Legal
Data rights requests
How to access, correct, delete or move your personal data.
Version: 1.0 (draft) · Effective date: 1 December 2026
Draft — pending review by qualified legal counsel. This text is a working draft designed to support Nigeria's NDPA 2023 and, where it applies, the GDPR. It does not claim compliance with either and is not legal advice. It is not in effect until approved.
Your rights
This page explains how to use the data rights described in our Privacy Policy: access, correction, deletion, restriction, objection, withdrawing consent, portability, and asking for a person to review an automated decision. Using your rights is free.
How to make a request
The fastest way is in the app, where we already know it is you:
- Download your data: Settings, Privacy & Data, Download your data. We tell you when the file is ready; it is deleted 72 hours later, and you can ask for a new one.
- Delete your account: Settings, Privacy & Data, Delete account. You have 30 days to change your mind by logging in.
- Correct your data: edit your profile, addresses and settings directly.
- Change consent: cookie settings on our websites, and Settings, Privacy & Data in the app.
- Anything else: email privacy@nantty.com or our Data Protection Officer at dpo@nantty.com, or open a Help Centre ticket and choose Privacy.
Checking it is you
If you are signed in, that is usually enough. If you write from outside the app, we may ask you to confirm from the email address on your account or answer questions about your account. We only ask for an ID document if there is no other way, and we delete it once your identity is confirmed. A parent or guardian can make requests for a child's account. Someone acting for you needs your signed permission.
How long we take
We confirm we received your request within 72 hours. We answer as soon as we can and within the time your law sets:
| Where you live | Time to answer |
|---|---|
| Nigeria | Within 30 days, the period the NDPC expects under the GAID. |
| Kenya | Access requests within 7 days; other requests within 14 days. |
| Ghana | Within 21 days. |
| South Africa | Within 30 days, as PAIA sets for access requests. |
| United Kingdom and European Union | Within one month, extendable by two months for complex requests. |
| United States | Within 45 days, extendable by 45 days where state law allows. |
When we cannot do everything you ask
Some data must be kept by law, for example order, payment and verification records for tax and anti-money laundering rules, or data needed for an open dispute, claim or investigation. We cannot show you other people's personal data, or chat messages, which are end-to-end encrypted and live on your devices. If we refuse all or part of a request, we tell you why and how to complain.
If you are not happy
You can ask our DPO to look at it again, and you can complain to the Nigeria Data Protection Commission or the data protection authority where you live: the Data Protection Commission in Ghana, the Office of the Data Protection Commissioner in Kenya, the Information Regulator in South Africa, the Information Commissioner's Office in the UK, or the authority in your EU country.
Our records
We keep a log of each request, what we did and when, to show regulators that we answer on time. The log is kept for 3 years after the request closes.
View previous versions
There are no previous versions yet.