Supporting Countries
NGN
GHS
Effective Date: September 2025
This Privacy Policy explains how The Tonic Technologies Limited ("Cardtonic", "we", "our", "us") collects, uses, stores, and protects your personal information when you use our website, mobile app, and related services (the "Platform").
By using Cardtonic, you consent to the practices described in this Policy.
We may collect the following categories of personal information:a. Information you provide directly:• Full name, date of birth, contact details.• Government-issued ID and proof of address (for KYC).• Payment/bank account details.b. Information collected automatically:• Device information (IP address, browser type, OS).• Usage data (pages visited, time spent, transaction activity).c. Information from third parties:• Verification service providers, regulators, fraud prevention agencies.
We process your personal data for the following purposes:• To create and manage your Cardtonic account.• To verify your identity and comply with AML/CFT laws.• To process transactions and provide services.• To detect and prevent fraud and misuse of the Platform.• To communicate with you (e.g., service updates, support).• To comply with legal and regulatory obligations in Nigeria and Ghana.
We rely on one or more of the following legal grounds:• Consent – when you agree to the processing of your data.• Contractual necessity – to provide our services.• Legal obligation – to comply with AML/CFT and data protection laws.• Legitimate interest – to improve our services and ensure platform security.
We may share your data with:• Regulators and law enforcement (e.g., NDPC in Nigeria, DPC in Ghana, EFCC, SCUML, Bank of Ghana, CBN) where required by law.• Third-party service providers (payment processors, KYC/AML vendors, cloud hosting providers).• Business partners where necessary to fulfill transactions.We do not sell your personal data.
Where your data is transferred outside Nigeria or Ghana, we ensure adequate protection through:• Countries with adequate data protection laws; or• Standard contractual safeguards with our service providers.
We retain personal data only as long as necessary for:• Providing services and managing your account.• Compliance with legal and regulatory obligations (e.g., AML recordkeeping requirements – typically 5–7 years).• Resolving disputes and enforcing our Terms.
We apply appropriate technical and organizational measures to protect your data, including:• Encryption of sensitive information.• Access controls and monitoring.• Regular audits and vulnerability testing.
Depending on whether you are in Nigeria or Ghana, you have rights under applicable law to:• Access the personal data we hold about you.• Request correction or deletion of inaccurate data.• Withdraw consent (where processing is based on consent).• Restrict or object to certain processing.• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or the Ghana Data Protection Commission (DPC).Requests can be sent to: legal@cardtonic.com.
We may use cookies and similar technologies to improve user experience and analyze Platform performance. You can adjust your browser settings to disable cookies, but some features may not function properly.
Our services are not directed to individuals under 18. We do not knowingly collect personal data from children.
We may update this Privacy Policy from time to time. Updates will be posted on our website/app, and continued use of the Platform constitutes acceptance of the revised Policy.
Nigeria: Cardtonic is duly registered with the Nigeria Data Protection Commission (NDPC) as a Data Controller of Major Importance, in compliance with the Nigeria Data Protection Act, 2023.Ghana: Cardtonic complies with the Data Protection Act, 2012 (Act 843) and will maintain registration with the Ghana Data Protection Commission (DPC) as required.
If you have questions or concerns about this Policy:Nigeria: legal@cardtonic.com