This policy explains what personal data CrossCulture (“CrossCulture”, “we”, “us”) collects when you use our website and app, why we collect it, who we share it with, and the choices and rights you have.
We are the data controller for this data. We follow the Nigeria Data Protection Act 2023 and, where they apply to members living in the UK or European Economic Area, the UK GDPR and EU GDPR.
1. What we collect
Information you give us:
- Account details: name, email address, password (stored hashed), and, if you sign in with Google, your Google name, email and profile picture.
- Profile and onboarding answers: photo, bio, gender, date of birth, phone number, country of origin, current country and city, languages and interests.
- Identity verification: a government-issued ID document, a selfie or short liveness video, and the result of the check. This is collected by our verification provider, Sumsub.
- Content: posts, comments, group activity, Knowledge Hub guides, Marketplace listings, reviews and photos you upload.
- Messages you send through chat. These are stored so they can be delivered and so we can investigate reports.
- Transactions: orders, bookings, tickets, subscriptions, delivery addresses, and the bank details you add for payouts.
- Anything you send us when you contact support or report a problem.
Information collected automatically:
- Device and log data: IP address, browser and device type, pages and features used, and dates and times of access.
- Approximate location derived from your IP address, and your precise location only if you choose to share it (for example to find nearby events).
- Data saved in your browser to keep you signed in and remember your settings (see section 8).
Information from others:
- Our payment providers tell us whether a payment succeeded, failed or was refunded. We never receive your full card number.
- Sumsub tells us whether your verification passed and the details needed to confirm it.
- Other members may mention you, review you, or report you.
2. How we use it, and our legal basis
- To create and run your account, show your profile, connect you with members, groups and events, and deliver your messages: to perform our contract with you.
- To verify your identity, prevent fraud, scams and fake accounts, and keep members safe: our legitimate interest in a trustworthy community, and our legal obligations.
- To process payments, hold funds in escrow, pay out earnings and keep financial records: to perform our contract, and to meet tax and anti-money-laundering obligations.
- To review reports, enforce our Terms and Community Guidelines, and respond to legal requests: legitimate interest and legal obligation.
- To send service messages such as receipts, security alerts and changes to our terms: to perform our contract.
- To send product news and offers: with your consent, which you can withdraw at any time.
- To understand how the Platform is used and improve it: legitimate interest.
Your ID and liveness check involve biometric data. We, through Sumsub, process this only with your explicit consent and only to confirm you are who you say you are.
We do not sell your personal data, and we do not use it for third-party advertising.
3. What other members can see
Your name, photo, verification badge, city, country of origin, bio and interests are visible to other members, as are your posts, listings, reviews and group activity. Messages are visible to the people in the conversation.
Your email address, phone number, date of birth, ID documents, payout details and exact address are not shown on your profile. A delivery address is shared only with the seller of an order you place.
5. International transfers
CrossCulture serves people across borders, and some of our providers process data outside Nigeria and outside the country you live in. Where we transfer data internationally we rely on adequacy decisions, standard contractual clauses or other safeguards recognised by the applicable law.
6. How long we keep it
We keep your data for as long as your account is open and for as long as we need it for the purposes above.
When you delete your account we delete or anonymise your profile and content within a reasonable period, except where we must keep some records longer: for example transaction and payout records for tax and accounting, verification records for anti-fraud and anti-money-laundering rules, and records related to a report, dispute or legal claim until it is resolved.
7. Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and get a copy of it;
- correct data that is wrong or incomplete;
- delete your data;
- object to, or ask us to restrict, how we use it;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent;
- complain to a data protection authority. In Nigeria this is the Nigeria Data Protection Commission (NDPC); in the UK, the ICO; in the EU, your local supervisory authority.
You can edit most of your profile in Settings. For anything else, email hello@crossculture.com. We may need to confirm your identity first, and we will reply within the time the law requires.
9. Security
We use encryption in transit, access controls and other technical and organisational safeguards to protect your data. ID documents are held by our verification provider rather than in our own app. No system is completely secure, so please use a strong, unique password. If we become aware of a breach that affects you, we will notify you and the authorities as the law requires.
10. Children
CrossCulture is for people aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a child has an account, tell us and we will remove it.
11. Changes to this policy
We will update this policy as the Platform changes and change the date at the top. If a change is significant we will tell you in the app or by email.
12. Contact
For privacy questions or to exercise your rights, email hello@crossculture.com, or write to us in Abuja, Nigeria.