Data Protection (NDPA)

Lawful bases

• Contract — operating your wallets, allocations, mandates and payments.
• Legal obligation — identity verification, sanctions screening and transaction record-keeping.
• Legitimate interest — fraud prevention, service security and product reliability.
• Consent — marketing messages and optional WhatsApp notifications, withdrawable at any time.

Your rights

• Access a copy of the personal data we hold about you.
• Correct inaccurate or incomplete records.
• Request erasure where no legal retention duty applies.
• Object to or restrict certain processing, including marketing.
• Receive your data in a portable, machine-readable format.
• Lodge a complaint with the Nigeria Data Protection Commission.

We respond to verified rights requests within 30 days.

Retention

Financial records, KYC evidence and audit logs are retained for at least five years after account closure, as required by Nigerian financial regulation. Non-essential data is deleted or anonymised sooner.

Cross-border transfers

Where infrastructure or subprocessors are located outside Nigeria, transfers rely on adequacy or contractual safeguards, and are limited to what is necessary to run the service. See our Subprocessors page.

Breach notification

Suspected personal data breaches are investigated immediately. Reportable breaches are notified to the Nigeria Data Protection Commission within 72 hours, and affected users are informed where there is a high risk to their rights.

Data protection officer

A designated data protection officer oversees compliance, handles rights requests and maintains our record of processing activities. Requests can be raised through in-app support.