Privacy Policy

SubAndWin is run by Tech Savvy Labs Ltd (RC 7444696), a company registered in Nigeria with its registered office at No. 8B, Eti-Osa Way, Lagos Island, Lagos State, Nigeria. We decide how and why your personal data is used on SubAndWin, so we are its data controller under the Nigeria Data Protection Act 2023 (NDPA) and the rules of the Nigeria Data Protection Commission (NDPC).

For anything about your data, including requests to see or delete it, email support@subandwin.com. A member of our team responsible for data protection will reply.

We collect only what we need to deliver your top-ups, run your account and keep it safe.

Your phone number

It is your SubAndWin account. We use it to send your sign-in codes, your receipts and electricity tokens, and to confirm withdrawals.

What you buy

The numbers and prepaid meters you top up, the meter owner's name that the electricity company returns when you check a meter, what you bought, when, the price, and whether it was delivered.

Your wallet and winnings

Money added, spent, refunded and won, your bonus points, and the entries and score picks you make.

Withdrawals

The bank or wallet name, account number and account name you send winnings to.

Personal transfer account (optional)

If you ask for your own account number for bank transfers, the name, BVN and bank account you enter go straight to Paystack, which must verify your identity under Central Bank of Nigeria rules. We keep the account number Paystack gives you, never your BVN.

Payments

Paystack handles your card, bank and USSD details. We never see or store your card number. Paystack tells us the payment reference, amount, method and result.

Profile (optional)

A display name, a small profile photo, and a backup email for sign-in codes, if you add them. You can change or remove them in Profile at any time.

Help requests

What you write when you report an issue, and our reply.

Device and security data

Your IP address, browser type and sign-in times. We use them to keep you signed in, limit repeated attempts, spot fraud and fix problems.

Notifications (optional)

If you turn on notifications, the push address your browser or phone gives us for this device.

We do not collect your contacts, location, photos (other than the one profile photo you choose) or anything on your device beyond what is listed here.

The NDPA allows personal data to be used only for a lawful reason. Ours are:

• To provide the service you asked for (performing our contract with you): signing you in, delivering top-ups, running your wallet, entries, points and withdrawals, sending receipts and tokens, and answering help requests.
• To meet our legal duties: keeping financial records, helping our payment partners meet their own know-your-customer and anti-fraud duties, and answering lawful requests from regulators, courts or the police.
• For our legitimate interests, balanced against your rights: protecting accounts and payments from fraud and abuse, keeping the service running and improving it, and enforcing our Terms of Use.
• With your consent: notifications, a backup email and a profile photo. You can withdraw consent at any time by turning notifications off or removing the email or photo in Profile. This doesn't affect anything done before.

We don't send you marketing messages unless you ask for them, we don't sell your data, and we don't make decisions about you based only on automated processing that have legal or similarly significant effects.

We share personal data only with companies that help us run SubAndWin, under contracts that require them to protect it, and only as much as each one needs:

• Paystack, our licensed payment provider, and its partner banks: payments, wallet top-ups, personal transfer accounts and withdrawals.
• Our licensed VTU and bill-payment partners (such as VTpass, ClubKonnect and Peyflex), mobile networks and electricity distribution companies: the number or meter, product and amount, so your top-up can be delivered.
• Termii: your phone number or email, to send sign-in codes, receipts and tokens by call, text or email.
• Vercel and Supabase: they host our website and database.
• The push services built into browsers and phones (from Google, Apple, Mozilla and Microsoft): they carry your notifications, which are encrypted so only your device can read them.
• Government bodies, regulators or courts, when the law requires it.

Some things on SubAndWin are public by design: recent activity on our homepage, shared entry slips and match night results show a masked number such as 0803•••234, never your full number or name.

Our website and database are hosted in the United Kingdom (London). When your data leaves Nigeria, we rely on the grounds the NDPA allows, such as the receiving country's adequate level of protection and contractual safeguards with our providers, and we apply the same protections described here.

We use a few small cookies that SubAndWin needs to work. There are no advertising or tracking cookies.

sw_session

Keeps you signed in, for up to 30 days. It holds a random key, never your number.

sw_signed_in

Lets the page show that you're signed in. It holds a masked number such as 0803***234.

sw_ref

Remembers the invite code of the friend whose link you followed, so they can earn their points.

sw_orders

Lets the browser that paid for an order see it and its electricity token without signing in.

Your browser's own storage

Small choices such as hiding the install card, and whether we've already celebrated a purchase on this tab.

Staff who use our admin tools get one more cookie for that. You can clear cookies in your browser at any time; you'll just need to sign in again.

• Sign-in codes: a few minutes. We store them scrambled, and they can be used once.
• Sign-ins: up to 30 days, or until you sign out.
• Purchases, payments, wallet records and withdrawals: as long as Nigerian tax and company law requires financial records to be kept (generally six years), even after you close your account.
• Your profile name, photo and backup email: until you remove them or close your account.
• Notification addresses: until you turn notifications off or the push service tells us your device has unsubscribed.
• Help requests: as long as we need them to resolve the issue and keep a record of our answer.

Under the NDPA you have the right to:

• be told how your data is used (this policy);
• get a copy of the personal data we hold about you;
• have wrong or incomplete data corrected;
• have your data deleted, unless we must keep it by law;
• restrict or object to how we use it, including where we rely on our legitimate interests;
• receive your data in a common, machine-readable format, or have it sent to another company;
• withdraw consent you've given, at any time;
• not be subject to decisions based solely on automated processing that significantly affect you.

You can change your name, photo, backup email and phone number yourself in Profile. For anything else, email support@subandwin.com from your backup email or tell us your number; we may confirm it's you with a code to your phone first. We'll reply within 30 days.

If you're not happy with how we handle your data, please tell us first so we can put it right. You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

• Everything between your device and SubAndWin is encrypted (HTTPS).
• Sign-in, withdrawal and admin codes are stored scrambled and expire within minutes. Withdrawals and number changes always need a fresh code to your phone.
• Your BVN is never stored by SubAndWin, and we never see card details.
• Only staff who need it can see customer data. Every admin action is recorded in an audit log, and admin access needs its own code.

If a breach of personal data is likely to put your rights at risk, we will report it to the NDPC within 72 hours of becoming aware of it, as the NDPA requires, and tell you directly, in plain language, when it's likely to put you at high risk, with what we're doing and what you can do.

SubAndWin is for people aged 18 and over. We don't knowingly collect data about children. If you think a child has used SubAndWin, email support@subandwin.com and we'll close the account.

When we change this policy, we'll update the date at the top. If a change is significant, we'll tell you on SubAndWin before it takes effect.

Tech Savvy Labs Ltd (RC 7444696), No. 8B, Eti-Osa Way, Lagos Island, Lagos State, Nigeria. Email support@subandwin.com.