Privacy Policy

1. Introduction

This Privacy Policy explains how Flexigrid Solutions Ltd ("we", "us", "our" or "PassGuard") collects, uses, shares, and protects personal data through the PassGuard platform ("Platform").

PassGuard is a digital event guest-authentication service. We take the privacy of Hosts and Guests seriously and handle personal data in accordance with the Nigeria Data Protection Act 2023 ("NDPA") and other applicable laws.

Flexigrid Solutions Ltd is registered in Nigeria with company registration number RC 8642152 and is registered with the Nigeria Data Protection Commission ("NDPC") under registration number NDPC/DCP/14276.

2. Our role: controller and processor

The NDPA distinguishes between a data controller (who decides why and how personal data is processed) and a data processor (who processes personal data on a controller's behalf). Our role depends on whose data is involved:

• Host account data — we are the controller. When you register and use the Platform as a Host, we decide how your account data is used to provide and improve the service, and we are the controller for that data.
• Guest data — we are the processor. When a Host uploads or generates personal data about their Guests (such as names, phone numbers, email addresses, guest categories, RSVP status, and check-in records), the Host is the controller and we act as the Host's processor. We process Guest Data on the Host's behalf and in line with their instructions and their own privacy notice.

If you are a Guest and have a question about how your data is used for a specific event, please contact the Host who invited you. We will assist Hosts in responding to such requests.

3. Information we collect

From Hosts, when you register and use the Platform:

• identity and contact details, such as name, email address, phone number, and business or organisation name;
• account and profile information;
• event details you create, such as event names, dates, venues, and guest categories;
• payment-related information (see below); and
• support communications you send to us.

Guest Data, uploaded or generated by Hosts:

• Guest names and contact details, such as phone numbers and email addresses;
• guest categories, plus-one counts, and RSVP status;
• Pass and QR-code identifiers; and
• check-in records, including check-in status and timestamps.

Payment information:

• Payments are processed by Paystack. We do not collect or store your full card number or card security details. We may retain limited transaction records, such as a payment reference, amount, status, and date.

Information we collect automatically:

• device and usage information, such as IP address, browser or device type, and pages or features accessed;
• log data and diagnostic information; and
• cookies and similar technologies used to operate and secure the Platform (see the Cookies section).

4. How we use personal data and our lawful bases

We use personal data for the following purposes, relying on one or more lawful bases under section 25 of the NDPA:

Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect processing carried out before withdrawal.

5. Guest Data and Host responsibilities

We process Guest Data only to provide the Platform to the Host who uploaded it — for example, to generate Passes, dispatch invitations, and record check-ins. We do not use Guest Data for our own independent marketing.

Hosts are responsible for ensuring they have a lawful basis to collect and share Guest Data, and for providing their Guests with any privacy information required by law. If you are a Guest, the Host that invited you is your first point of contact regarding your data.

6. How we share personal data

We share personal data only as needed to run the Platform and as described below:

• Payment provider: Paystack, to process payments.
• Messaging providers: the WhatsApp Business API and Meta, together with SMS and email providers, to deliver invitations and messages to Guests. Guest contact details are shared with these providers only to deliver the messages a Host chooses to send.
• Infrastructure and service providers: hosting, storage, analytics, and security providers that help us operate the Platform, under contracts that require them to protect personal data.
• Legal and regulatory bodies: where we are required to disclose data by law, court order, or a lawful request from a regulator such as the NDPC.
• Business transfers: if we are involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy.

We do not sell personal data.

7. International transfers

Some of our service providers — including messaging and infrastructure providers such as Meta — may process personal data on servers located outside Nigeria. Where we transfer personal data outside Nigeria, we take steps to ensure it is protected in line with the NDPA, for example by transferring only to recipients subject to adequate data protection, by putting appropriate contractual safeguards in place, or by relying on another lawful transfer mechanism.

8. Data retention

We keep personal data only for as long as necessary for the purposes described in this Policy, including:

• Host account data: for as long as your account is active, and for a reasonable period afterwards to meet legal, accounting, and dispute-resolution needs.
• Guest Data: for as long as needed to provide the relevant Event to the Host, and then in line with the Host's instructions. Hosts can request deletion of Guest Data associated with their events.
• Transaction records: for the period required by applicable financial and tax laws.

When personal data is no longer needed, we delete or anonymise it.

9. How we protect personal data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, and alteration. These include access controls, encryption in transit, and restricting access to personal data to those who need it to do their work. No system can be guaranteed completely secure, and we cannot warrant absolute security, but we work to protect your data and to respond promptly to any incident.

10. Your rights under the NDPA

Subject to the conditions and exceptions in the NDPA, you have the right to:

• be informed about how your personal data is used;
• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data in certain circumstances;
• restrict or object to certain processing;
• data portability, where applicable;
• withdraw consent where processing is based on consent; and
• lodge a complaint with the Nigeria Data Protection Commission.

To exercise any of these rights in respect of data for which we are the controller, contact us at info@flexigridsolutions.com. If your request relates to Guest Data for a specific event, we will direct you to, or coordinate with, the relevant Host, who is the controller of that data.

We will respond to requests within the timeframes required by the NDPA. We may need to verify your identity before acting on a request.

11. Cookies and similar technologies

We use cookies and similar technologies to operate the Platform, keep you signed in, remember your preferences, secure your session, and understand how the Platform is used. You can control cookies through your browser settings, though disabling some cookies may affect how the Platform works.

12. Children

The Platform is intended for use by adults organising and managing events. It is not directed at children, and we do not knowingly collect personal data directly from children through the Platform. Where a Host includes a minor as a Guest, the Host is responsible for having the appropriate authority and consent to do so.

13. Changes to this Policy

We may update this Privacy Policy from time to time. Where changes are material, we will take reasonable steps to notify you, for example by posting a notice on the Platform. The "Last updated" date at the top shows when this Policy was last revised.

14. Contact us and complaints

If you have questions, requests, or complaints about this Policy or how we handle personal data, contact us:

Flexigrid Solutions Ltd Email: info@flexigridsolutions.com Address: Plot 1366, Edmund Madani Crescent, Abuja, FCT, Nigeria Company registration number: RC 8642152 NDPC registration number: NDPC/DCP/14276

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data protection rights have been breached.