Privacy Policy

01Who We Are

For the purposes of this Privacy Policy:

NetPay, we, us, or our refers to NetPay Instant, the entity responsible for the relevant NetPay services.

Registered address: 8 Osisiogwu Street, Utako, Abuja
Registration number: 9581624
Privacy contact: dpo@netpayinstant.com

Depending on the service you use, NetPay may act as a data controller, joint controller, or processor in relation to certain personal data.

Where a regulated payment partner or other third party independently determines how and why certain personal data is processed, that provider may have its own privacy notice and obligations in relation to that processing.

02Personal Data We Collect

The information we collect depends on how you use NetPay.

Identity and verification information

This may include:

• Full legal name;
• Date of birth;
• Nationality;
• Government-issued identification information;
• Passport or identity document details;
• Photograph or selfie where required for identity verification;
• Signature where applicable;
• Verification information provided through approved identity-verification providers;
• BVN, NIN, or other identifiers where required and legally permitted.

Contact information

This may include:

• Email address;
• Telephone number;
• Residential or mailing address; and
• Other contact information you provide.

Financial and transaction information

Depending on the service, this may include:

• Bank account details;
• Payment card information or payment tokens;
• Wallet or account information where applicable;
• Transaction amounts;
• Currencies;
• Exchange rates;
• Sender and recipient information;
• Beneficiary details;
• Payment and payout information;
• Source-of-funds information; and
• Transaction history.

Where payment information is processed directly by a third-party payment provider, that provider may collect and process certain payment information under its own privacy notice.

Technical and device information

When you use our website or application, we may collect information such as:

• IP address;
• Device type and operating system;
• Browser type;
• Device identifiers;
• Application version;
• Log information;
• Approximate location derived from technical information; and
• Information about how you interact with our Services.

We will only collect precise location information where there is a legitimate reason to do so and where permitted by applicable law.

Usage and support information

This may include:

• Application activity;
• Account activity;
• Customer support communications;
• Complaints and enquiries;
• Feedback;
• Transaction-related correspondence; and
• Information you provide when communicating with us.

Compliance and risk information

To comply with applicable legal, regulatory, fraud-prevention, and risk-management requirements, we may process information such as:

• Customer Due Diligence information;
• Enhanced Due Diligence information;
• Sanctions-screening results;
• Politically Exposed Person (PEP) screening information;
• Fraud indicators;
• Risk assessments;
• Source-of-funds or source-of-wealth information where required; and
• Information relating to suspected financial crime or prohibited activity.

03How We Collect Personal Data

We may collect personal data:

• Directly from you when you create an account or use our Services;
• When you initiate or receive a transaction;
• When you contact our support team;
• Automatically when you use our website or application;
• From payment providers and financial institutions involved in a transaction;
• From identity verification and fraud-prevention providers;
• From sanctions, watchlist, and other publicly available databases;
• From our regulated payment and financial partners; and
• From other third parties where permitted by law.

04Why We Use Your Personal Data

We use personal data where necessary to provide, secure, improve, and administer our Services.

Providing our Services

• Creating and managing your account;
• Processing payment instructions;
• Facilitating cross-border transactions;
• Providing transaction updates;
• Providing customer support; and
• Maintaining transaction records.

Identity and compliance

• Verifying your identity;
• Conducting Customer Due Diligence and Enhanced Due Diligence;
• Meeting legal and regulatory requirements;
• Screening against applicable sanctions and watchlists;
• Detecting and preventing fraud;
• Assessing transaction and customer risk;
• Preventing money laundering, terrorist financing, and proliferation financing; and
• Supporting legally required reporting and investigations.

Security and fraud prevention

• Protecting accounts and systems;
• Detecting suspicious activity;
• Investigating fraudulent or unauthorised transactions;
• Preventing abuse of the Services; and
• Maintaining the security and integrity of our technology.

Business operations

• Improving our Services;
• Analysing usage and performance;
• Troubleshooting technical issues;
• Managing complaints and disputes;
• Maintaining business records; and
• Protecting our legal rights.

Communications and marketing

We may use your contact information to send service-related communications, including transaction updates, security alerts, verification requests, and important account notices.

Where required, we will obtain appropriate consent before sending marketing communications. You can opt out of marketing communications at any time.

05Legal Bases for Processing

Where the NDPA or another applicable data-protection law requires us to identify a lawful basis for processing, we may rely on one or more of the following:

Performance of a contract

Where processing is necessary to provide the Services you have requested, such as creating your account or processing a payment instruction.

Legal obligation

Where processing is necessary to comply with applicable legal or regulatory obligations, including identity verification, financial crime prevention, sanctions requirements, recordkeeping, or legally required reporting.

Legitimate interests

Where processing is necessary for legitimate business purposes, such as fraud prevention, information security, service improvement, and protecting our business, provided those interests do not override applicable data-protection rights.

Consent

Where consent is required by applicable law, including for certain marketing or optional processing activities.

Where we rely on consent, you may withdraw it at any time. Withdrawal of consent does not affect processing that was already carried out lawfully before withdrawal.

06Sharing Personal Data

We may share personal data where necessary to provide the Services, comply with legal obligations, manage risk, or operate our business.

Recipients may include:

Payment and financial partners

Licensed payment service providers, banks, financial institutions, payout providers, mobile money operators, card networks, settlement providers, and other financial partners involved in processing or completing a transaction.

Identity and compliance providers

Identity verification, sanctions-screening, fraud-prevention, transaction-monitoring, and other compliance service providers.

Technology and infrastructure providers

Cloud hosting providers, software providers, security providers, communication platforms, analytics providers, and other technology vendors supporting our Services.

Regulators and public authorities

Competent regulators, law enforcement agencies, financial intelligence units, courts, tax authorities, and other public authorities where disclosure is required or permitted by law.

This may include authorities in Nigeria or other jurisdictions relevant to a transaction or our legal obligations.

Professional advisers

Lawyers, auditors, accountants, consultants, insurers, and other professional advisers where reasonably necessary.

Corporate transactions

Information may be disclosed as part of a merger, acquisition, financing, restructuring, sale of assets, or similar corporate transaction, subject to appropriate confidentiality and data-protection safeguards.

We do not sell your personal data.

07Cross-Border Data Transfers

Because NetPay facilitates cross-border transactions, personal data may be processed or accessed outside Nigeria.

For example, information may need to be shared with:

• A payment provider in the destination country;
• A bank or financial institution;
• A payout provider;
• An identity verification provider;
• A cloud or technology provider; or
• Another service provider involved in completing or securing a transaction.

Where personal data is transferred outside Nigeria, we will use an appropriate lawful transfer mechanism and applicable safeguards as required by the NDPA and other relevant data-protection laws.

Depending on the circumstances, this may include:

• A recognised adequacy mechanism;
• Appropriate contractual safeguards;
• Another lawful transfer mechanism permitted by applicable law; or
• A transfer necessary for the performance of a transaction or service, where legally permitted.

We assess cross-border processing risks where required and take reasonable steps to ensure that personal data receives appropriate protection when processed outside Nigeria.

08Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to:

• Provide our Services;
• Maintain business and transaction records;
• Comply with legal and regulatory obligations;
• Prevent and investigate fraud and financial crime;
• Resolve disputes and complaints;
• Enforce agreements; and
• Protect our legal rights.

Certain information may need to be retained for a specified period under applicable financial, AML/CFT, tax, accounting, or other legal requirements.

Where our regulated partners have independent recordkeeping obligations, they may retain relevant information in accordance with their own legal and regulatory requirements.

When personal data is no longer required, we will take reasonable steps to securely delete, anonymise, or otherwise dispose of it in accordance with applicable law and our retention procedures.

09Data Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure, destruction, or misuse.

Depending on the nature of the information and the risks involved, these measures may include:

• Encryption;
• Access controls;
• Authentication and identity management;
• Role-based access;
• Security monitoring;
• Network and application security;
• Secure development practices;
• Staff confidentiality and security training;
• Incident-response procedures; and
• Regular security assessments and testing.

No electronic transmission or storage system can be guaranteed to be completely secure. We therefore continually review and improve our security measures.

10Your Privacy Rights

Subject to applicable law and any lawful restrictions, you may have rights including the right to:

• Be informed about how your personal data is processed;
• Request access to personal data we hold about you;
• Request correction of inaccurate or incomplete information;
• Request deletion of personal data in appropriate circumstances;
• Request restriction of processing in applicable circumstances;
• Object to certain types of processing;
• Request portability of personal data where applicable;
• Withdraw consent where processing is based on consent; and
• Seek review of certain decisions based solely on automated processing where applicable.

Some rights may be restricted where we are required to retain or process information to comply with a legal, regulatory, fraud-prevention, financial-crime, or other lawful obligation.

To exercise your rights, contact: dpo@netpayinstant.com

We may need to verify your identity before responding to a request.

11Automated Processing and Decision-Making

NetPay and/or our service providers may use automated tools to help:

• Detect fraud;
• Identify suspicious transactions;
• Screen sanctions and watchlists;
• Assess transaction risk;
• Verify identity; and
• Protect the security of our Services.

In some circumstances, automated processing may contribute to decisions such as delaying, restricting, or declining a transaction.

Where applicable law provides you with a right to human intervention or review in relation to a decision based solely on automated processing that produces legal or similarly significant effects, you may request such review by contacting compliance@netpayinstant.com.

Certain compliance and fraud-prevention decisions may be subject to legal restrictions on disclosure where revealing the underlying information could undermine financial-crime prevention or regulatory obligations.

12Cookies and Similar Technologies

Our website and application may use cookies, software development kits, local storage, pixels, and similar technologies.

These technologies may be used to:

• Keep you signed in;
• Maintain security;
• Remember preferences;
• Understand how our Services are used;
• Improve application performance; and
• Analyse website and application activity.

Where required, we will provide appropriate cookie controls or consent mechanisms.

You can also manage cookies through your browser or device settings. Disabling certain technologies may affect the availability or functionality of some Services.

13Children's Privacy

NetPay's Services are intended for individuals who are legally permitted to use financial services in their jurisdiction and are not directed at children.

Where our Services are restricted to individuals aged 18 or older, we do not knowingly permit individuals under that age to create accounts.

If we become aware that we have collected personal data from an individual who is not permitted to use the Services, we will take appropriate steps to address the situation in accordance with applicable law.

14Personal Data Breaches

We maintain procedures for identifying, assessing, containing, investigating, and responding to personal-data breaches.

Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority within the timeframe required by applicable law.

Where a breach presents a high risk to affected individuals and notification is legally required, we will also notify affected individuals and provide appropriate information about the breach and recommended protective measures.

Under the applicable Nigerian framework, certain qualifying breaches must be reported to the NDPC within 72 hours of becoming aware of the breach.

15Third-Party Services

NetPay relies on third-party providers to support certain aspects of the Services. These may include:

• Payment processors;
• Banks and financial institutions;
• Identity verification providers;
• Fraud and sanctions-screening providers;
• Cloud and infrastructure providers;
• Communication providers;
• Analytics providers; and
• Payout and settlement providers.

Third-party providers may process personal data in accordance with their own privacy notices and legal obligations.

Where appropriate, NetPay enters into contractual arrangements designed to require service providers to protect personal data and process it only for authorised purposes.

16Data Protection Officer / Privacy Contact

For privacy questions, data-subject requests, or concerns regarding the processing of your personal data, contact:

Data Protection Officer / Privacy Team
Email: dpo@netpayinstant.com

We may request additional information to verify your identity before processing certain requests.

17Complaints

If you have concerns about how NetPay processes your personal data, we encourage you to contact us first so that we can investigate and attempt to resolve the matter.

You may contact: dpo@netpayinstant.com

If you remain dissatisfied after completing our internal complaints process, you may have the right to lodge a complaint with the Nigeria Data Protection Commission or another competent data-protection authority, depending on the circumstances and applicable law.

18Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in:

• Our Services;
• Our data-processing practices;
• Technology;
• Service providers;
• Legal or regulatory requirements; or
• Other relevant circumstances.

Where changes are material, we will provide appropriate notice through the application, website, email, or another suitable communication channel.

The latest version will always be identified by the "Last updated" date at the beginning of this Policy.

19Governing Law

This Privacy Policy is governed by the applicable data-protection laws of the jurisdictions in which NetPay processes personal data.

To the extent Nigerian law applies, this includes the Nigeria Data Protection Act, 2023 and applicable regulations, directives, and guidance issued by the Nigeria Data Protection Commission.

Nothing in this Privacy Policy limits any mandatory rights or protections available to you under applicable data-protection law.

20Contact Us

If you have questions about this Privacy Policy or how your personal data is handled, please contact us using the details below.

Legal entity: NetPay Instant Limited
Registration number: 9581624
Registered address: 8 Osisiogwu Street, Utako, Abuja

General enquiries: support@netpayinstant.com
Compliance: compliance@netpayinstant.com
Privacy / DPO: dpo@netpayinstant.com