Your privacy,clearly explained.

Your privacy, clearly explained. How CardNuvio uses information, how our business works, and the choices you have. Last updated September 8, 2026 ON THIS PAGE Our business & markets CardNuvio is operated by WING HING DISPENSARY LIMITED (“we”, “us”). We provide a gift-card purchasing and resale service intended for eligible users in Nigeria and Ghana only. We buy legally held, eligible gift cards at a quote accepted by the user and earn revenue through the margin on subsequent resale. Any additional transaction or withdrawal fees are disclosed before confirmation. We process account, card and payout information to evaluate submissions, fulfil agreed trades, maintain transaction records and resolve issues. Gift-card issuing countries do not extend our customer markets. This policy covers the CardNuvio iOS app, this website and support interactions. Data we use CategoryExamples and purposeAccount & contactEmail, account identifier, name or nickname, optional profile photo and WhatsApp contact; used for sign-in, communication and account administration.Gift cards & ordersCard brand, issuing country, type, denomination, images, redemption details, quotes and order references; used to assess and fulfil trades. Treat redemption details as sensitive.Payouts & balancesBank name, account holder name, account number, balance and withdrawal records; used to check payout details, route payouts and resolve payment issues.SupportMessages, attachments and account context shared with customer service; used to respond and investigate.Device & service activityDevice identifiers, network information such as IP addresses, request timestamps and app interaction events; used to operate, troubleshoot, measure service activity and protect the service.Verification, if introducedIdentity evidence and verification results would be processed only for a clearly explained verification purpose. See Identity checks below for the status of the proposed KYC framework.Information comes from you, your use of the service and service providers involved in the transaction or support process. Optional profile information is separate from information necessary to complete a trade. Why we use information Provide requested account access, quotes, card reviews, transactions and payouts. Communicate about service activity and answer support or privacy requests. Investigate suspicious or disputed activity, protect accounts and enforce service terms. Maintain necessary business records and respond to applicable legal obligations. Depending on the purpose and applicable law, processing may rely on steps to enter or perform a contract, legal obligations, legitimate operational and security interests, or your consent. Where consent is required, you may withdraw it without affecting earlier lawful processing. We explain additional purposes before using information in a materially different way. Identity checks & KYC The current app supports account verification and bank-account details checks. These checks alone are not a complete document-based KYC programme. We have published a proposed KYC operating framework covering customer due diligence, risk review, payout ownership checks, information safeguards and appeals. Document verification, biometric checks, sanctions screening, specific verification providers and transaction restrictions described as planned are not represented as already deployed. Before any new identity collection is introduced, the collection notice must explain the responsible provider, required information, purpose, legal basis, applicable retention and available rights. Do not send identification documents, NIN/BVN details or selfies to this website or by ordinary email. Who may receive information Service providers supporting hosting, object storage, communications and technical operations. This public website is hosted on Vercel. SaleSmartly, used for in-app customer service, may receive your customer identifier, name, messages and support attachments when you use that service. Banks and payout providers receive the information needed for account checks and payment processing. Card validation or resale counterparties may receive the card details needed to assess or fulfil a trade. Personal data should be limited to what the transaction requires. Authorities, advisers or other parties where disclosure is lawfully required or necessary to investigate disputes or protect rights. We do not sell personal information as our business model. Any recipient processing information for us must be subject to appropriate purpose, confidentiality and security restrictions. Contact us for information about recipients involved in your specific request. International processing The operator and service providers may process information outside Nigeria or Ghana. We do not promise that all information is stored locally. Where required, international transfers must use an applicable legal mechanism and safeguards for confidentiality, security and enforceable rights. Contact us for details about safeguards relevant to your information. Retention & deletion Information is retained for the period needed for its stated purpose, including account administration, completion of trades, payment reconciliation, disputes and applicable legal recordkeeping. Retention depends on the type of record, outstanding matters and the law that applies; it is not an unlimited right to retain data. An account deletion request starts closure and deletion review. Some transaction or legal records may need to remain after account closure. Ask us what categories are retained, for what reason and for how long. The proposed KYC framework sets out a retention approach to be confirmed before new identity collection is activated. Security & website technologies Use a strong account password, keep your withdrawal PIN private and do not share one-time verification codes. This website uses HTTPS and does not provide an identity-document or gift-card-code upload form. No system can guarantee absolute security. This public website does not add advertising pixels, analytics scripts or marketing cookies. Our hosting provider processes network requests needed to deliver and secure the website. The app and embedded customer-support service have their own operational data flows described above. You can control photo permissions through iOS Settings. Your rights & choices Subject to applicable law and necessary identity verification, you may request access to your information, correction, deletion, information about processing, restriction or objection, and withdrawal of consent. Portability may apply to certain information. You may also ask for human review of a decision affecting you. Visit Privacy Choices for practical instructions, including account deletion. We may ask for proportionate verification to protect your information; never provide your password or a one-time code to support. If your concern remains unresolved, you may contact the Nigeria Data Protection Commission or the Ghana Data Protection Commission, as applicable. Age & policy changes The service is intended for adults aged 18 or older in the supported markets. It is not directed at children. Contact us if you believe a child has provided personal information. We update this page when practices change and provide additional notice where appropriate. The date above identifies this version. Contact the operator WING HING DISPENSARY LIMITED CardNuvio support and privacy contact: miriamrhodes9314@outlook.com For a privacy request, describe the right you want to exercise and use your registered email where possible. You do not need to include identity documents in the initial message.