Privacy Policy

Middleman Global Solutions Limited (“Middleman,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, store, retain, and protect personal data when you use the Middleman website, mobile application, and related services (collectively, the “Platform”).

This Policy should be read together with our Terms and Conditions. By using the Platform, you acknowledge that you have had the opportunity to read this Policy. Where consent is legally required for a particular processing activity, we will seek that consent separately where appropriate.

1. Scope of This Policy

This Policy applies to personal data processed in connection with:

• Creating and managing Middleman accounts.
• Creating, funding, and completing escrow transactions.
• Verifying user identities and preventing fraud.
• Handling disputes, complaints, refunds, and withdrawals.
• Providing customer support and maintaining Platform security.
• Meeting applicable legal and regulatory obligations.

This Policy applies to personal data collected directly from users, generated through their use of the Platform, or received from relevant third parties.

2. Personal Data We Collect

The personal data we collect depends on how you use the Platform, the features you access, and the verification requirements applicable to your account or transactions.

2.1 Information You Provide

Depending on the services you use, we may collect:

• Full name and contact details, including email address and phone number.
• Account credentials and account-related information.
• Date of birth and other identity information where required.
• Government-issued identification documents, verification photographs, and other identity-verification information where KYC is required.
• Transaction details, including agreed terms, amounts, fees, payment status, and transaction history.
• Payment, payout, and withdrawal information necessary to process transactions.
• Messages, supporting documents, and other evidence submitted in connection with transactions or disputes.
• Communications with our customer support team.
• Information you voluntarily provide when contacting us or submitting a complaint.

You should only submit personal information that is relevant and reasonably necessary for the service or request concerned.

2.2 Information Collected Automatically

When you access or use the Platform, we may collect certain technical and usage information, where available and applicable, including:

• IP address and connection information.
• Device type, operating system, browser type, and technical identifiers.
• Log records, access times, and usage activity.
• Security events, failed login attempts, and information relevant to detecting suspicious activity.
• Cookie identifiers and similar technology data, where such technologies are deployed.
• Approximate location information where it is collected through IP addresses or other enabled technologies.

We do not claim to collect precise location data unless the relevant feature or technology actually collects it.

2.3 Information Received from Third Parties

Where necessary and lawful, we may receive relevant information from:

• Payment service providers involved in deposits, payments, refunds, or withdrawals.
• Identity-verification providers.
• Fraud prevention and security services.
• Compliance and screening providers, where applicable.
• Other transaction participants, including information and evidence submitted during a dispute.
• Public authorities or other sources where permitted or required by law.

Information received from third parties is used only for relevant purposes and subject to applicable legal requirements.

3. How We Use Personal Data

We process personal data for the following purposes, where applicable:

1. Account management: To register users, authenticate accounts, and provide access to the Platform.
2. Escrow transactions: To facilitate transaction agreements, funding, delivery confirmation, fund releases, refunds, and withdrawals.
3. Identity verification: To verify identities where required and apply relevant account or transaction restrictions.
4. Fraud prevention and security: To detect suspicious activity, protect accounts, investigate potential abuse, and reduce payment and transaction risks.
5. Dispute resolution: To review transaction agreements, communications, receipts, delivery evidence, and other relevant information when resolving disputes.
6. Payment administration: To reconcile transactions, verify payment status, process authorised refunds, and administer withdrawals.
7. Customer support: To respond to questions, complaints, and requests.
8. Legal compliance: To comply with applicable laws, lawful requests, and relevant legal obligations.
9. Platform operations: To maintain, troubleshoot, evaluate, and improve the security, reliability, and functionality of the Platform.
10. Service communications: To send transaction notifications, security alerts, policy updates, and other service-related communications.
11. Marketing: To send promotional communications where permitted by law and, where required, with your consent.

4. Legal Grounds for Processing

Middleman processes personal data only where an appropriate legal basis applies under relevant data protection law.

Depending on the circumstances, these grounds may include:

• Contractual necessity: Where processing is necessary to provide the Platform or perform a transaction-related service requested by you.
• Legal obligations: Where processing is necessary to comply with applicable laws or lawful regulatory requirements.
• Legitimate interests: Where processing is reasonably necessary for purposes such as preventing fraud, securing accounts, protecting the Platform, and resolving disputes, provided those interests are not overridden by applicable rights and protections.
• Consent: Where you have given consent for a specific purpose and consent is the appropriate legal basis.
• Other lawful grounds: Where another legal basis permitted by applicable law applies.

Where we rely on consent, you may withdraw it where permitted by law. Withdrawal does not invalidate processing lawfully carried out before withdrawal, and it may not prevent processing that can continue under another applicable legal basis.

5. Identity Verification and Compliance

Middleman may require identity verification for particular services, transactions, withdrawals, or risk-related checks.

Where verification is required, relevant information may be collected directly from you or obtained through authorised verification providers.

We may use verification information to:

• Confirm identity and reduce impersonation.
• Prevent fraud, account misuse, and prohibited activity.
• Assess whether additional verification is necessary.
• Meet applicable legal or compliance requirements.
• Protect users and investigate suspicious transactions.

Failure to complete required verification may result in restrictions on certain features, transactions, or withdrawals, subject to applicable law and our Terms and Conditions.

We will limit the collection, access, use, and retention of verification information to what is reasonably necessary for the applicable purpose and legal requirements.

6. How We Share Personal Data

Middleman may disclose relevant personal data to the following categories of recipients where necessary, lawful, and proportionate:

6.1 Payment Service Providers

We may share transaction and payment information with payment service providers to facilitate or verify deposits, payments, refunds, withdrawals, and related financial operations.

6.2 Identity Verification and Compliance Providers

We may share relevant identity information with verification, fraud prevention, and compliance providers where necessary for identity checks, risk assessment, or applicable legal obligations.

6.3 Service Providers

We may disclose relevant information to providers supporting services such as hosting, infrastructure, customer support, communications, security, analytics, and technical maintenance.

Where required, appropriate contractual and organisational safeguards will be used to protect personal data processed by these providers.

6.4 Other Transaction Participants

Where necessary to facilitate a transaction or resolve a dispute, relevant transaction information or evidence may be shared with the other party to the transaction. We will seek to limit such disclosure to information reasonably necessary for the purpose.

6.5 Authorities and Legal Recipients

We may disclose personal data to courts, regulators, law enforcement agencies, or other authorised recipients where required or permitted by applicable law, or where necessary to establish, exercise, or defend legal claims.

6.6 Business Transfers

If Middleman undergoes a merger, acquisition, restructuring, or transfer of relevant business assets, personal data may be transferred as part of that process, subject to applicable law and appropriate safeguards.

We do not authorise third parties to use personal data obtained from us for purposes unrelated to the services they provide or other lawful purposes. Where a third party independently determines its own processing purposes, its own privacy practices and legal obligations may also apply.

7. Transactions, Disputes, and Evidence

Middleman may process transaction agreements, messages, receipts, delivery evidence, payment records, support communications, and other relevant information to administer transactions and resolve disputes.

Where a dispute is raised:

• Authorised personnel may review relevant transaction information and evidence.
• Relevant information may be shared with the other party to the dispute where necessary to assess the claims and reach a fair decision.
• Access to dispute records should be limited to authorised personnel who require the information for their responsibilities.
• Relevant records may be retained after the dispute is resolved where necessary for security, legal compliance, recordkeeping, or the establishment, exercise, or defence of legal claims.

Middleman will seek to process only information relevant to the dispute and to protect it against unauthorised access or disclosure.

8. International Data Transfers

Some of our service providers or technical infrastructure may process or store personal data outside Nigeria or outside your country of residence.

Where personal data is transferred internationally, Middleman will comply with applicable data protection requirements, including any applicable conditions for international transfers and appropriate safeguards.

Where required by law, we will provide additional information about relevant transfer arrangements or safeguards and obtain consent where consent is the applicable legal requirement.

Use of the Platform does not, by itself, replace any consent, authorisation, or other legal condition required for an international data transfer.

9. Data Retention

Middleman retains personal data only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal obligations and legitimate recordkeeping requirements.

Retention may depend on:

• The duration of your account and your use of the Platform.
• The completion of transactions, refunds, and withdrawals.
• The resolution of disputes and complaints.
• Applicable financial, legal, regulatory, or recordkeeping requirements.
• Fraud prevention, security investigations, and the protection of legal rights.
• The establishment, exercise, or defence of legal claims.

Different categories of data may be retained for different periods. For example, identity-verification information, transaction records, dispute evidence, support communications, and technical security logs may have different retention requirements.

When personal data is no longer required, Middleman will take reasonable steps to delete it, anonymise it, or otherwise dispose of it securely, subject to applicable law and legitimate retention requirements.

10. Your Data Protection Rights

Depending on applicable law and the circumstances of the processing, you may have the right to:

• Request access to your personal data.
• Request correction of inaccurate or incomplete personal data.
• Request deletion of personal data where the legal conditions for deletion are met.
• Request restriction of certain processing.
• Object to certain processing, including processing based on legitimate interests, where applicable.
• Request a portable copy of personal data where the relevant legal requirements are met.
• Withdraw consent where processing is based on consent.
• Raise concerns or lodge a complaint with the relevant data protection authority.
• Exercise other rights available under applicable data protection law, including rights relating to qualifying automated decisions.

We may need to verify your identity before responding to a request. We will handle requests within the timeframes and procedures required by applicable law.

To exercise your rights, contact us using the details in Section 20.

11. Account Closure and Deletion Requests

You may request the closure or deletion of your account through the available Platform functionality or by contacting our support team.

When a deletion request is received, Middleman will assess which personal data can be deleted and which information must or may lawfully be retained.

Account closure or deletion does not automatically require the deletion of:

• Transaction and payment records that must be retained under applicable law.
• Relevant dispute evidence or records required to resolve outstanding matters.
• Information reasonably necessary to investigate suspected fraud or protect legal rights.
• Records subject to other lawful retention requirements.

Where data is retained after account closure, it will remain subject to applicable data protection requirements and should not be retained longer than necessary for the relevant purpose.

Closing an account does not remove obligations arising from transactions or agreements entered into before closure.

12. Cookies and Similar Technologies

Middleman may use cookies, local storage, or similar technologies where these are deployed on the Platform.

Such technologies may be used to:

• Maintain sessions and support essential Platform functionality.
• Remember relevant settings and preferences.
• Improve reliability and performance.
• Detect suspicious activity and protect the Platform.
• Understand usage patterns where analytics technologies are used.

Where consent is required for non-essential cookies or similar technologies, we will provide an appropriate notice and consent mechanism.

You may be able to manage cookies through your browser settings or any cookie preference controls provided on the Platform. Disabling certain technologies may affect the availability or functionality of some features.

The actual cookies and tracking technologies used should be described in any applicable cookie notice.

13. Data Security

Middleman will implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, destruction, or disclosure.

Depending on the systems used and the risks involved, these measures may include access restrictions, appropriate authentication, encryption where suitable, security monitoring, staff access controls, backups, and procedures for handling security incidents.

Access to personal data should be limited to authorised individuals who need it for legitimate operational, support, compliance, or security responsibilities.

No website, application, network, or storage system can be guaranteed to be completely secure. However, this does not remove Middleman's obligations to take appropriate protective measures or comply with applicable data protection law.

14. Staff and Administrator Access

Access to personal data by Middleman personnel and administrators should be limited to what is necessary for their assigned duties, including customer support, transaction administration, dispute resolution, compliance, and security.

Middleman will seek to apply appropriate access controls and accountability measures to reduce the risk of unauthorised access or misuse.

Where administrator activity logging is implemented, relevant logs may be used to investigate security incidents, review access, and support internal accountability.

15. Third-Party Websites and Services

The Platform may contain links to websites or services operated by third parties.

Those third parties may have their own privacy policies, data collection practices, and terms of service. Middleman does not control the privacy practices of independent third-party websites.

We encourage you to review the relevant privacy information before submitting personal data directly to a third party.

This section does not exclude any responsibilities Middleman may have under applicable law in relation to third-party services it uses to process personal data on its behalf.

16. Children's Privacy

The Platform is intended for individuals aged 18 or older. Individuals under 18 must not create accounts or use the Platform where doing so would breach our eligibility requirements.

If we become aware that personal data has been collected from an individual under 18 in circumstances where collection is not permitted, we will take appropriate steps in accordance with applicable law, which may include restricting the account and deleting information that is not lawfully required to be retained.

A parent, guardian, or other appropriate representative who has concerns about a minor's information may contact us using the details in Section 20.

17. Data Breaches and Security Incidents

If Middleman becomes aware of a personal data breach affecting personal information for which it is responsible, we will assess the incident and take reasonable and appropriate steps to contain, investigate, mitigate, and address its effects.

Where notification to the Nigeria Data Protection Commission (NDPC) or another competent supervisory authority is required by applicable law, Middleman will make the required notification within the applicable statutory timeframe. Where a breach is likely to create a risk to individuals’ rights and freedoms, notification to the NDPC will be made within the period required by law, including the applicable 72-hour requirement.

Where a breach is likely to result in a high risk to affected individuals’ rights and freedoms, Middleman will notify affected individuals as required by applicable law and provide relevant information about the nature of the incident, its reasonably foreseeable consequences, and steps they may take to protect themselves.

Depending on the circumstances, Middleman may take measures such as restricting access to affected systems, securing compromised accounts, investigating unauthorised access, working with relevant service providers, and implementing corrective measures to reduce the likelihood of recurrence.

Middleman will maintain appropriate records of security incidents and the actions taken in response, in accordance with applicable legal and regulatory requirements.

Nothing in this section limits any rights you may have under applicable data protection law.

18. Changes to This Policy

Middleman may update this Privacy Policy from time to time to reflect changes in our services, applicable law, security requirements or business operations.

Material changes will be communicated through an appropriate channel, such as in-app notices, email or the Platform, and will state their effective date where appropriate.

Where an update requires your consent under applicable law, we will seek that consent separately. Continued use of the Platform does not replace any consent that is legally required.

19. Complaints

If you have a concern or complaint about how Middleman handles your personal data, please contact us first using the details in Section 20 so that we can review and try to resolve it.

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or another competent data protection authority, subject to applicable law.