Privacy Policy

1. Who we are

Matchwik (“Matchwik”, “we”) runs the Matchwik website and app and is the controller of the personal data described here. Questions about your data go to privacy@matchwik.com. This policy applies alongside our Terms and Conditions.

2. What we collect

• Account details: username, email address, phone number (when you add one), a hashed password (never the password itself), profile picture and bio, and your referral code.
• Google sign-in: if you sign in with Google we receive your verified email address, your Google account ID and your profile picture from Google. We do not receive your Google password.
• Identity verification: to unlock withdrawals we ask for your legal first and last name, date of birth, and your NIN (and later your BVN). The numbers are sent to our verification partner to be checked. We keep only a one-way hash of each number, the result of the check and the partner’s reference, not the readable number.
• Wallet and payments: your balances, deposits, withdrawals and full transaction history; the bank accounts you save for withdrawals (bank, account number and the account name our provider resolves); and, if you save a card, its brand, last four digits, expiry and a token from the payment provider. We never see or store your full card number.
• Activity: the Contests, Circles, pools, picks, notifications and disputes you take part in, and your settings (such as whether your Contest history and leaderboard position are public).
• Technical and security data: sign-in attempts, session tokens (stored hashed), push-notification tokens if you turn notifications on, and IP address and device or browser details in security and audit logs.
• Communications: messages you send to support.

3. Why we use it, and our legal basis

• To provide Matchwik (contract): run your account, wallet, Contests and pools, settle results and pay winners.
• To verify identity and meet the law (legal obligation): know-your-customer checks, anti-money-laundering and fraud controls, keeping financial records, responding to lawful requests from authorities.
• To keep Matchwik safe (legitimate interests): prevent fraud, multiple accounts, collusion and abuse, secure accounts, investigate disputes and fix problems.
• To communicate with you: verification codes, security notices, Contest and payment updates (these are part of the service), and support replies.
• With your consent, where we ask for it, for example push notifications. You can withdraw consent at any time.

4. Who we share it with

We do not sell your personal data. We share it only as needed, with:

• Other players: your username, profile picture and bio; your Circle display name; your finishing position and picks in pools you enter (picks are visible to that Circle once a gameweek locks); your Contest history and global leaderboard position unless you turn those off in Settings.
• Service providers who process data for us: payment providers (Paystack, Flutterwave), identity verification (Prembly), SMS delivery (Termii), email delivery, Google (sign-in), and our hosting and infrastructure providers. Sports data providers supply fixtures and results and do not receive your personal data.
• Authorities and advisers where the law requires, to enforce our Terms, or to protect people from fraud or harm.
• A buyer or successor if our business is ever sold or restructured, on the same protections.

Some providers process data outside Nigeria. Where they do, we require appropriate safeguards for it.

5. How long we keep it

We keep your data while your account is open and afterwards for as long as we need it for the purposes above, including the periods the law requires for financial and verification records. When it is no longer needed we delete it or anonymise it. Some records (such as transaction history and audit logs) must be kept even after you close your account.

6. How we protect it

Passwords and identity numbers are stored hashed; session tokens are stored hashed; data is encrypted in transit; access to personal data is limited to staff who need it, and staff sign-in uses two-factor authentication. No system is perfectly secure, so please use a strong, unique password and keep your devices safe. If something goes wrong that affects your data we will tell you and the regulator as the law requires.

7. Your rights

Under the Nigeria Data Protection Act 2023 you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong or incomplete;
• delete your data, where we no longer need it or are not required to keep it;
• restrict or object to certain uses, and withdraw consent you gave;
• give you your data in a portable format, where applicable.

Email privacy@matchwik.com. We may need to confirm who you are first, and some requests are limited where we must keep records by law. You can also change your username, bio and privacy settings yourself in Settings. If you are unhappy with how we handle your data you can complain to the Nigeria Data Protection Commission.

8. Cookies and local storage

We do not use advertising or analytics cookies. The website stores your sign-in session and a few preferences (for example recent codes you looked up) in your browser’s local storage so you stay signed in and things work as you left them. Signing out clears your session; you can clear the rest in your browser settings.

9. Children

Matchwik is only for people aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a child has an account, tell us and we will close it.

10. Changes to this policy

We may update this policy and will show the date at the top. For material changes we will let you know in the app or by email.

11. Contact

Matchwik, Lagos, Nigeria. Privacy questions: privacy@matchwik.com. General support: support@matchwik.com.