Privacy & Data Protection Policy
Last updated 1 September 2026. Applies to every Panta account, listing, order and ticket.
1. Who is responsible for your data
Panta is the data controller for the account, listing, order, ticket and support data created on this platform. Our payment, hosting, storage and messaging providers act as data processors on our instructions under written agreements.
2. Data we collect
Account data (name, username, email, phone, campus, university, avatar); listing and vendor data you publish; order, ticket, delivery and dispute data; wallet, payout and commission records; support messages; and technical data such as IP address, device/browser type, timestamps and error logs needed to keep the service secure.
3. Data we do not collect
We never store full card numbers, CVV codes or bank login credentials. Card and bank details are entered directly with our licensed payment provider; Panta receives only a transaction reference, amount, status and a masked card descriptor.
4. Lawful basis for processing
We process data to perform our contract with you (running your account, orders, tickets and payouts), to meet legal obligations (tax, anti-fraud, record keeping), for our legitimate interests (platform safety, abuse prevention, product improvement), and with your consent where consent is required, such as optional marketing messages.
5. How we use your data
To create and secure your account, show campus-relevant listings and events, process payments and escrow release, calculate marketplace fees and ambassador commission, verify tickets at check-in, investigate disputes and reports, prevent fraud, and provide support.
6. Referrals and ambassadors
If you register through an ambassador link we store the referral code and the attribution date so commission can be calculated for the 365-day commission window. Ambassadors see aggregate referral and commission figures only — never your contact details, addresses or payment data.
7. What other users can see
Your display name, username, avatar, campus and verification badge are visible alongside your listings, events and reviews. Buyers and sellers involved in the same order see the limited contact and delivery details needed to complete that order. Nothing else about your account is exposed to other users.
8. Sharing with third parties
We share the minimum necessary data with our payment processor (to charge, refund and pay out), cloud hosting and database providers (to store your records), file storage (for images and verification documents), email/SMS providers (for transactional notices), and analytics/error monitoring. We do not sell, rent or trade your personal data, and we do not share it for third-party advertising.
9. Legal disclosure
We may disclose data where we are required to by Nigerian law, a valid court order or a lawful request from a regulator or law enforcement agency, or where disclosure is necessary to prevent fraud, protect life or defend our legal rights. Where permitted, we will notify you first.
10. International transfers
Some processors store data outside Nigeria. Where that happens we rely on providers offering an adequate level of protection and contractual data-protection terms consistent with the Nigeria Data Protection Act 2023.
11. Retention
Account and profile data is kept while your account is active. Order, payment, payout and commission records are retained for at least 6 years after the transaction to meet tax, accounting and dispute obligations. Verification documents are deleted within 12 months of a decision. Technical and security logs are kept up to 12 months. After these periods data is deleted or irreversibly anonymised.
12. Your rights
You may access a copy of your data, correct inaccurate data, request deletion, object to or restrict certain processing, withdraw consent for optional messages, and request portability of the data you supplied. Email the address in Settings & help and we will respond within 30 days. You may also complain to the Nigeria Data Protection Commission.
13. Deleting your account
You can request account deletion at any time. We remove or anonymise your profile, listings and preferences, but we must retain transaction, payout, tax and dispute records for the retention period in section 11, and we cannot delete records needed for an open dispute or investigation.
14. Security
Access is enforced by row-level security policies in our database so records are readable only by you and authorised staff. Payment credentials never touch our servers, verification documents sit in private storage buckets, staff access is role-based and logged, and administrative overrides such as manual ticket check-in are written to an audit log.
15. Data breaches
If a breach is likely to result in a risk to your rights, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it and inform affected users without undue delay, describing what happened, what data was involved and what you should do.
16. Cookies and similar technologies
We use strictly necessary cookies and local storage for sign-in sessions, theme preference, referral attribution and fraud prevention. We do not use third-party advertising cookies. Blocking necessary cookies will prevent sign-in from working.
17. Children
Panta is intended for users aged 16 and above. We do not knowingly collect data from children below that age; if we learn that we have, we delete the account and its data.
18. Automated decisions
We use automated checks to flag suspicious listings, orders and referral activity, but suspensions, refunds and dispute outcomes are reviewed by a human. You can ask for a review of any decision that affects you.
19. Changes to this policy
We will post material changes on this page and update the date above. Continuing to use Panta after a change means you accept the updated policy.
Questions? Reach us from Settings & help.