Privacy Policy

BEWDY PRIVACY POLICY

Effective Date: 13/07/2026

Last Updated: 03/12/2025

1. INTRODUCTION

Welcome to Bewdy.

Bewdy Technologies Limited ("Bewdy," "we," "our," or "us") is committed to protecting your privacy and handling your Personal Data transparently, responsibly, and securely.

This Privacy Policy explains how we collect, use, disclose, transfer, store, protect, retain, and otherwise process Personal Data when you use any Bewdy products or services.

This Privacy Policy applies to all products and services owned or operated by Bewdy, including but not limited to:

• the Bewdy website;
• the Bewdy mobile applications;
• Bewdy Book;
• online booking services;
• payment services;
• messaging services;
• customer support services;
• APIs;
• integrations;
• marketing platforms;
• loyalty and rewards programmes;
• subscription services;
• business analytics tools;
• future products, features and services that reference this Privacy Policy.

This Privacy Policy forms part of the Bewdy Terms of Service.

Capitalised terms not defined in this Privacy Policy have the meaning given to them in the Terms of Service.

2. OUR COMMITMENT TO PRIVACY

Privacy is fundamental to the trust placed in our Platform.

We are committed to:

• processing Personal Data lawfully, fairly and transparently;
• collecting only information that is reasonably necessary;
• maintaining appropriate technical and organisational safeguards;
• respecting applicable privacy rights;
• limiting access to authorised personnel;
• continuously improving our privacy and security practices;
• complying with applicable data protection legislation.

Nothing in this Privacy Policy limits any rights you may have under mandatory applicable law.

3. WHO WE ARE

Bewdy is a technology platform that connects Customers with independent beauty and wellness professionals while providing software that enables Service Providers to operate and manage their businesses.

Bewdy is not itself a salon, spa, barbershop, beauty clinic, makeup artist, nail technician, hairstylist, aesthetic practitioner, massage therapist, or wellness provider.

Services offered through the Platform are performed solely by independent Service Providers.

Unless expressly stated otherwise, Service Providers are not employees, agents, partners, representatives or franchisees of Bewdy.

4. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies whenever you:

• browse our website;
• download our applications;
• create an account;
• book appointments;
• receive beauty or wellness services through the Platform;
• provide services through the Platform;
• use Bewdy Book;
• process payments;
• communicate with another user;
• contact customer support;
• submit reviews;
• upload photographs;
• participate in promotions;
• subscribe to newsletters;
• integrate third-party software;
• attend Bewdy events;
• communicate with us by telephone, email, social media or other channels;
• otherwise interact with any Bewdy products or services.

This Privacy Policy applies whether you access the Platform from a computer, mobile device, tablet, wearable device or any future technology capable of accessing our services.

5. OUR ROLE IN PROCESSING PERSONAL DATA

Depending on how you use the Platform, Bewdy may act as:

• a Data Controller;
• a Joint Controller;
• a Data Processor;
• or, where applicable, a service provider or equivalent role under applicable privacy legislation.

Our role depends on the particular activity being performed rather than your account type.

For example, Bewdy generally acts as a Data Controller when:

• creating your account;
• authenticating users;
• securing the Platform;
• preventing fraud;
• processing subscription payments;
• communicating service updates;
• complying with legal obligations;
• improving our products.

When Service Providers use Bewdy Book to manage their own customer relationships, appointment records, client notes or business operations, Bewdy generally processes such information on behalf of the relevant Service Provider acting as a Data Processor, except where applicable law or the nature of the processing requires Bewdy to act as an independent or joint controller.

Nothing in this Privacy Policy transfers ownership of customer relationships, business goodwill or customer databases from a Service Provider to Bewdy.

6. APPLICABLE DATA PROTECTION LAWS

Depending on your location and the services you use, your Personal Data may be processed in accordance with applicable privacy and data protection legislation, including but not limited to:

• the Nigeria Data Protection Act 2023;
• the UK General Data Protection Regulation;
• the EU General Data Protection Regulation;
• the UK Data Protection Act 2018;
• applicable United States state privacy legislation;
• and other applicable privacy laws in jurisdictions where Bewdy operates.

Where different laws apply simultaneously, Bewdy will endeavour to comply with the requirements applicable to the relevant processing activity.

7. DEFINITIONS

For purposes of this Privacy Policy:

Account means a registered Bewdy user account.

Applicable Law means all laws, regulations, statutory instruments, regulatory guidance and legally binding requirements applicable to the processing of Personal Data.

Business Customer means any salon, spa, beauty professional or other commercial organisation using Bewdy Book.

Customer means an individual seeking, booking or receiving services through the Platform.

Data Controller means the person or organisation determining the purposes and means of processing Personal Data.

Data Processor means a person or organisation processing Personal Data on behalf of a Data Controller.

Personal Data means any information relating to an identified or identifiable natural person.

Platform means every website, application, software product, API, integration, service or technology owned, operated or controlled by Bewdy.

Processing includes collecting, recording, organising, storing, adapting, retrieving, consulting, using, transmitting, sharing, restricting, deleting or otherwise handling Personal Data.

Service Provider means an independent beauty, wellness or related business using the Platform to advertise, accept bookings or manage business operations.

Special Category Data means Personal Data that receives enhanced protection under applicable law.

Unless the context requires otherwise, words in the singular include the plural and vice versa.

8. CATEGORIES OF PERSONAL DATA WE COLLECT

The Personal Data we collect depends on how you interact with the Platform, the products or services you use, your account type, applicable legal requirements, and the permissions you grant.

We do not intentionally collect Personal Data that is not reasonably necessary for the purposes described in this Privacy Policy.

The categories below are intended to be illustrative rather than exhaustive. We may collect additional categories of Personal Data where reasonably necessary to provide, improve, secure, or comply with legal obligations relating to the Platform.

9. INFORMATION YOU PROVIDE TO US

9.1 Account Registration Information

When you create an Account, we may collect information including:

• full name;
• preferred display name;
• username;
• email address;
• mobile telephone number;
• password (stored only in encrypted or hashed form where applicable);
• date of birth;
• country of residence;
• preferred language;
• profile photograph;
• authentication credentials;
• account preferences;
• marketing preferences.

You are responsible for ensuring that the information you provide is accurate, current, and complete.

9.2 Customer Information

Customers may voluntarily provide additional information, including:

• preferred beauty or wellness services;
• favourite Service Providers;
• preferred appointment times;
• saved addresses;
• emergency contact details (where applicable);
• accessibility requirements;
• communication preferences;
• profile biography;
• referral information;
• promotional codes;
• gift card information;
• loyalty programme participation;
• review history;
• ratings;
• uploaded images;
• appointment notes voluntarily provided by the Customer.

9.3 Service Provider Information

Where you register as a Service Provider or Business Customer, we may collect:

• legal business name;
• trading name;
• registered business address;
• business telephone number;
• business email address;
• website;
• social media profiles;
• professional qualifications;
• licences;
• certifications;
• insurance information where required;
• business registration documents;
• tax identification numbers where legally required;
• VAT or equivalent tax registration details where applicable;
• business operating hours;
• services offered;
• service descriptions;
• service pricing;
• estimated appointment durations;
• cancellation policies;
• portfolio images;
• promotional materials;
• staff profiles;
• business logos;
• photographs of premises;
• payroll-related information where features require it;
• inventory records;
• supplier information;
• customer management information entered into Bewdy Book.

9.4 Identity Verification Information

To comply with legal obligations, reduce fraud, improve marketplace integrity, or verify eligibility for certain services, Bewdy may collect or receive:

• government-issued identification;
• passport information;
• driver's licence information;
• national identity card information;
• proof of address;
• business ownership verification;
• company registration documentation;
• tax verification;
• photographs or selfies used for identity verification;
• biometric comparison results provided by third-party verification providers where legally permitted.

Unless required by law or operational necessity, Bewdy does not permanently retain copies of identity documents after verification has been completed.

9.5 Payment and Financial Information

Where payments are processed through the Platform, we may collect:

• transaction identifiers;
• payment reference numbers;
• payment status;
• payment method;
• billing address;
• payout information;
• settlement information;
• refund history;
• chargeback information;
• commission calculations;
• subscription billing records;
• invoices;
• receipts;
• taxation information;
• payment disputes.

Payment card details are generally collected and processed directly by PCI DSS-compliant third-party payment processors.

Bewdy does not intentionally store full payment card numbers or card security codes.

10. INFORMATION WE COLLECT AUTOMATICALLY

When you access or use the Platform, certain information may be collected automatically.

This may include:

Device Information

• device type;
• manufacturer;
• operating system;
• operating system version;
• browser type;
• browser version;
• device identifiers;
• advertising identifiers;
• mobile network;
• application version;
• screen resolution;
• language settings;
• time zone.

Network Information

We may collect:

• IP address;
• internet service provider;
• connection type;
• network diagnostics;
• latency information;
• approximate geographic location derived from IP address.

Usage Information

We may collect information relating to your interaction with the Platform, including:

• login history;
• logout history;
• session duration;
• searches performed;
• services viewed;
• providers viewed;
• appointments booked;
• appointments cancelled;
• features used;
• navigation behaviour;
• clicks;
• scrolling activity where legally permitted;
• referral source;
• crash reports;
• error logs;
• application diagnostics.

Security Information

To protect the Platform, we may collect information relating to:

• suspicious login attempts;
• authentication failures;
• password reset requests;
• unusual device activity;
• fraud indicators;
• abuse detection;
• account compromise indicators;
• security event logs.

11. LOCATION INFORMATION

Where you grant permission, Bewdy may collect location information to improve Platform functionality.

Location information may include:

Precise Location

Collected through GPS or comparable device technologies where permission has been granted.

Approximate Location

Derived from:

• IP address;
• Wi-Fi information;
• mobile network;
• regional settings.

Location information may be used to:

• identify nearby Service Providers;
• improve search relevance;
• estimate travel distance;
• personalise recommendations;
• detect potentially fraudulent activity;
• comply with legal obligations;
• improve operational analytics.

You may disable location permissions through your device settings, although some Platform features may become unavailable or function with reduced accuracy.

12. INFORMATION FROM THIRD PARTIES

We may receive Personal Data from third parties including:

• payment processors;
• identity verification providers;
• fraud prevention providers;
• analytics providers;
• marketing partners;
• advertising partners;
• social media platforms;
• authentication providers;
• business partners;
• publicly available sources;
• regulatory authorities;
• law enforcement agencies where legally authorised;
• other users of the Platform.

Where legally permitted, we may combine information received from third parties with information already associated with your Account.

13. SPECIAL CATEGORY DATA

Certain services may involve the processing of information that is considered sensitive or Special Category Data under applicable law.

Examples may include:

• accessibility requirements;
• allergy information voluntarily disclosed for appointment purposes;
• pregnancy-related service preferences voluntarily disclosed;
• disability accommodations;
• health-related information voluntarily provided to facilitate safe service delivery.

Bewdy requests that users provide only the minimum information reasonably necessary.

Unless otherwise required by law, Service Providers remain responsible for determining what client information is necessary to deliver their services safely and lawfully.

Where Bewdy processes Special Category Data as a Data Processor on behalf of a Service Provider, the relevant Service Provider remains responsible for establishing an appropriate lawful basis for such processing.

14. CHILDREN'S INFORMATION

The Platform is intended for individuals who are at least the minimum age required to enter into a legally binding agreement under applicable law.

Bewdy does not knowingly solicit or intentionally collect Personal Data from children where prohibited by applicable law.

If we become aware that Personal Data has been collected from a child without appropriate legal authority or required parental consent, we will take reasonable steps to:

• restrict access to the Account where appropriate;
• investigate the circumstances;
• delete the relevant Personal Data where legally required;
• comply with any applicable legal notification obligations.

Parents or legal guardians who believe a child has submitted Personal Data to Bewdy should contact us using the details provided in this Privacy Policy.

15. INFORMATION WE DO NOT INTENTIONALLY COLLECT

Unless specifically required for a lawful purpose, Bewdy does not intentionally collect:

• passwords for third-party services;
• complete payment card numbers;
• card verification values (CVV/CVC);
• confidential government security credentials;
• information unrelated to the operation of the Platform;
• unlawful or improperly obtained Personal Data.

If such information is inadvertently received, Bewdy reserves the right to securely delete or restrict access to that information where appropriate and permitted by law.

16. PURPOSES FOR WHICH WE PROCESS PERSONAL DATA

Bewdy processes Personal Data only where there is a legitimate and lawful purpose for doing so. The purposes described below are intended to be comprehensive but not exhaustive. We may process Personal Data for additional compatible purposes where permitted or required by applicable law.

Depending on the circumstances, a single processing activity may rely on more than one lawful basis.

17. LAWFUL BASES FOR PROCESSING

Where applicable privacy laws require a lawful basis for processing Personal Data, Bewdy relies on one or more of the following:

17.1 Performance of a Contract

We process Personal Data where necessary to:

• create and manage Accounts;
• enable Customers to book appointments;
• enable Service Providers to receive bookings;
• process subscriptions;
• facilitate payments and payouts;
• provide Bewdy Book;
• provide customer support;
• authenticate users;
• manage appointments;
• provide requested services;
• enforce contractual rights and obligations.

Without this processing, many core Platform features cannot operate.

17.2 Compliance with Legal Obligations

We process Personal Data where required to comply with applicable laws, including obligations relating to:

• taxation;
• financial reporting;
• anti-money laundering;
• sanctions compliance;
• court orders;
• lawful requests from regulators;
• law enforcement investigations;
• consumer protection legislation;
• accounting obligations;
• employment obligations where applicable;
• data protection legislation.

17.3 Legitimate Interests

Subject to applicable law, Bewdy may process Personal Data where necessary for our legitimate interests or those of our users, provided those interests do not override your fundamental rights and freedoms.

These interests include:

• improving Platform performance;
• protecting users;
• preventing fraud;
• preventing spam;
• preventing abuse;
• ensuring network security;
• detecting malicious activity;
• developing new products;
• conducting analytics;
• measuring Platform performance;
• maintaining service reliability;
• enforcing our legal rights;
• protecting intellectual property;
• resolving disputes;
• responding to legal claims;
• protecting the integrity of the marketplace.

Where required, we conduct legitimate interest assessments before relying on this legal basis.

17.4 Consent

Where processing is based upon consent, we will obtain consent before processing begins.

Examples include:

• promotional emails;
• marketing SMS;
• optional push notifications;
• location services;
• optional cookies;
• participation in surveys;
• participation in promotional campaigns.

You may withdraw consent at any time without affecting processing already carried out before consent was withdrawn.

Withdrawal of consent does not affect processing carried out on another lawful basis.

17.5 Protection of Vital Interests

Where necessary, Bewdy may process Personal Data to protect an individual's life, health or physical safety.

Examples may include responding to emergency situations, serious security incidents or cooperating with emergency services where legally appropriate.

18. HOW WE USE PERSONAL DATA

We use Personal Data for the following purposes.

18.1 Account Administration

Including to:

• create Accounts;
• verify Accounts;
• manage profiles;
• authenticate users;
• reset passwords;
• prevent duplicate Accounts;
• secure logins;
• manage permissions;
• manage subscriptions.

18.2 Marketplace Operations

Including to:

• display Service Providers;
• enable appointment bookings;
• manage availability;
• process cancellations;
• manage waitlists;
• confirm appointments;
• notify Service Providers;
• notify Customers;
• facilitate communications;
• generate booking records;
• improve booking accuracy.

18.3 Bewdy Book Services

Where Service Providers use Bewdy Book, Personal Data may be processed to provide:

• appointment scheduling;
• calendar management;
• customer relationship management;
• customer history;
• customer notes;
• invoicing;
• financial reporting;
• sales reporting;
• inventory management;
• stock control;
• supplier management;
• employee scheduling;
• payroll-related features;
• business analytics;
• operational reporting;
• customer retention tools;
• marketing features;
• loyalty programme administration;
• gift card administration;
• package management;
• membership management;
• reporting dashboards;
• future software modules released as part of Bewdy Book.

18.4 Payments

Personal Data may be processed to:

• process payments;
• process deposits;
• process refunds;
• calculate commissions;
• settle funds;
• detect payment fraud;
• investigate payment disputes;
• manage subscriptions;
• calculate taxes;
• generate invoices;
• generate receipts;
• reconcile financial records.

18.5 Identity Verification

Where appropriate, Bewdy may process Personal Data to:

• verify identity;
• verify business ownership;
• reduce fraud;
• protect users;
• comply with Know Your Customer (KYC) obligations;
• comply with anti-money laundering obligations;
• investigate suspicious activity.

Identity verification may be performed internally or through trusted third-party providers.

18.6 Communications

We process Personal Data to communicate with users, including:

• booking confirmations;
• appointment reminders;
• payment confirmations;
• security notifications;
• support responses;
• verification codes;
• product updates;
• maintenance notices;
• policy updates;
• legal notices;
• dispute notifications.

These communications are generally considered service communications rather than marketing communications.

Users cannot opt out of communications that are necessary for operation of the Platform.

18.7 Customer Support

Personal Data may be processed to:

• respond to enquiries;
• investigate complaints;
• resolve disputes;
• improve support quality;
• verify user identity;
• prevent abuse of support services;
• maintain support records.

Support interactions may be monitored, recorded or reviewed where permitted by applicable law for quality assurance, training, fraud prevention and security purposes.

18.8 Platform Improvement

We analyse information to:

• improve user experience;
• improve accessibility;
• improve search algorithms;
• improve recommendations;
• optimise booking flows;
• identify software bugs;
• monitor application performance;
• improve reliability;
• test new features;
• develop future services.

Where possible, we use aggregated or de-identified information for these purposes.

18.9 Fraud Prevention and Platform Integrity

Protecting the integrity of the Platform is a legitimate business objective.

We may process Personal Data to:

• detect fraudulent Accounts;
• identify fake bookings;
• prevent payment fraud;
• detect account takeovers;
• identify suspicious login activity;
• detect bots;
• prevent spam;
• identify abusive behaviour;
• investigate policy violations;
• investigate intellectual property infringement;
• enforce Platform rules;
• protect other users.

Where appropriate, automated systems may assist in identifying suspicious behaviour.

18.10 Safety and Security

We process Personal Data to:

• protect Customers;
• protect Service Providers;
• protect employees;
• protect contractors;
• protect Platform infrastructure;
• detect cybersecurity threats;
• investigate incidents;
• maintain system integrity;
• prevent unauthorised access.

18.11 Compliance and Legal Enforcement

We may process Personal Data where reasonably necessary to:

• comply with applicable law;
• comply with court orders;
• cooperate with regulators;
• respond to lawful governmental requests;
• establish legal claims;
• exercise legal rights;
• defend legal proceedings;
• resolve disputes;
• enforce our contracts.

18.12 Research, Analytics and Business Intelligence

Subject to applicable law, Bewdy may use Personal Data, aggregated information and de-identified information to:

• understand marketplace trends;
• improve operational efficiency;
• identify service demand;
• improve software performance;
• analyse customer behaviour;
• measure business growth;
• evaluate feature adoption;
• produce statistical reports;
• develop future products.

Where reasonably possible, these activities will rely on aggregated or anonymised information rather than identifiable Personal Data.

18.13 Artificial Intelligence and Machine Learning

Bewdy may use artificial intelligence, machine learning or similar technologies to:

• improve search functionality;
• personalise recommendations;
• detect fraud;
• identify spam;
• improve customer support;
• automate administrative processes;
• generate business insights for Service Providers;
• improve appointment scheduling;
• optimise Platform performance.

Unless expressly stated otherwise, Bewdy does not use identifiable Personal Data to train publicly available artificial intelligence models without an appropriate lawful basis and any required consent.

Where third-party AI providers process Personal Data on our behalf, they are required to process such information only in accordance with our instructions, applicable law, and contractual obligations.

Where applicable law grants individuals rights in relation to solely automated decision-making that produces legal or similarly significant effects, Bewdy will provide those rights in accordance with applicable law.

19. DISCLOSURE AND SHARING OF PERSONAL DATA

Bewdy treats Personal Data as confidential and does not sell Personal Data to third parties for monetary consideration.

We disclose Personal Data only where necessary to operate the Platform, comply with legal obligations, protect legitimate interests, fulfil contractual obligations, or where you have directed or authorised us to do so.

Any disclosure is limited to the information reasonably necessary for the relevant purpose.

20. SHARING BETWEEN CUSTOMERS AND SERVICE PROVIDERS

The Platform is designed to facilitate transactions between Customers and independent Service Providers.

Accordingly, certain Personal Data must be shared between the parties in order to complete bookings and provide services.

20.1 Information Shared with Service Providers

When a Customer books an appointment, Bewdy may provide the selected Service Provider with information including:

• Customer name;
• appointment date and time;
• selected services;
• booking reference;
• appointment notes voluntarily provided by the Customer;
• communication history relating to the booking;
• payment status where necessary;
• cancellation history relating to that booking;
• customer preferences voluntarily provided for service delivery.

Only the information reasonably necessary to perform the requested services will be shared.

20.2 Information Shared with Customers

Customers may view information relating to Service Providers, including:

• business name;
• trading name;
• business description;
• professional qualifications voluntarily displayed;
• service listings;
• pricing;
• business hours;
• location;
• portfolio images;
• customer ratings;
• customer reviews;
• available appointment times;
• cancellation policies;
• other information intentionally published by the Service Provider.

Service Providers control the content they choose to publish through their public profiles, subject to the Platform's Terms of Service and Community Guidelines.

21. THIRD-PARTY SERVICE PROVIDERS

Bewdy engages carefully selected third-party providers to support the operation of the Platform.

Depending on the services used, these providers may process Personal Data on our behalf.

Categories of providers include:

• cloud hosting providers;
• database providers;
• payment processors;
• payment gateways;
• fraud detection providers;
• identity verification providers;
• customer support platforms;
• analytics providers;
• communication providers;
• SMS providers;
• email delivery providers;
• push notification providers;
• mapping providers;
• search providers;
• authentication providers;
• monitoring providers;
• cybersecurity providers;
• disaster recovery providers;
• document storage providers;
• accounting software providers;
• legal advisers;
• auditors;
• insurance providers;
• regulatory reporting providers.

All providers receiving Personal Data are required, by contract or applicable law, to implement appropriate security and confidentiality measures.

Where required by law, Data Processing Agreements are entered into with relevant processors.

22. PAYMENT PROCESSORS

Payments made through the Platform may be processed by independent third-party payment providers.

Depending upon the country in which services are provided, payment processing may involve:

• payment gateways;
• acquiring banks;
• card networks;
• mobile money providers;
• digital wallet providers;
• banking institutions.

These providers process payment information in accordance with their own privacy policies and applicable financial regulations.

Bewdy does not control the independent processing activities of payment providers acting as separate data controllers.

23. BUSINESS TRANSFERS

If Bewdy undergoes or participates in:

• a merger;
• acquisition;
• investment;
• recapitalisation;
• restructuring;
• sale of shares;
• sale of assets;
• insolvency;
• administration;
• receivership;
• business reorganisation;
• financing transaction;

Personal Data may be transferred to the relevant successor entity or authorised participants in the transaction, subject to applicable confidentiality obligations and applicable law.

Where legally required, affected users will receive appropriate notice.

24. LEGAL DISCLOSURES

Bewdy may disclose Personal Data where we reasonably believe disclosure is necessary to:

• comply with applicable law;
• comply with court orders;
• comply with lawful governmental requests;
• respond to lawful requests from regulators;
• comply with tax authorities;
• enforce contractual rights;
• protect public safety;
• prevent fraud;
• investigate unlawful conduct;
• investigate violations of our Terms;
• defend legal proceedings;
• establish legal claims;
• protect the rights, property or safety of Bewdy, our users or others.

Nothing in this Privacy Policy requires Bewdy to notify users where notification is prohibited by law or would compromise an investigation.

25. INTERNATIONAL DATA TRANSFERS

Because Bewdy operates through cloud-based technologies and international service providers, Personal Data may be processed outside your country of residence.

Where Personal Data is transferred internationally, Bewdy implements safeguards appropriate to the applicable legal framework.

These safeguards may include:

• Standard Contractual Clauses approved by the European Commission;
• the UK International Data Transfer Addendum;
• adequacy regulations or adequacy decisions;
• approved certification mechanisms;
• approved codes of conduct;
• binding contractual obligations;
• encryption;
• pseudonymisation;
• access controls;
• other legally recognised transfer mechanisms.

Where no appropriate safeguard exists, Bewdy will rely only upon a lawful transfer mechanism recognised under applicable law.

26. DATA OWNERSHIP

Nothing in this Privacy Policy transfers ownership of Personal Data, customer relationships or business goodwill.

26.1 Customer Accounts

Customers retain ownership of Personal Data they provide, subject to the licences and rights necessary for Bewdy to operate the Platform.

26.2 Service Provider Business Data

Subject to applicable law and our contractual rights:

• Service Providers retain ownership of their business information;
• Service Providers retain ownership of customer relationship information entered into Bewdy Book;
• Service Providers retain ownership of appointment histories they create;
• Service Providers retain ownership of pricing structures they configure;
• Service Providers retain ownership of portfolio content they upload.

Bewdy does not acquire ownership of a Service Provider's customer list merely because the Service Provider uses Bewdy Book.

26.3 Platform Data

Bewdy owns all rights, title and interest in:

• Platform software;
• source code;
• databases created by Bewdy;
• algorithms;
• analytics methodologies;
• aggregated information;
• anonymised datasets;
• system logs;
• security systems;
• intellectual property;
• business processes;
• trademarks;
• branding.

Nothing in this Privacy Policy grants users ownership of Bewdy intellectual property.

27. USER-GENERATED CONTENT

Users may voluntarily upload:

• reviews;
• ratings;
• comments;
• photographs;
• videos;
• portfolio images;
• testimonials;
• profile content;
• messages where applicable.

Users remain responsible for ensuring they possess all rights necessary to upload such content.

By uploading content, users grant Bewdy a worldwide, non-exclusive, royalty-free, transferable, sublicensable licence to host, store, reproduce, display, adapt, distribute and otherwise use that content solely to:

• operate the Platform;
• improve the Platform;
• provide the requested services;
• market the Platform;
• enforce our agreements;
• protect the integrity and security of the Platform.

This licence continues only for as long as reasonably necessary to provide the relevant services, maintain backups, comply with legal obligations, resolve disputes, or protect legitimate interests.

Removal of content from the Platform does not require immediate deletion from secure backups, archival systems or records maintained for legal compliance.

28. REVIEWS AND RATINGS

Transparency is fundamental to maintaining trust in the Bewdy marketplace.

Customers may leave reviews following genuine appointments.

Bewdy reserves the right, but not the obligation, to investigate, moderate, edit, restrict, remove or refuse to publish reviews that:

• are fraudulent;
• relate to appointments that did not occur;
• are defamatory;
• contain hate speech;
• contain unlawful content;
• reveal confidential information;
• contain personal information about another individual without lawful authority;
• constitute harassment;
• impersonate another person;
• promote competing services;
• violate our Community Guidelines;
• otherwise threaten the integrity of the Platform.

Removing a review does not necessarily affect the validity of the underlying transaction or the Customer's account.

Service Providers may respond publicly to reviews in accordance with our Community Guidelines.

Bewdy does not guarantee the accuracy, completeness or reliability of user-generated reviews and accepts no responsibility for opinions expressed by users.

29. INFORMATION SECURITY

Protecting Personal Data is fundamental to the integrity of the Platform.

Bewdy maintains and continuously reviews administrative, technical, physical and organisational safeguards designed to protect Personal Data against accidental, unlawful or unauthorised destruction, loss, alteration, disclosure, access or misuse.

Our security programme is risk-based and evolves to address emerging threats, technological developments and regulatory expectations.

No security measure is infallible. While Bewdy implements commercially reasonable safeguards appropriate to the nature of the Personal Data processed, no method of electronic transmission, cloud storage or information security can guarantee absolute security.

29.1 Security Measures

Depending on the services provided and the sensitivity of the information involved, our safeguards may include:

• encryption of data in transit using industry-standard protocols;
• encryption of sensitive data at rest where appropriate;
• strong cryptographic key management;
• role-based access controls;
• least-privilege access principles;
• multi-factor authentication for privileged accounts;
• secure software development practices;
• security testing before deployment;
• vulnerability scanning;
• penetration testing;
• infrastructure monitoring;
• intrusion detection and prevention technologies;
• distributed denial-of-service mitigation;
• malware detection;
• audit logging;
• access logging;
• backup and disaster recovery procedures;
• business continuity planning;
• change management procedures;
• vendor security assessments;
• employee confidentiality obligations;
• regular security awareness training.

The implementation of any specific security measure does not constitute a contractual guarantee that such measure will always prevent unauthorised access or security incidents.

29.2 User Security Responsibilities

Users also play an important role in protecting their information.

Users are responsible for:

• maintaining the confidentiality of login credentials;
• selecting strong passwords;
• protecting authentication devices;
• promptly notifying Bewdy of suspected unauthorised access;
• keeping contact information current;
• maintaining the security of their own devices;
• ensuring software is kept reasonably up to date;
• protecting backups of exported data.

Bewdy is not responsible for losses resulting from a user's failure to protect Account credentials except where required by applicable law.

30. DATA RETENTION

Bewdy retains Personal Data only for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, enforce agreements and protect legitimate business interests.

Retention periods may vary depending upon:

• the nature of the information;
• the purpose of processing;
• legal requirements;
• regulatory obligations;
• accounting requirements;
• fraud prevention needs;
• security requirements;
• contractual obligations.

30.1 Illustrative Retention Periods

Unless a longer period is required or permitted by applicable law, Personal Data may generally be retained as follows:

These periods are indicative only and may be extended where necessary to comply with applicable law or protect legitimate interests.

30.2 Secure Disposal

Where Personal Data is no longer required, Bewdy will, where reasonably practicable:

• securely delete it;
• anonymise it;
• aggregate it;
• permanently destroy physical records;
• render it irretrievable.

Residual copies may remain within secure backups until overwritten in accordance with normal disaster recovery procedures.

31. YOUR PRIVACY RIGHTS

Depending on your jurisdiction and applicable law, you may have one or more of the following rights.

31.1 Right of Access

You may request confirmation of whether Bewdy processes your Personal Data and obtain access to that information together with information required under applicable law.

31.2 Right to Rectification

You may request correction of inaccurate or incomplete Personal Data.

31.3 Right to Erasure

Subject to applicable law, you may request deletion of your Personal Data.

Deletion rights are not absolute.

Bewdy may retain information where necessary to:

• comply with legal obligations;
• exercise legal rights;
• defend legal claims;
• investigate fraud;
• maintain financial records;
• protect other users;
• complete ongoing transactions.

31.4 Right to Restrict Processing

Where applicable, you may request that certain processing activities be temporarily restricted.

31.5 Right to Object

Where processing is based upon legitimate interests, you may object to that processing.

Bewdy will evaluate such objections in accordance with applicable law.

31.6 Right to Data Portability

Where legally applicable, you may request a copy of certain Personal Data in a structured, commonly used and machine-readable format.

Where technically feasible and legally required, you may request transmission of such information to another service provider.

31.7 Right to Withdraw Consent

Where processing relies upon consent, consent may be withdrawn at any time.

Withdrawal does not affect the lawfulness of processing undertaken before consent was withdrawn.

31.8 Right Not to Be Subject to Certain Automated Decisions

Where applicable law grants this right, you may request human review of decisions based solely on automated processing that produce legal or similarly significant effects.

31.9 Right to Lodge a Complaint

You may lodge a complaint with the competent supervisory authority responsible for privacy matters within your jurisdiction.

Nothing in this Privacy Policy limits your statutory rights.

32. EXERCISING YOUR RIGHTS

Privacy requests may be submitted using the contact information provided in this Privacy Policy.

Before fulfilling certain requests, Bewdy may require verification of identity to protect users against fraudulent or unauthorised requests.

Verification requirements will be proportionate to the sensitivity of the request.

Bewdy reserves the right to:

• request additional information;
• decline manifestly unfounded requests;
• decline excessive or repetitive requests;
• charge a reasonable fee where permitted by applicable law;
• extend response periods where legally permitted due to complexity or volume.

Where a request cannot be fulfilled, Bewdy will explain the reasons unless prohibited by law.

33. MARKETING COMMUNICATIONS

Where permitted by applicable law, Bewdy may send marketing communications regarding:

• new products;
• platform features;
• promotional campaigns;
• educational content;
• loyalty programmes;
• referral programmes;
• partner offers;
• surveys;
• events.

Users may opt out of marketing communications at any time by:

• using the unsubscribe mechanism included in communications;
• updating communication preferences within their Account;
• contacting Bewdy directly.

Opting out of marketing communications does not prevent Bewdy from sending operational, transactional or legally required communications.

34. COOKIES AND SIMILAR TECHNOLOGIES

Bewdy uses cookies, software development kits (SDKs), pixels, local storage, device identifiers and similar technologies to improve the operation of the Platform.

These technologies may perform functions including:

• authenticating users;
• maintaining sessions;
• remembering preferences;
• improving performance;
• measuring usage;
• preventing fraud;
• delivering security functions;
• measuring advertising effectiveness where permitted.

34.1 Categories of Cookies

We may use:

Strictly Necessary Cookies

Required for the Platform to operate.

Functional Cookies

Used to remember preferences and improve usability.

Analytics Cookies

Used to understand Platform performance and user interaction.

Performance Cookies

Used to optimise speed, reliability and functionality.

Advertising Cookies

Where permitted, used to measure marketing performance and provide relevant advertising.

34.2 Cookie Consent

Where required by applicable law:

• non-essential cookies will not be placed until consent has been obtained;
• users may modify cookie preferences at any time;
• consent may be withdrawn without affecting essential Platform functionality.

Certain browser settings may also permit users to restrict or delete cookies.

Disabling cookies may reduce the functionality of certain Platform features.

35. ARTIFICIAL INTELLIGENCE AND AUTOMATED PROCESSING

Bewdy may use artificial intelligence ("AI"), machine learning, statistical models, and other automated technologies to improve the Platform, enhance security, support business operations, and deliver a better user experience.

Our use of AI is guided by the principles of lawfulness, fairness, transparency, accountability, privacy, security, and human oversight where appropriate.

35.1 Permitted Uses of AI

AI may be used to:

• recommend relevant Service Providers;
• improve search functionality;
• personalise content;
• optimise appointment scheduling;
• identify duplicate or fraudulent Accounts;
• detect suspicious activity;
• improve customer support;
• generate business insights for Service Providers;
• improve forecasting and analytics;
• analyse support requests;
• improve spam detection;
• identify policy violations;
• improve Platform reliability;
• assist internal administrative processes.

35.2 AI Training

Unless expressly disclosed otherwise, Bewdy does not intentionally use identifiable Personal Data to train publicly available or generally available artificial intelligence models without an appropriate lawful basis and, where required, valid consent.

Where Personal Data is used to improve Bewdy's proprietary systems, appropriate safeguards including data minimisation, access controls, pseudonymisation or anonymisation may be applied where reasonably practicable.

35.3 Human Oversight

Where automated systems assist with decision-making, Bewdy may conduct human review where appropriate, particularly where required by applicable law or where automated decisions may materially affect users.

Nothing in this Privacy Policy guarantees that every operational decision will involve human review where automated processing is legally permissible.

36. FRAUD PREVENTION, SECURITY MONITORING AND PLATFORM INTEGRITY

Protecting the integrity of the Platform is essential to maintaining trust between Customers, Service Providers and Bewdy.

Accordingly, Bewdy may process Personal Data to:

• detect fraud;
• prevent account takeovers;
• identify fake reviews;
• identify fake bookings;
• prevent payment fraud;
• detect bots;
• investigate abuse;
• enforce Platform rules;
• investigate policy violations;
• investigate intellectual property infringement;
• monitor unusual activity;
• identify coordinated fraudulent behaviour;
• protect users from scams;
• identify compromised devices;
• detect malicious software;
• improve Platform security.

Where appropriate, automated systems may be used to identify patterns associated with fraudulent or abusive activity.

Bewdy reserves the right to suspend, restrict or investigate Accounts where reasonably necessary to protect the Platform or comply with applicable law.

37. DATA BREACH MANAGEMENT

Bewdy maintains internal procedures designed to detect, investigate, contain and respond to actual or suspected Personal Data breaches.

Where a Personal Data breach occurs, Bewdy will assess:

• the nature of the incident;
• the categories of information affected;
• the likelihood of harm;
• the individuals affected;
• applicable legal notification obligations;
• remediation measures.

Where required by applicable law, Bewdy will notify:

• affected individuals;
• supervisory authorities;
• regulators;
• law enforcement agencies where appropriate.

Notifications will be made without undue delay and within applicable statutory timeframes where legally required.

Nothing in this Privacy Policy requires Bewdy to provide notifications where notification is not required under applicable law.

38. THIRD-PARTY WEBSITES, APPLICATIONS AND SERVICES

The Platform may contain links to websites, applications, plug-ins or services operated by third parties.

Bewdy does not own or control these third-party services and is not responsible for:

• their privacy practices;
• their security measures;
• their content;
• their availability;
• their processing of Personal Data.

Your interactions with third-party services are governed by the applicable terms and privacy policies of those third parties.

The inclusion of a link does not constitute endorsement by Bewdy.

39. ACCOUNT CLOSURE AND DELETION

Users may close their Accounts at any time, subject to any outstanding contractual or legal obligations.

Closing an Account does not automatically result in the immediate deletion of all Personal Data.

Certain information may be retained where reasonably necessary to:

• complete pending transactions;
• process refunds;
• resolve disputes;
• comply with tax obligations;
• comply with accounting obligations;
• investigate fraud;
• detect abuse;
• comply with court orders;
• protect legal rights;
• maintain security records;
• comply with applicable law.

Where Personal Data is no longer required, Bewdy will securely delete, anonymise or otherwise dispose of such information in accordance with this Privacy Policy and applicable law.

40. CHANGES TO THIS PRIVACY POLICY

Bewdy may amend this Privacy Policy from time to time to reflect:

• changes to the Platform;
• technological developments;
• legal or regulatory changes;
• operational requirements;
• security improvements;
• business expansion;
• new products or services.

The "Last Updated" date at the beginning of this Privacy Policy indicates the version currently in effect.

Where required by applicable law, Bewdy will provide notice of material changes through one or more appropriate channels, including:

• the Platform;
• email;
• push notifications;
• other reasonable communication methods.

Continued use of the Platform following the effective date of an updated Privacy Policy constitutes acceptance of the revised Privacy Policy to the extent permitted by applicable law.

41. CONTACT INFORMATION

Questions, requests or concerns regarding this Privacy Policy or Bewdy's processing of Personal Data may be directed to:

Data Protection Officer

Bewdy Technologies Limited

Email: privacy@bewdy.com

Website: https://www.bewdy.com

Registered Office:

15 Oluyole Extension Ibadan, Nigeria

Where required by applicable law, users may also contact the relevant supervisory authority responsible for data protection in their jurisdiction.

42. GOVERNING LAW

This Privacy Policy shall be governed by and interpreted in accordance with the laws specified in the Bewdy Terms of Service, without prejudice to any mandatory rights afforded to individuals under applicable data protection legislation.

Nothing in this Privacy Policy excludes, restricts or limits any statutory rights that cannot lawfully be excluded under applicable law.

43. SEVERABILITY

If any provision of this Privacy Policy is held to be invalid, unlawful or unenforceable by a court or competent authority, that provision shall be enforced to the maximum extent permissible, and the remaining provisions shall continue in full force and effect.

44. NO WAIVER

Failure by Bewdy to exercise or enforce any right or provision under this Privacy Policy shall not constitute a waiver of that right or provision.

Any waiver shall be effective only if made expressly in writing by an authorised representative of Bewdy.

45. ENTIRE PRIVACY POLICY

This Privacy Policy constitutes the entire privacy notice governing Bewdy's processing of Personal Data unless supplemented by:

• jurisdiction-specific privacy notices;
• product-specific privacy notices;
• employment privacy notices;
• Data Processing Agreements;
• additional notices presented at the point of collection.

Where such supplementary notices apply, they shall prevail only to the extent of any inconsistency for the specific processing activity they govern.

46. EFFECTIVE DATE

This Privacy Policy is effective from the Effective Date stated at the beginning of this document and remains in force until replaced by a subsequent version.