requirements.

Tax Compliance

We may collect tax identification information, such as TIN, where required by Nigerian tax laws. This data is shared with tax authorities as required by law.

Content Ownership

You retain ownership of the content you upload. Our use of your content is governed by our Terms of Service. This Privacy Policy governs the personal data associated with your content, including your name and profile information.

18. DATA PROTECTION IMPACT ASSESSMENTS (DPIA)

We conduct DPIAs for high-risk processing activities, including large-scale processing of sensitive data, systematic monitoring, cross-border data transfers, and deployment of new technologies.

DPIAs are conducted in accordance with Article 7(o) and 28 of the GAID.

19. RECORDS OF PROCESSING ACTIVITIES (ROPA)

We maintain comprehensive Records of Processing Activities in accordance with NDPA requirements, documenting categories of data subjects and personal data, purposes of processing, recipients of data, cross-border transfers, retention periods, and security measures.

20. GOVERNING LAW

This Privacy Policy is governed by the laws of the Federal Republic of Nigeria. Any disputes arising from this Policy shall be subject to the jurisdiction of Nigerian courts, without prejudice to your rights under applicable data protection laws.

By using WHO MADE THIS?, you acknowledge that you have read and understood this Privacy Policy.