# Pip2Dollar Privacy Policy

**Version 1.0 · Effective 27 August 2026 · Published at https://app.pip2dollar.com/legal/privacy**
*Counsel-approved. Compliant with the Nigeria Data Protection Act 2023 (NDPA).*

Pip2Dollar ("we", "us") explains here how we collect, use, protect, and share your personal data, and your rights over it. This policy is incorporated into the Client Services Agreement.

## 1. Who we are
Pip2Dollar operates an automated gold-trading service that executes trades on clients' own Exness MT5 accounts. For the data we process about you, we act as a data controller under the NDPA.

## 2. Data we collect
- **Account and identity:** name, email, date of birth (used only to confirm you are 18+), and authentication data.
- **Trading connection:** your Exness MT5 login, server, account type, and trading password. The trading password is collected only after affiliation verification, is **encrypted immediately**, and is never stored or displayed in plaintext.
- **Optional profile:** avatar image and social handles you choose to add. These are private by default; you control their visibility per field.
- **Financial and performance:** fee assessments, invoices, payments, and the daily aggregate performance of your Account.
- **Referral:** your referral code, who you referred, and rebate-share accruals — where applicable.
- **Technical:** IP address, device and browser information, and consent records (timestamp, version hash) for legal acceptances.
- **Communications:** support messages and, where you opt in, WhatsApp/Telegram contact for community and updates.

## 3. Why we process it (lawful bases)
- **To perform our contract with you:** operate the Strategy on your Account, calculate fees, process referrals, and provide the portal.
- **Legal obligation:** identity and record-keeping requirements, tax, and regulatory compliance.
- **Legitimate interests:** securing the platform, preventing fraud, and improving the service — balanced against your rights.
- **Consent:** optional profile fields, marketing communications, and community messaging, which you may withdraw at any time.

## 4. Trading-credential custody
Your MT5 trading password is treated as highly sensitive. It is envelope-encrypted, the decryption key is held separately from the stored data, and it is decrypted only within the controlled environment that operates the Strategy. **These credentials permit trading only and cannot withdraw funds** — withdrawals require your Exness Personal Area login, which we never request or hold. We will never ask for this or any password by email or message.

## 5. Sharing
We share personal data only with:
- **Exness**, as necessary to verify affiliation and operate on your Account under our partnership.
- **Infrastructure and processing providers** under contract (hosting, database, email delivery, cloud secret storage), each bound to protect your data and process it only on our instructions.
- **Authorities**, where required by law.
We do **not** sell your personal data.

## 6. International transfers
Some providers process data outside Nigeria (for example in the EU or US). Where this occurs, we rely on lawful transfer mechanisms and require appropriate safeguards consistent with the NDPA.

## 7. Retention
We keep personal data for as long as your account is active and as required afterward for legal, tax, and dispute-resolution purposes, then delete or anonymize it. Financial and consent records are retained for the periods the law requires.

## 8. Your rights
Under the NDPA you may request access to, correction of, deletion of, or restriction of processing of your personal data, object to certain processing, withdraw consent, and request portability. You can exercise avatar, social-handle, and date-of-birth erasure directly in your profile settings; for other requests, contact us through the portal. You may also lodge a complaint with the Nigeria Data Protection Commission.

## 9. Security
We apply encryption for sensitive data, strict access controls and row-level security, least-privilege service roles, audit logging, and multi-factor authentication for privileged access. No system is perfectly secure, but we design to fail closed and to keep credentials and raw trading data walled off from anything published.

## 10. Children
The service is for adults (18+) only. We do not knowingly process data of anyone under 18; date of birth is collected to enforce this.

## 11. Changes
We may update this policy; material changes will be notified and, where they affect your rights or the processing of sensitive data, will require your renewed acceptance. The current version and its hash are published at the URL above.

## 12. Contact
Reach us through the support section of the portal for any privacy request or question, including exercising your rights or contacting our data-protection point of contact.