Privacy Policy

01Introduction

NetPay provides cross-border payment and remittance services. By using our services, you agree to the terms of this Privacy Policy. We are committed to protecting your personal data and processing it lawfully, fairly, and transparently.

02Information We Collect

Because NetPay facilitates cross-border money transfers, we are required by our regulators to collect more extensive identity, financial, and transaction information than a typical consumer app, in order to verify identity, screen for sanctions and financial crime risk, and comply with reporting obligations to the CBN and the Nigerian Financial Intelligence Unit (NFIU).

We collect this information directly from you during onboarding and transaction initiation, automatically through your use of the NetPay application, and from third parties such as identity verification providers, correspondent banks, partner payment institutions, card networks, and public sanctions or watchlist databases.

03Legal Basis for Processing

NetPay processes personal data only where a lawful basis exists under the NDPA, including:

• Consent — where you have given clear, informed consent for a specific purpose, such as marketing communications.
• Performance of a contract — to open your account, verify your identity, and execute payment instructions you have given us.
• Compliance with a legal obligation — including KYC, customer due diligence, sanctions screening, and suspicious transaction reporting required under CBN and NFIU rules.
• Legitimate interests — for fraud prevention, network and information security, and service improvement, balanced against your rights and freedoms.

04How We Use Your Information

• To verify your identity and conduct customer due diligence (CDD) and enhanced due diligence (EDD) where required.
• To open, maintain, and administer your NetPay wallet or account.
• To execute, process, confirm, and reconcile domestic and cross-border payment instructions, including converting currency and routing funds through correspondent banks or partner payment institutions.
• To screen transactions and counterparties against applicable sanctions lists and politically exposed persons (PEP) databases.
• To detect, investigate, and prevent fraud, money laundering, terrorism financing, and proliferation financing.
• To comply with reporting obligations to the CBN, NFIU, NDPC, and other competent authorities, including suspicious transaction reports (STRs) and currency transaction reports (CTRs).
• To respond to customer support requests and resolve disputes or chargebacks.
• To improve, secure, and personalise the NetPay application.

05Cross-Border Transfer of Personal Data

Given the nature of our cross-border payment service, your personal data may be transferred to, stored in, or accessed from countries outside Nigeria, including the destination country of your transfer, correspondent banks, partner payment institutions, and cloud infrastructure providers.

Where we transfer personal data outside Nigeria, we do so only where one of the following safeguards applies, in line with the cross-border data transfer requirements of the NDPA:

• The recipient country or organisation has been assessed by the NDPC as providing an adequate level of data protection; or
• Appropriate safeguards are in place, such as standard contractual clauses, binding corporate rules, or an equivalent contractual data protection agreement with the receiving institution; or
• The transfer is necessary for the performance of the payment contract between you and NetPay (for example, transmitting beneficiary details to the receiving bank to complete your transfer); or
• You have given explicit, informed consent to the specific transfer after being told of the possible risks.

We maintain a record of all cross-border data transfer mechanisms and conduct periodic transfer impact assessments for high-risk corridors.

06Sharing and Disclosure of Information

We disclose personal data only to the extent necessary for the purposes described in this Policy, including to:

• Correspondent banks, partner payment institutions, and mobile money operators in the destination country, to complete your transfer.
• Regulators and law enforcement, including the CBN, NDPC, NFIU, the Economic and Financial Crimes Commission (EFCC), and equivalent authorities abroad, where legally required.
• Identity verification, sanctions screening, and fraud-prevention service providers acting on our behalf.
• Card networks, payment schemes, and settlement banks.
• Professional advisers, auditors, and our licensed Data Protection Compliance Organisation (DPCO), where applicable.
• A successor entity in the event of a merger, acquisition, or restructuring of NetPay's business, subject to equivalent data protection safeguards.

We do not sell your personal data to third parties.

07Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, and thereafter as required by law. In particular, transaction records, KYC documentation, and CDD records are retained for a minimum of five (5) years from the date of the transaction or termination of the business relationship, in line with CBN AML/CFT/CPF Regulations and the Money Laundering (Prevention and Prohibition) Act, 2022. Where retention is no longer required, data is securely deleted or anonymised.

08Data Security

We implement technical and organisational measures proportionate to the sensitivity of the data we process, including encryption of data in transit and at rest, role-based access controls, multi-factor authentication, network monitoring, regular security testing, and staff training. Access to customer and transaction data is restricted to personnel who need it to perform their duties.

09Your Rights

Subject to applicable law, you have the following rights in relation to your personal data:

To exercise any of these rights, please contact our Data Protection Officer at dpo@netpayinstant.com. We may need to verify your identity before actioning a request.

10Automated Decision-Making

NetPay uses automated systems to screen transactions for fraud, sanctions exposure, and money-laundering risk. Where an automated decision produces a legal or similarly significant effect on you — such as declining or delaying a transaction — you may request human review of that decision by contacting compliance@netpayinstant.com.

11Cookies and Similar Technologies

Our website and application use cookies and similar technologies to maintain your session, remember preferences, and analyse usage. You can manage cookie preferences through your device or browser settings. Disabling certain cookies may limit your ability to use some features of the NetPay application.

12Children's Privacy

NetPay's services are not directed at, and may not be used by, individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a minor, we will take steps to delete it promptly.

13Data Breach Notification

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, NetPay will notify the NDPC without undue delay, and in any event within the timeframe prescribed by the NDPA, and will notify affected individuals where required, together with guidance on protective steps to take.

14Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal and regulatory requirements. We will notify you of material changes through the NetPay application or by email, and will indicate the date of the latest revision at the top of this Policy.

15Governing Law and Complaints

This Policy is governed by the laws of the Federal Republic of Nigeria, including the NDPA. If you are not satisfied with our response to a privacy concern, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at www.ndpc.gov.ng, or with the relevant data protection authority in your country of residence.

16Contact Us

If you have questions about this Privacy Policy or how NetPay handles your personal data, please contact: