🎁
🎈
🎊
✨
Loading the magic...
CELEBRATEME DIGITAL TECHNOLOGY LTD PRIVACY POLICY
Version: 1.0 Effective Date: December 2025 Last Reviewed: April 2026
Celebrateme Digital Technology Ltd ("Celebrateme," "the Company," "we," "us," or "our"), duly incorporated under the laws of the Federal Republic of Nigeria, is committed to protecting the personal data and privacy of all individuals who interact with the Celebrateme platform ("Platform").
This Privacy Policy ("Policy") sets out the basis on which we collect, use, process, store, share, and protect personal data in connection with the Platform, in compliance with the Nigeria Data Protection Regulation 2019 (NDPR), as administered by the National Information Technology Development Agency (NITDA), and consistent with the principles of the General Data Protection Regulation (EU) 2016/679 (GDPR) where applicable to Users in relevant jurisdictions.
By using the Platform, you acknowledge that you have read this Policy and consent to the practices described herein. This Policy forms part of our Terms of Service and should be read in conjunction therewith.
Data Controller: Celebrateme Digital Technology Ltd RC Number: 9203610 Registered Address: Lagos, Nigeria Privacy Contact: legal@celebrateme.co
1. Definitions
1.1 "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, phone number, device identifiers, location data, financial data, and usage data.
1.2 "Processing" means any operation or set of operations performed on Personal Data, whether by automated means or otherwise, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
1.3 "Data Subject" means any natural person whose Personal Data is processed by the Company.
1.4 "Consent" means a freely given, specific, informed, and unambiguous indication by the Data Subject of agreement to the Processing of their Personal Data.
1.5 "Third Party" means any natural or legal person other than the Data Subject, the Company, and any data processors acting under the direct authority of the Company.
1.6 "Cookies" means small text files placed on a User's device by the Platform for the purposes described in Part VI of this Policy.
2. Categories of Personal Data Collected
We collect the following categories of Personal Data, depending on how you interact with the Platform:
2.1 Registration and Identity Data
2.2 Authentication and Security Data
X-Device-ID header) used for session management and fraud prevention2.3 Financial and Transaction Data
Note: Celebrateme does not store full card numbers or CVV data. Payment card processing is handled exclusively by PCI-DSS compliant third-party payment processors.
2.4 Device and Technical Data
2.5 Push Notification and Communication Tokens
2.6 User-Generated Content
2.7 Gamification and Behavioural Data
3. Data We Do Not Collect
We do not knowingly collect:
4. Purposes and Legal Bases for Processing
We process your Personal Data for the following purposes and on the following legal bases:
Purpose -> Legal Basis
Account creation and authentication -> Contractual necessity; Consent
Processing Token purchases and Gift transactions -> Contractual necessity
Fraud prevention and security monitoring -> Legitimate interests; Legal obligation
Processing Withdrawal requests -> Contractual necessity
Sending service-critical notifications -> Contractual necessity
Sending marketing and promotional communications -> Consent (opt-in)
Improving Platform features and user experience -> Legitimate interests
Compliance with legal and regulatory obligations -> Legal obligation
Leaderboard and gamification feature delivery -> Contractual necessity; Legitimate interests
Resolving disputes and enforcing our Terms -> Legitimate interests; Legal obligation
5. Marketing Emails and Promotional Communications
5.1 Opt-In Basis. With your express consent, provided at the time of Account registration or subsequently through your Account settings, Celebrateme may send you marketing emails, newsletters, promotional offers, event highlights, and platform updates.
5.2 Right to Unsubscribe. You have the absolute right to withdraw your consent to receive marketing communications at any time, at no cost and without detriment to your access to the Platform. You may unsubscribe by:
(a) clicking the "Unsubscribe" link included in every marketing email we send; or
(b) updating your notification preferences within your Account settings; or
(c) sending a written request to legal@celebrateme.co with the subject line "Marketing Opt-Out."
5.3 Effect of Unsubscription. Unsubscribing from marketing communications will not affect your receipt of service-critical notifications necessary for the operation of your Account (e.g., transaction confirmations, security alerts, Withdrawal notifications).
5.4 Frequency and Content. We will not send marketing communications at a frequency or volume that constitutes spam. All marketing communications will clearly identify Celebrateme as the sender.
6. We Do Not Sell Your Data
Celebrateme Digital Technology Ltd does not sell, rent, trade, or otherwise transfer your Personal Data to any Third Party for commercial or marketing purposes. This is an absolute commitment.
7. Authorised Disclosures
We may share your Personal Data only in the following strictly limited circumstances:
7.1 Service Providers and Data Processors. We engage carefully selected third-party service providers who process data strictly on our behalf and under binding data processing agreements that comply with NDPR requirements. These include:
(a) Payment processors: Paystack and Stripe, for the purpose of processing Token purchases and Withdrawal disbursements;
(b) Cloud infrastructure providers: For secure hosting, storage, and database management;
(c) Email delivery services: For transactional and (where consented) marketing email delivery;
(d) Analytics providers: For aggregated, anonymised Platform performance analysis.
All service providers are contractually prohibited from using your Personal Data for any purpose beyond the specific service they provide to us.
7.2 Legal and Regulatory Disclosure. We may disclose Personal Data where required to do so by applicable law, court order, or lawful request from a competent government or regulatory authority, including but not limited to NITDA, the EFCC, FCCPC, or law enforcement agencies acting within their lawful authority.
7.3 Business Transfers. In the event of a merger, acquisition, or sale of all or substantially all of the Company's assets, your Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections. We will notify affected Users of any such transfer.
7.4 Protection of Rights. We may disclose Personal Data where we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of Celebrateme, our Users, or the public.
8. Use of Cookies
8.1 The Platform uses cookies and similar tracking technologies (collectively, "Cookies") to enhance user experience, maintain session security, and gather analytics data.
8.2 Types of Cookies We Use:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Essential Cookies | Required for Platform functionality, authentication, and security | Session / persistent |
| Preference Cookies | Remember your settings and preferences | Up to 12 months |
| Analytics Cookies | Measure Platform usage and performance (anonymised) | Up to 24 months |
| Marketing Cookies | Deliver relevant content (only with consent) | Up to 12 months |
8.3 Cookie Consent. Non-essential Cookies are deployed only with your prior consent, obtained through the Cookie consent banner displayed upon your first visit to the Platform.
8.4 Managing Cookies. You may manage, restrict, or delete Cookies through your browser settings. Please note that disabling essential Cookies may impair the functionality of the Platform.
9. Retention Periods
We retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general retention schedule is as follows:
| Data Category | Retention Period |
|---|---|
| Account and identity data | Duration of Account + 5 years post-closure |
| Transaction and financial records | 7 years (in compliance with Nigerian financial record-keeping requirements) |
| Security and device logs | 12 months |
| Marketing communication records | Until consent is withdrawn + 1 year |
| User-generated content | Duration of Account; or earlier if deleted by User |
Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised in a manner that prevents re-identification.
10. Security Measures
10.1 Celebrateme implements robust technical and organisational security measures to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction. These measures include:
(a) Encryption of data in transit using TLS/SSL protocols;
(b) Encryption of sensitive data at rest;
(c) Role-based access controls limiting employee access to Personal Data;
(d) Regular security audits and penetration testing;
(e) Multi-factor authentication for administrative access.
10.2 Notwithstanding the foregoing, no method of electronic transmission or storage is one hundred percent (100%) secure. Celebrateme cannot guarantee absolute security and shall not be liable for any unauthorised access that occurs despite its reasonable security measures, except where such breach is attributable to the Company's gross negligence or wilful misconduct.
11. Data Breach Notification
11.1 In the event of a Personal Data breach that is likely to result in a risk to the rights and freedoms of Data Subjects, Celebrateme shall:
(a) notify NITDA within seventy-two (72) hours of becoming aware of the breach, in accordance with NDPR requirements;
(b) notify affected Data Subjects without undue delay where the breach is likely to result in a high risk to their rights, providing clear information on the nature of the breach and recommended protective steps.
12. Rights Under NDPR and GDPR
As a Data Subject, you have the following rights in respect of your Personal Data:
12.1 Right of Access. You have the right to request a copy of the Personal Data we hold about you.
12.2 Right to Rectification. You have the right to request correction of inaccurate or incomplete Personal Data.
12.3 Right to Erasure ("Right to be Forgotten"). You have the right to request deletion of your Personal Data, subject to our legal retention obligations.
12.4 Right to Restriction of Processing. You have the right to request that we restrict the processing of your data in certain circumstances.
12.5 Right to Data Portability. You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format.
12.6 Right to Object. You have the right to object to processing based on legitimate interests, including direct marketing.
12.7 Right to Withdraw Consent. Where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
12.8 Right to Lodge a Complaint. You have the right to lodge a complaint with NITDA (the competent supervisory authority under NDPR) or, for Users in applicable jurisdictions, with the relevant data protection authority in your country of residence.
13. Exercising Your Rights
To exercise any of the rights set out in Clause 12, please submit a written request to legal@celebrateme.co with the subject line "Data Subject Rights Request." We will respond within thirty (30) days of receipt, in compliance with NDPR timeframes.
14. Cross-Border Transfers
14.1 Your Personal Data is primarily stored and processed within Nigeria. Where it is necessary to transfer Personal Data outside Nigeria (e.g., to cloud infrastructure providers or payment processors operating internationally), Celebrateme shall ensure that such transfers are subject to appropriate safeguards, including:
(a) Adequacy decisions by NITDA or equivalent competent authority; or
(b) Binding contractual clauses providing equivalent data protection standards.
15. Users Under Sixteen (16) Years
15.1 The Platform is not directed at children under the age of sixteen (16). We do not knowingly collect Personal Data from individuals under this age.
15.2 If we become aware that we have inadvertently collected Personal Data from a person under sixteen (16) years of age, we will take immediate steps to delete such data from our systems.
15.3 Parents or guardians who believe their child has provided Personal Data to the Platform without appropriate consent should contact us immediately at legal@celebrateme.co.
16. Policy Updates
16.1 Celebrateme reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or Platform services.
16.2 Material changes will be notified to Users via the email address associated with their Account and/or via a prominent notice on the Platform.
16.3 Continued use of the Platform following the publication of an updated Policy constitutes acceptance of the revised terms.
For all privacy-related enquiries, data subject rights requests, or complaints, please contact:
Data Protection Officer / Privacy Contact Celebrateme Digital Technology Ltd Email: legal@celebrateme.co Address: [INSERT REGISTERED ADDRESS], Nigeria