Privacy Policy

1. Introduction

This Privacy Policy describes how Bluecounts collects, uses, discloses and protects Personal Data in connection with the Platform. It should be read together with the Bluecounts Platform Terms of Use, and it applies to everyone who visits or uses the Platform.

We are committed to protecting your privacy and to processing Personal Data in accordance with the Nigeria Data Protection Act 2023 and other applicable law. Any capitalised terms used but not defined here have the meanings given in the Bluecounts Platform Terms of Use.

2. Scope and Roles

2.1 Controller and Processor. Bluecounts is the controller for Personal Data collected through the Platform for its own purposes (such as account and subscription management). Where a Merchant uploads or processes Personal Data relating to its own business (including data about its customers, students or staff) through the Platform, Bluecounts processes that data on the Merchant's behalf and is a processor.

2.2 What this Policy covers. This Policy covers Personal Data collected: (a) when you visit the Bluecounts website; (b) when you register for or use a Merchant, Admin or other account; (c) when you contact us; (d) when you sign up to learn about Bluecounts through forms on the website (for example, lead-capture forms, which may be processed in a CRM such as Zoho CRM); and (e) when you otherwise interact with the Platform.

2.3 What this Policy does not cover. This Policy does not cover third-party websites or services that are not owned or controlled by Bluecounts, even where links to them appear on the Platform.

3. Definitions

“Personal Data” means any information relating to an identified or identifiable natural person. "Business Data" has the meaning given in the Bluecounts Platform Terms of Use. "Controller", "Processor" and "Data Subject" have the meanings given in applicable data-protection law.

References to "you" cover visitors and Users of the Platform, whether acting as an individual or on behalf of a Merchant or other organization.

4. Information You Provide

4.1 Account and Profile Data. When you register, we collect your name, email address, phone number, business or organization details, password (stored securely) and, where you set one up, a profile. The data may vary by whether you are a merchant, admin or other user.

4.2 Commercial Data. For paid plans, we collect billing and order information, including the payment method you register. Payment details (such as card numbers) are processed by our payment processor (Paystack) and are not stored by Bluecounts.

4.3 Contact and Support Data. When you contact us, use support channels or respond to surveys, we collect the information you provide, including your name, email and the content of your enquiry.

4.4 Lead and Interest Data. When you express interest in Bluecounts (for example through the website's contact or sign-up forms, including any demo or 'get started' requests), we may collect your name, email, company and message. If you consent, a lead record may be created in our CRM (Zoho CRM) so we can respond and, where you have opted in, keep you informed.

4.5 Business Data. Merchants upload or process Business Data through the Platform. We process it on the Merchant's behalf as described in this Policy and do not use it for our own unrelated purposes.

5. Information Collected Automatically

5.1 Technical Data. We collect standard technical information such as IP address, browser type and version, device type, operating system, referring URLs and log data, to provide, secure and improve the Platform.

5.2 Cookies and Similar Technologies. We use Essential Cookies for secure login, sessions and core security. We do not currently deploy non-essential analytics, marketing or advertising trackers. For details, see the Bluecounts Cookie Policy.

5.3 Usage Data. We may collect aggregated, anonymised information about how the Platform is used (for example feature engagement and performance) to improve our services. Aggregated data that cannot identify you is not Personal Data.

6. Information from Third Parties

We may receive information about you from third parties where permitted by law, including payment processors (for payment status), service providers, or publicly available sources. Where we combine that information with other data, we treat the combined data in accordance with this Policy.

Where a Merchant adds staff or users to its account, we receive the basic information needed to create those user accounts.

7. Purposes of Processing

We use Personal Data for the following purposes:

7.1 To provide and operate the Platform, including account creation, authentication, secure sessions and delivering requested functionality.

7.2 To provide customer support and respond to enquiries.

7.3 To manage commercial relationships, including billing, invoicing, renewals, refunds and payment processing.

7.4 To secure the Platform, detect, prevent and investigate fraud, abuse or security incidents, and enforce our Terms.

7.5 To comply with legal obligations and respond to lawful requests from regulators, courts or law enforcement.

7.6 To measure and improve the Platform, including analytics and performance monitoring.

7.7 To communicate with you about your account, the Platform, and important changes to our Terms or policies.

7.8 For direct marketing or lead follow-up only where you have provided the required consent or an existing relationship permits it under applicable law. You can withdraw consent at any time. Where Bluecounts uses AI-based features, it does not train AI models on merchants' Business Data without separate, lawful consent; at the Effective Date, Business Data is not used to train AI models.

8. Legal Bases for Processing

We process Personal Data on one or more of the following bases, as applicable:

8.1 Performance of a Contract, where processing is needed to provide the Platform or services you have requested under the Bluecounts Platform Terms of Use.

8.2 Compliance with a Legal Obligation, where processing is required by law.

8.3 Legitimate Interests, where processing is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override them. Our legitimate interests include operating and securing the Platform, preventing fraud, improving our services and responding to enquiries.

8.4 Consent, where you have given clear consent for a specific purpose (for example, certain marketing communications or non-essential cookies). Consent can be withdrawn at any time.

Where we process Business Data as a processor on a Merchant's behalf, the Merchant is responsible for the legal basis and for providing the required notices to data subjects.

9. How We Share Information

We share Personal Data only in the following circumstances, or where permitted by law:

9.1 With service providers who process data on our behalf to operate the Platform (see Section 10 and Appendix D).

9.2 With our payment processor to process payments; only the minimum information needed for the transaction is shared.

9.3 For lead follow-up, with our CRM provider (Zoho CRM) when you consent to a lead record being created; only the information you provide in the form is shared.

9.4 To comply with law, a court order or a valid government request, or to protect the rights, property or safety of Bluecounts, our Users or the public.

9.5 In connection with a merger, acquisition, reorganization or sale of assets, where we require the recipient to honour this Policy or provide equivalent protections.

We do not sell Personal Data. We do not allow third parties to use Personal Data for their own unrelated purposes, except as described in this Policy.

10. Third-Party Providers

We rely on a small number of service providers to operate the Platform, including cloud hosting and infrastructure, database and object storage, payment processing, email and transactional messaging, and CRM. These providers are bound by appropriate contracts and process data only for the purposes we instruct.

The current sub-processor register is set out in Appendix D. We will update it, and notify affected Users where required, when we make material changes.

11. International Transfers

Bluecounts is based in Nigeria. Some service providers (including infrastructure and CRM providers) may process Personal Data outside Nigeria, including in the European Economic Area, the United Kingdom, the United States and India.

Where Personal Data is transferred internationally, we use appropriate safeguards required by applicable law, including standard contractual clauses where required. The absence of optional browser tracking does not mean all data stays in Nigeria; essential infrastructure may process data abroad as described in this Policy and Appendix D.

12. Security

We implement appropriate technical and organisational measures to protect Personal Data against unauthorised access, loss, alteration or disclosure, including access controls, encryption in transit, secure storage and periodic reviews.

No method of transmission or storage is completely secure. While we work to protect Personal Data, we cannot guarantee absolute security, and we encourage you to use strong credentials and safeguard your account.

Where we become aware of a personal-data breach that creates a risk to affected individuals, we will notify the relevant authorities and affected data subjects as required by applicable law.

13. Data Retention

We keep Personal Data only for as long as necessary for the purposes for which it was collected, or as required by applicable law. Our retention schedule is set out below.

Application and service logs: up to 90 days, except where a longer period is needed for security or legal reasons.

Authentication and security logs: up to 180 days.

Audit and support records (including support tickets): up to 24 months.

Backups: approximately 35 days.

Inactive accounts: up to 60 days after the suspension of an inactive trial or abandoned sign-up, unless reactivated.

Closed accounts: Business Data is exported or returned then deleted within 30 days, except where we must keep limited records to comply with legal or regulatory obligations.

CRM lead records (for example in Zoho CRM): up to 12 months after the last contact, or until consent is withdrawn, unless a longer retention is needed for an active commercial relationship.

Where a longer retention is required by law (including tax and record-keeping law), the legal period prevails. On request, we will tell you the applicable retention period.

14. Your Rights

Subject to applicable law, you have the right to: access your Personal Data; correct inaccurate data; request deletion; restrict or object to processing; request a portable copy in a structured, commonly used format; and withdraw consent at any time where processing is based on consent.

Where we process Personal Data as a processor on a Merchant's behalf, you should contact the relevant Merchant first; we will assist the Merchant to respond to data-subject requests where required.

To exercise your rights, or for any privacy enquiry, contact privacy@bluecounts.com using the official channels in Section 18. We will respond within the time required by applicable law, normally within thirty (30) days, and will communicate the outcome and any necessary explanation.

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or another competent supervisory authority.

15. Cookies

Bluecounts uses Essential Cookies for secure login, sessions and core security, and does not currently deploy non-essential analytics, marketing or advertising trackers. You can learn more about how cookies are used and how to manage them in the Bluecounts Cookie Policy.

Before any non-essential cookie or similar technology is enabled, Bluecounts will request your consent, provide clear accept/reject/manage options, and update this Policy and the Cookie Policy in advance.

16. Children's Privacy

The Platform is not directed at children. We do not knowingly collect Personal Data directly from children under the age of thirteen (13), or the higher age set by applicable law, without parental consent.

Where a Merchant (such as a school or an NGO serving children) processes Personal Data relating to children through the Platform, that Merchant must obtain all required parental or guardian consent, provide the required privacy notices, and comply with applicable law. We act only as processor for such data and do not use it for our own purposes.

If you believe we have inadvertently collected Personal Data from a child, contact privacy@bluecounts.com and we will take appropriate steps to delete it.

17. Changes to this Policy

17.1 We may update this Privacy Policy from time to time to reflect changes in our services, data practices, applicable law or business requirements.

17.2 Where we make material changes, we will provide at least thirty (30) days' prior notice using a reasonable method selected by us, such as an email to the registered address or an in-product notice, and will post the updated Policy on the Platform.

17.3 Changes that are required urgently for legal, security or compliance reasons may take effect on the date stated in the notice.

18. Contact Information

If you have any questions regarding this Privacy Policy or any privacy concern, please contact us using the following official channels:

· Privacy Email: privacy@bluecounts.com · Support Email: support@bluecounts.com · General Enquiries: hello@bluecounts.com · Website: https://bluecounts.com

Business Address: C8/C9 Gidan Halima, Opposite Audu Bako Secretariat, Zaria Road, Kano State, Nigeria.

Our data-protection contact may be reached at privacy@bluecounts.com.