Privacy Policy

This Privacy Policy describes the policies and procedures of BMO Projects Ltd ("we", "our", or "us"), operator of the I Sabi Millions application (the "App") and all associated services, features, content, and applications offered through the App (collectively, the "Services"). We are committed to protecting your personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation 2019 (NDPR).

By using the Services, you consent to the collection, processing, storage, and use of your information as described in this Privacy Policy.

1. Scope of This Policy

This Privacy Policy covers our treatment of personally identifiable information ("Personal Data") gathered during your use of or access to the Services. It also covers our treatment of Personal Data that our partners, service providers, and Business Partners share with us, or that we share with them.

This Privacy Policy does not apply to the practices of third-party platforms we do not own or control, including third-party websites, services, or applications you may access through the App.

2. Lawful Basis for Processing

Under the NDPA and NDPR, we may only process your Personal Data where we have a lawful basis to do so. We rely on the following:

3. Information We Collect

3.1 Account Information

When you create an Account, you will provide:

• Full name
• Phone number (used as primary identifier and for verification)
• Email address (optional but recommended)
• Username (publicly visible within the App)

This information is used to create and manage your Account, verify your identity, communicate with you about the Services, and facilitate Prize delivery.

3.2 Payment and Financial Information

When you make in-app purchases or cash out Prizes, all payment transactions are processed by Paystack as our authorised payment processor. We do not directly store your payment card details. We retain transaction records (amounts, timestamps, account references) for Prize administration and statutory financial reporting purposes. Wallet top-ups are made through the I Sabi Millions website (isabimillions.com) via Paystack, and your balance updates live within the App.

3.3 Game Activity and Performance Data

We collect information about your participation in Game Sessions, including:

• Answers submitted and their timing
• Game session identifiers and session history
• Prize winnings and cash-out history
• Usage of in-app items (Extra Life, Comot)
• Win/loss records and scores
• XP awards per Game Session (event type, amount, timestamp, session reference) — stored as an append-only ledger
• Cumulative XP total and derived Rank

3.4 Device and Technical Information

We automatically collect information from your mobile device when you access the Services, including:

• Device type, model, and operating system
• Unique device identifiers (IDFA for iOS, GAID for Android)
• Mobile network information
• App version and crash/diagnostic data
• IP address (used for security and fraud prevention)

We do not use browser cookies. Mobile advertising identifiers may be opted out of through your device settings.

3.5 Push Notification Data

We use Firebase Cloud Messaging (FCM), provided by Google LLC, to send you push notifications about upcoming Game Sessions, prize notifications, account alerts, and promotional content (where you have opted in). FCM requires collection of your device's push notification token. You may disable push notifications at any time through your device settings.

3.6 Live Streaming Data

I Sabi Millions delivers live game show broadcasts through Amazon Interactive Video Service (Amazon IVS), provided by Amazon Web Services, Inc. ("AWS"). Your video viewing behaviour and session data during live broadcasts may be processed by Amazon IVS on AWS infrastructure. AWS processes data in accordance with its AWS Data Processing Addendum, which constitutes an appropriate safeguard for cross-border data transfers under the NDPA.

3.7 Location Information

We do not require or automatically collect your GPS location. If you voluntarily opt into any location-based features, we will collect location information at that time only. You may opt out through your device settings.

3.8 Communications Data

We may collect information relating to communications between you and us, including support requests, feedback, and messages sent through the App. Where you consent to marketing communications, we collect interaction data (e.g., push notification open rates) to improve our Services.

3.9 Aggregate and Anonymised Data

We collect, use, and share statistical information about how users collectively use the Services ("Aggregate Information"). Aggregate Information is derived from Personal Data but is anonymised and cannot reasonably be used to identify you.

4. How We Use Your Information

5. How We Share Your Information

5.1 Service Providers and Processors

We share Personal Data with trusted third-party service providers who process data on our behalf and under our instructions, including:

• Paystack — payment processing and prize disbursement
• Firebase Cloud Messaging (Google LLC) — push notification delivery
• Amazon Interactive Video Service (Amazon IVS, AWS) — live broadcast delivery

Our service providers are contractually required to process your data only as instructed, maintain appropriate security measures, and comply with applicable data protection law.

5.2 Business Transfers

If we acquire, are acquired by, or merge with another entity, or if we enter administration or bankruptcy, your Personal Data may be transferred as part of that transaction. The acquiring party will be bound to treat your data in accordance with this Privacy Policy.

5.3 Legal Compliance and Safety

We may disclose your information where we reasonably believe it is necessary to: (i) comply with any applicable law, regulation, or governmental request; (ii) enforce this Privacy Policy or our Terms of Use; (iii) detect, prevent, or address fraud, security, or technical issues; (iv) respond to user support requests; or (v) protect the rights, property, or safety of BMO Projects Ltd, our users, or the public.

5.4 With Your Consent

Except as set out above, we will not share your Personal Data with third parties without your explicit consent.

6. Data Security

We implement industry-standard technical and organisational measures to protect your Personal Data against unauthorised access, loss, destruction, or alteration, including encryption of data in transit and at rest, access controls, and regular security reviews.

You are responsible for maintaining the confidentiality of your Account credentials. Please notify us immediately at support@isabimillions.com if you suspect any unauthorised use of your Account.

Data Breach Notification

In the event of a Personal Data breach posing a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, as required under the NDPA. Where the breach is likely to result in a high risk to your rights, we will also notify you directly without undue delay.

7. Data Retention

We retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected and in accordance with applicable Nigerian law:

Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised.

8. Your Data Subject Rights

Under the NDPA and NDPR, you have the following rights with respect to your Personal Data:

To exercise any of these rights, contact us at: legal@isabimillions.com. We will respond to verified requests within 30 days of receipt. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

9. Account Deletion

You may delete your Account at any time:

• Through the App via the Account Settings menu; or
• By emailing support@isabimillions.com with your registered phone number and a deletion request.

We will action verified deletion requests within 30 days. Upon Account deletion:

• Your Account profile and personal identifiers will be permanently removed from our active systems.
• Financial and transaction data will be retained for the statutory retention period (Section 7).
• Anonymised aggregate data derived from your activity may be retained indefinitely for analytics purposes.
• Any uncashed Prizes at the time of deletion will be forfeited in accordance with the Official Rules.

10. Children's Data

The Services are strictly intended for users who are 18 years of age or older. We do not knowingly collect Personal Data from persons under the age of 18. If you believe a person under 18 has submitted Personal Data to us, please contact legal@isabimillions.com immediately and we will take prompt steps to delete such information.

11. Cross-Border Data Transfers

Your Personal Data may be processed and stored on servers located outside Nigeria, including in connection with services provided by Firebase Cloud Messaging (Google LLC) and Amazon Interactive Video Service (Amazon IVS, provided by Amazon Web Services, Inc.). Where we transfer your data outside Nigeria, we ensure that appropriate safeguards are in place as required under the NDPA, including the AWS Data Processing Addendum and Google standard data processing terms, each of which meets the standard required by the NDPC.

12. Your Choices

• You may use some features of the App without a registered Account, limiting the Personal Data we collect.
• You may opt out of marketing communications by contacting legal@isabimillions.com or adjusting notification preferences in the App.
• You may disable push notifications through your device settings at any time.
• You may request deletion of your Account as described in Section 9.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Where we make material changes, we will notify you by posting an announcement in the App or by direct notification to your registered phone number or email. Your continued use of the Services after notification constitutes acceptance of the revised Policy.

14. Contact Us

This Privacy Policy was prepared in accordance with the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Regulation 2019.