Privacy Policy & Data Protection Notice

2. Categories of Personal Data Collected

Depending on your interaction with MOVENSTAQ, we process the following categories of lawful personal data:

3. Payment Tokenization & Absolute Card Security

All electronic card transactions and recurring debit instructions are processed directly through Central Bank of Nigeria (CBN) licensed, PCI-DSS Level 1 certified payment switches — including Paystack Payments Limited and Flutterwave Technology Solutions Limited.

When you authorize an auto-renewal subscription or tokenize your card, your bank and the payment gateway exchange an encrypted, randomized authorization token (e.g. AUTH_w9x...). MOVENSTAQ only stores this opaque token alongside standard non-sensitive card metadata (card brand, expiration month/year, and masked last 4 digits e.g. Visa •••• 4242) to display on your billing statements and execute automated scheduled renewals.

4. WhatsApp Messaging Consent & Opt-Out Provisions

MOVENSTAQ integrates with the official Meta WhatsApp Cloud Business API to deliver time-sensitive gym operational alerts on behalf of your fitness center:

• Transactional Notifications: Digital pass QR delivery, payment confirmation receipts, and failed auto-renewal balance recovery links.
• Engagement & Retention: Membership expiry reminders (7 days, 3 days, and 1 day prior) and workout streak celebrations.

Member Opt-Out Mechanism: In compliance with NDPA Section 37, members maintain absolute autonomy over messaging channels. You may opt out of promotional and retention WhatsApp messages at any time by replying STOP to any message or requesting the front-desk staff to disable WhatsApp messaging on your member profile. Transaction-critical receipts will remain accessible via email and your public pass link.

5. Biometric, Kiosk & QR Scanner Access Data

Where a gym tenant utilizes hardware QR code scanners, optical barcode guns, or biometric access scanners connected to MOVENSTAQ, data is processed strictly for identity verification at the point of entry and safety capacity enforcement. Scanner check-ins generate a localized timestamp and member ID record. MOVENSTAQ does not sell, broker, or aggregate attendance patterns for external advertising.

6. Your Data Subject Rights (NDPA 2023)

Under Part V of the Nigeria Data Protection Act 2023, every data subject has the right to:

• Right of Access: Request a copy of all personal records and attendance logs held about you.
• Right to Rectification: Request correction of inaccurate names, phone numbers, or billing details (also editable by gym staff via the Member Directory).
• Right to Erasure ("Right to Be Forgotten"): Request total anonymization or deletion of your profile upon membership termination, subject to statutory tax and financial reporting retention laws (e.g., CAMA 2020 and Money Laundering Prevention Act).
• Right to Restrict or Object: Object to automated decision-making or specific processing activities.
• Right to Lodge a Complaint: Lodge a regulatory complaint directly with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

7. Data Retention, Encryption & Breach Protocol

All data at rest is encrypted using industry-standard AES-256 encryption, and data in transit is protected via TLS 1.3 cryptographic protocols. Operational databases are hosted in certified Tier-III data center environments with automated daily backups.

In the unlikely event of a security incident affecting personal data, MOVENSTAQ enforces a strict 72-hour notification protocol in compliance with NDPA Section 40, immediately alerting the NDPC and impacted gym controllers with mitigation advisories.

8. Contact Us & Governance

For questions regarding this policy, data subject requests, or tenant data processing agreements: