Peni Privacy Notice

Last updated: 12 November 2026 Peni helps Nigerian business owners keep their books by chatting with us on WhatsApp or on the web. This notice explains, in plain language, what personal data we collect, why we use it, who we share it with, and the rights you have over it. We handle your data in line with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Commission (NDPC) directives. 1. WHO WE ARE Peni is the data controller for the information described here. If you have any question about your data or this notice, or you want to reach our Data Protection Officer, contact us at privacy@peni.ng. If your business is on a paid plan or has team members, your business is the controller of its own books and Peni processes that data on its behalf. 2. THE DATA WE COLLECT Account and identity data: your name, phone number, business name and type, your role, and your profile photo if you add one. Your business records: the sales, expenses, purchases, stock, prices and notes you send us — as text, voice notes, or photos of receipts and invoices — and the books, reports and balances we build from them. Payment data: when you subscribe, our payment partner Paystack processes your card or bank details. Peni never sees or stores your full card number; we keep only a record that a payment succeeded or failed and when your plan renews. Adviser data (for financial advisers who sign up): your bio, qualifications, the schools you attended and when you graduated, certificates and supporting documents you upload, your photo, the areas and languages you cover, and the prices you set. Technical data: basic device, log and usage information we need to run the service securely and fix problems. 3. HOW WE COLLECT IT We collect data directly from you — through the Peni WhatsApp chat (carried over Meta's WhatsApp Business Platform), the Peni web app, voice notes, and receipt or invoice images you send. We also generate data about your business, such as your ledger, reports and reminders. 4. WHY WE USE YOUR DATA, AND OUR LAWFUL BASIS To provide the service and keep your books — reading your messages, voice notes and receipts, recording confirmed transactions, tracking stock and prices, and producing your reports (lawful basis: performance of our contract with you). To take payment and manage your subscription, trial, renewals and reminders (contract and our legitimate interest in running the service). To connect you with a financial adviser you choose, and to share only the records you agree to share, for as long as you choose (your consent). To keep accounts, meet tax, anti-fraud and other legal duties (legal obligation). To keep the service safe, prevent abuse, and improve how it works (our legitimate interests, balanced against your rights). We ask for your consent where the law requires it, and you can withdraw consent at any time. 5. AUTOMATED READING OF YOUR MESSAGES Peni uses automated tools, including artificial intelligence, to read your messages, voice notes and receipts and suggest a bookkeeping entry. Nothing is posted to your books until you confirm it. We redact obvious sensitive details before processing and do not use your business records to train third-party AI models. You can ask a person to review any decision that affects you and you are never subject to a decision with legal or similarly significant effects based solely on automated processing. 6. WHO WE SHARE IT WITH Meta Platforms, which carries WhatsApp messages between you and Peni. Paystack, which processes subscription payments. Our hosting and infrastructure providers, which store and run the service for us under confidentiality and data-protection terms. AI processing providers, which help read your messages and receipts under strict instructions and confidentiality. A financial adviser or programme you choose — and only the specific records you consent to share, for the period you set. You can withdraw this at any time. We do not sell your personal data, and we do not share it for third-party advertising. 7. KEEPING DATA OUTSIDE NIGERIA (CROSS-BORDER TRANSFERS) Some of our processors store or handle data outside Nigeria. Where we transfer your personal data abroad, we do so only in line with Part VIII of the NDPA — either to a country the NDPC recognises as providing adequate protection, or under contractual and security safeguards that protect your data to a comparable standard. 8. HOW LONG WE KEEP IT We keep your business records for as long as you use Peni and for a reasonable period afterwards, so your books stay complete and we can meet legal and tax obligations. When you close your account you can ask us to delete your data, and we will do so except where the law requires us to keep certain records for a set period. 9. HOW WE PROTECT IT We protect your data with encryption in transit and at rest, strict access controls, tenant isolation so one business can never see another's data, and audit logging. Access to your books is limited to you and the people you add to your business. 10. YOUR RIGHTS Under the NDPA you have the right to: - be informed about how your data is used (this notice); - access a copy of the personal data we hold about you; - have inaccurate or incomplete data corrected; - ask us to delete your data (the right to be forgotten), subject to our legal duties; - restrict or object to certain processing; - receive your data in a portable, machine-readable format, and ask us to transfer it; - withdraw consent at any time, without affecting processing done before you withdrew it; and - not be subject to a decision based solely on automated processing that significantly affects you. To exercise any of these rights, contact privacy@peni.ng. We will respond within the time the law allows and will not charge you for a reasonable request. 11. DATA BREACHES If a breach occurs that is likely to put your rights at risk, we will notify the NDPC within 72 hours of becoming aware of it, and we will tell you without undue delay where the risk to you is high, along with steps you can take to protect yourself. 12. CHILDREN Peni is for business owners and advisers aged 18 and above. We do not knowingly collect data from children. If you believe a child has used Peni, contact us and we will remove the data. 13. COOKIES The Peni web app uses only the cookies and similar storage needed to sign you in and keep the service working. We do not use advertising or cross-site tracking cookies. 14. CHANGES TO THIS NOTICE We may update this notice as Peni grows or the law changes. Each version is numbered and dated. When we publish a material change, we will ask you to read and accept the new version the next time you use Peni. 15. HOW TO COMPLAIN If you are not satisfied with how we handle your data, please contact us first at privacy@peni.ng so we can put it right. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng. Contact: privacy@peni.ng