Privacy Policy

BGNL Panel is a panel research platform based in Lagos, Nigeria. We operate the bgnlpanel.com website and related mobile and web applications.

For data protection purposes, BGNL Panel is the data controller for panelist and researcher account data. For survey response data, BGNL Panel acts as a data processor on behalf of the researcher (data controller) who created the survey.

Account data (all users)

When you register, we collect your name, email address, and phone number. We use this to create and manage your account, communicate with you about your activity, and send important service updates.

Identity verification data (panelists)

KYC verification requires a government-issued ID (NIN, BVN, passport, driver's licence, or voter's card). We collect the ID type, ID number, and supporting document images. This data is used solely to verify your identity — it is not shared with researchers and is not used for any profiling or marketing purpose.

Survey responses

When you complete a survey, we store your answers linked to your panelist profile. Researchers receive aggregate results and demographic breakdowns. They do not receive your name, contact details, or ID information.

Payment data

Payment transactions (credit top-ups by researchers, withdrawals by panelists) are processed by Paystack. We do not store card numbers or bank account numbers. We retain transaction records (amounts, dates, status) for accounting and dispute resolution purposes.

Device and usage data

We collect device identifiers, IP addresses, browser type, and usage patterns (pages visited, features used) for fraud detection, quality scoring, and platform improvement. We do not sell this data.

• To operate your account and deliver the service you signed up for
• To verify panelist identities and prevent duplicate or fraudulent accounts
• To calculate and disburse credit rewards to panelists
• To detect and prevent fraudulent survey responses
• To send transactional notifications (survey completion, credit withdrawal, account security)
• To analyse platform usage in aggregate to improve the product
• To comply with legal obligations, including tax and financial reporting

We do not use your data for targeted advertising. We do not build or sell advertising profiles. We do not share personal data with third parties except as described in section 4.

Paystack — for processing researcher top-ups and panelist withdrawals. Paystack operates under its own privacy policy and is PCI-DSS compliant.

Cloud infrastructure providers — we use Google Cloud Platform to host the platform and store data. Data is stored in data centres within or proximate to Nigeria where feasible.

Researchers (for response data only) — researchers receive the survey responses submitted by panelists, along with demographic breakdowns. They do not receive any personally identifying information about individual panelists.

Law enforcement — we will disclose data when required to do so by valid Nigerian legal process (court order, regulatory demand). We will attempt to notify affected users before disclosure where legally permitted.

We do not sell data to data brokers, marketing platforms, or any other party.

Account data is kept for as long as your account is active. If you close your account, we delete or anonymise personal data within 90 days, except where we are required to retain it for legal, financial, or audit purposes (typically 6 years for financial records under Nigerian law).

Survey response data is retained for the period requested by the researcher or for 2 years from survey completion, whichever is shorter. After this period, responses are anonymised.

KYC documents are retained for 5 years from the date of verification, as required by NDPR guidelines on identity records.

Under the NDPR and NDPA, you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to update inaccurate data
• Deletion — request that we delete your data, subject to our legal retention obligations
• Restriction — ask us to pause processing while a dispute is resolved
• Objection — object to any processing based on our legitimate interests
• Portability — receive your data in a structured, machine-readable format

To exercise any of these rights, email privacy@bgnlpanel.com. We will respond within 30 days.

BGNL Panel uses session cookies to keep you logged in and to protect against cross-site request forgery. We do not use third-party advertising cookies or tracking pixels.

You can configure your browser to reject cookies, but some parts of the platform will not work correctly without them (specifically, the login session and the survey-taking flow).

Passwords are hashed using bcrypt and never stored in plaintext. All traffic between your browser and BGNL Panel is encrypted over HTTPS. Access tokens expire every 15 minutes and require refresh.

KYC documents are stored in encrypted object storage and are only accessible to authorised staff during the review process.

No system is perfectly secure. If you believe there has been unauthorised access to your account, contact us immediately at security@bgnlpanel.com.

We'll update the effective date at the top of this page when we make material changes. For significant changes, we'll send a notification to your registered email address at least 14 days before they take effect.