How PrymACE Handles Your Information

This notice covers the PrymACE website, the PrymACE mobile application, PrymACE Port facilities and the digital accounts used to record contributions and their value.

Where a person uses PrymACE on behalf of a company, institution, household or other entity, we treat that entity as the account holder and the individual as its authorised user.

We collect the information needed to run a resource-contribution account and to keep a defensible record of what was received and what it was valued at:

• Account information — your name, the role your account holds (subscriber, agent, vendor or administrator), your participation type where you have chosen one, and whether your email address has been confirmed.
• Contact information — your email address and, where you provide it, your telephone number.
• Contribution and transaction records — the material recorded, its weight, the rate it was valued at, any adjustment applied, the resulting credit, the facility it was recorded at and the agent who recorded it. This is the record the Terms commit us to be able to investigate.
• Value-system records — your Ace-Point and Ace-Coin balances, every movement in and out of them, and any conversion or payout request you make.
• Location information — the country on your account, and the facility you are attached to as an agent. The mobile application asks for your device location only when you use the nearest-facility search, and only to sort facilities by distance.
• Market activity — the products you list as a vendor, the contents of your cart, and the orders you place, including the delivery details you give at checkout.
• Authentication information — your password in hashed form (we never store it in readable form), and the access tokens issued to the mobile application so it can stay signed in.
• Device information — limited technical information the mobile application and web server need in order to work, such as the platform the application is running on.
• Communications with us — enquiries, support requests, complaints and dispute reports you submit, and our replies and their outcomes.

We do not ask for, and do not want, special-category information such as health data, political opinions or religious beliefs. Please do not send it to us through a support request.

We use the information above for these purposes, and for no others:

• Account management — creating your account, confirming your email address, letting you sign in, and keeping your profile and participation type correct.
• Transaction processing — recording a contribution, valuing it, crediting your balance, applying corrections where a recorded figure turns out to be wrong, and processing conversions, payouts and Market orders.
• Customer support — investigating a request about a contribution against the weighing, valuation and system records behind it.
• Security — protecting accounts against unauthorised access, fraud and manipulation of the value system.
• System improvement — understanding how the network is being used so the service can be made to work better.
• Legal and regulatory compliance — meeting obligations that apply to us, and responding to lawful requests.

We do not sell your personal information, and we do not use it for advertising.

We process your information because it is necessary to perform our agreement with you (running your account and recording your contributions), because we have a legitimate interest in keeping the network secure and the records accurate, and because the law requires us to keep and produce certain records.

Where we rely on your consent for something specific — such as using your device location for the nearest-facility search — you can decline it and the rest of the service still works.

Card and mobile-money payments are processed by Paystack. When you pay for a Market order you are passed to Paystack to complete the payment; we receive confirmation of whether it succeeded, the amount and a reference.

We do not receive or store your full card number or mobile-money PIN.

If you settle an order from your Ace-Coin balance instead, no payment processor is involved and no payment data leaves the platform.

We share information only where it is needed to run the service:

• With our payment processor, to take and confirm payments.
• With our email delivery provider, to send account confirmations, verification codes and service notices.
• With our hosting and infrastructure providers, who store the application and its database on our behalf.
• With professional advisers, auditors or authorities where the law requires it or where we need to establish or defend a legal claim.

A vendor sees the order and delivery details needed to fulfil it. An agent sees the subscriber they are recording a contribution for. Beyond that, account holders cannot see each other’s information.

We keep account and contact information for as long as your account is open, and for a reasonable period afterwards in case of a query or dispute.

Contribution, valuation, order and balance-ledger records are kept for longer, because they are the financial and environmental record of the network and the evidence base for any later dispute. Where a record is corrected, both the original figure and the correction are retained so the change stays explainable.

Support requests are kept while they are open and for a reasonable period afterwards so we can show how the matter was handled.

Subject to applicable law, you can ask us to:

• Give you a copy of the personal information we hold about you.
• Correct anything that is inaccurate — and your contribution records have their own correction route, described below.
• Delete information we no longer need, or close your account entirely.
• Restrict or object to a particular use of your information.
• Provide your information in a portable form.

You can see most of what we hold without asking: your dashboard shows your contributions, their valuations and your balances, and from a contribution you can raise a support request if a figure looks wrong.

To exercise any of these rights, use the contact channel or write to privacy@prymace.com.. We will respond within a reasonable period.

If you believe a contribution was recorded incorrectly, raise a support request from the contribution itself. The Terms commit us to reviewing it against the weighing records, timestamps, Port records, material classification and system logs.

While it is being investigated the contribution is marked Under Review rather than reported as settled. If the error is confirmed, your account is adjusted by the difference and the contribution keeps a record of both the original and corrected figures.

Passwords are stored only as hashes. The mobile application uses revocable access tokens rather than your password. Access to account data in the administrative console is restricted by role, and corrections to contribution records are recorded against the administrator who made them.

No system is perfectly secure. Please protect your account credentials, and tell us promptly if you believe your account has been accessed by someone else.

The website uses a session cookie to keep you signed in and to protect forms against cross-site request forgery. It is required for the service to work and is not used for advertising or tracking across other sites.

The mobile application stores its access token in the device’s secure storage rather than a cookie.

PrymACE accounts are intended for adults and for organisations. We do not knowingly create accounts for children. If you believe a child has registered, contact us and we will remove the account.

When this notice changes materially we will update the version number above and tell account holders through the service. The version you accepted at registration is recorded on your account.

This notice is version 1.0. It describes how the PrymACE platform actually handles information; where our published Terms describe personal data in more general terms, this notice is the more specific statement.

For any privacy question, or to exercise a right described above, write to privacy@prymace.com. or use the contact channel.

This notice should be read together with the Terms & Conditions, which set out the rules governing contributions, valuation, Ace-Points and Ace-Coin.