GDPR Compliance Statement
MCO Penny Limited (“we,” “us,” or “our”) is committed to protecting the privacy and personal data of our users in compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679. This GDPR Compliance Statement outlines how we process, store, and protect personal data when you use our website (mcopenny.ng), mobile application, or other related services (collectively, the “Services”) provided by MCO Penny Limited, its affiliates, successors, and permitted assigns. This statement applies to individuals located in the European Economic Area (EEA) whose personal data we process.
1. Data Controller
MCO Penny Limited, with its registered office at [Your Company Address, Lagos, Nigeria], acts as the data controller for the personal data collected through our Services. We are responsible for ensuring that your personal data is processed in compliance with the GDPR.
2. Lawful Basis for Processing Personal Data
We process personal data under the following lawful bases as defined by the GDPR:
- Consent: Where you have given explicit consent for us to process your personal data, such as for receiving promotional communications or enabling certain features of the Services (e.g., geo-location services).
- Contract: Where processing is necessary for the performance of a contract with you, such as providing access to our Services or processing transactions.
- Legitimate Interests: Where processing is necessary for our legitimate interests, provided these interests are not overridden by your rights and freedoms. This includes improving our Services, monitoring usage trends, and ensuring security.
- Legal Obligation: Where processing is required to comply with legal obligations, such as responding to lawful requests from authorities or preventing fraud.
3. Personal Data We Collect
We collect and process personal data as described in our Website Data Usage and Cookie Policy and Privacy Policy, both available at mcopenny.ng. This may include:
- Voluntarily Provided Data: Name, email address, phone number, postal address, account credentials, billing information, job application details, or other information you provide when interacting with our Services.
- Automatically Collected Data: Log information (e.g., IP address, browser type, access times), device information (e.g., hardware model, operating system), and data collected via cookies or similar technologies.
- Geo-Location Data: Location-based information from your device, if you grant permission, to provide location-based services. For a detailed explanation, please refer to our Website Data Usage and Cookie Policy.
4. Purposes of Processing
We process personal data to:
- Provide, maintain, and improve our Services, including the website and mobile application.
- Process transactions, deliver services, and send related confirmations or invoices.
- Respond to inquiries, provide customer support, and send technical or administrative notices.
- Send promotional communications (with your consent) about products, services, offers, or events.
- Monitor and analyze usage trends to enhance user experience and security.
- Comply with legal obligations or protect the rights, property, or safety of MCO Penny Limited, our users, or others.
5. Data Sharing and Transfers
We may share your personal data with:
- Third-Party Service Providers: Entities performing services on our behalf, such as payment processing (e.g., Paystack), data analysis, email delivery, hosting, customer support, or marketing assistance. These providers are bound by contractual obligations to protect your data in accordance with GDPR requirements.
- Legal Authorities: When required to comply with legal obligations or to protect our rights, property, or safety, or that of our users or others.
- Business Transfers: In connection with a merger, acquisition, or sale of assets, subject to appropriate safeguards.
As MCO Penny Limited is based in Nigeria, personal data may be transferred outside the EEA. When transferring data to countries without an adequacy decision from the European Commission, we implement appropriate safeguards, such as Standard Contractual Clauses (SCCs), to ensure GDPR-compliant protection. Where this is not possible (e.g., disclosures to certain government authorities), we rely on GDPR derogations, such as legal obligations or your explicit consent.
6. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, as outlined in our Website Data Usage and Cookie Policy, or to comply with legal obligations. For example:
- Website and mobile application log data is retained for a limited period to monitor performance and security.
- Account or communication data may be retained longer to support ongoing service needs. When personal data is no longer needed, we securely delete or anonymize it in accordance with GDPR requirements.
7. Your GDPR Rights
If you are located in the EEA, you have the following rights under the GDPR:
- Access: Request access to the personal data we hold about you.
- Rectification: Request correction of inaccurate or incomplete personal data.
- Erasure: Request deletion of your personal data, subject to legal or contractual limitations.
- Restriction: Request restriction of processing under certain conditions.
- Data Portability: Request a copy of your personal data in a structured, commonly used, and machine-readable format.
- Objection: Object to processing based on legitimate interests, including for direct marketing purposes.
- Withdraw Consent: Withdraw consent at any time where processing is based on your consent, without affecting the lawfulness of prior processing. To exercise these rights, please contact us at privacy@mcopenny.ng. We will respond to your request within one month, as required by the GDPR, though this may be extended in complex cases. We may need to verify your identity before processing your request.
8. Cookies and Tracking Technologies
We use cookies and similar technologies as described in our Website Data Usage and Cookie Policy. You can manage your cookie preferences by adjusting your browser or device settings or opting out via tools like www.aboutads.info/choices or the Google Analytics Opt-out Browser Add-on. For targeted advertising on platforms like LinkedIn or Twitter, adjust your privacy settings on those platforms.
9. Data Security
We implement appropriate technical, organizational, physical, and administrative measures to protect your personal data from unauthorized access, loss, misuse, alteration, or disclosure. These measures comply with GDPR standards. However, no system is completely secure, and we cannot guarantee absolute protection. If you suspect a security vulnerability, please report it to info@mcopenny.ng.
10.Third-Party Services
Our Services may include links to third-party websites or services (e.g., payment processors). We are not responsible for their data practices. Please review their privacy policies before providing personal data.
11. Complaints
If you believe we have not handled your personal data in accordance with the GDPR, you have the right to lodge a complaint with a supervisory authority in the EEA, such as the authority in the country where you reside, work, or where the alleged infringement occurred. We encourage you to contact us first at privacy@mcopenny.ng to resolve any concerns.
12. Contact Information
For questions about this GDPR Compliance Statement, our data practices, or to exercise your GDPR rights, please contact our data protection officer at: MCO Penny Limited Email: info@mcopenny.ng, Website: mcopenny.ng, Address: i014 Ogba central Mall, Beside Sunday Market, Ogba, Ikeja.
If you have feedback or need assistance, please include relevant details, such as your account information or the nature of your inquiry, to help us respond promptly and effectively.