Privacy Policy

Effective Date: January 1, 2024 | Last Updated: January 1, 2024

1. Introduction and Scope

ZPayNG Digital Services Limited ("ZPayNG," "we," "our," or "us") is a leading digital financial technology services provider operating in Nigeria and across Africa. As a technology-driven fintech company, we understand the critical importance of protecting your personal and financial information in accordance with the highest international standards.

This Privacy Policy applies to all users of our technology platform, including individual consumers, business customers, merchants, developers, and any other parties who interact with our platform through our website, mobile applications, APIs, or any other digital channels. By using our services, you acknowledge that you have read, understood, and agree to be bound by the terms of this Privacy Policy.

This policy is designed to comply with the Nigeria Data Protection Act (NDPA) 2023, applicable Central Bank of Nigeria (CBN) regulations for technology service providers, international data protection standards including the General Data Protection Regulation (GDPR), and other applicable privacy laws and regulations.

2. Information We Collect

As a comprehensive digital financial technology services provider, we collect various types of information to deliver secure, efficient, and personalized technology services to our users through our licensed financial institution partners. The information we collect falls into several categories:

2.1 Personal Identification Information

We collect personal identification information that is necessary for account creation, identity verification, and compliance with regulatory requirements:

• Basic Personal Information: Full legal name, date of birth, gender, nationality, and preferred language
• Contact Information: Email addresses, phone numbers, residential addresses, and business addresses
• Government-Issued Identification: National Identification Number (NIN), Bank Verification Number (BVN), Driver's License, International Passport, Voter's Card, and other official identification documents
• Biometric Information: Facial recognition data, fingerprints, and other biometric identifiers used for enhanced security and identity verification
• Employment and Income Information: Employment status, employer details, job title, income level, and source of funds documentation
• Next of Kin Information: Emergency contact details and beneficiary information for account security and inheritance purposes

2.2 Financial and Transaction Information

We collect comprehensive financial information to process transactions, assess risk, and provide personalized financial services:

• Bank Account Information: Bank account numbers, account names, bank codes, and account verification details
• Payment Card Information: Card numbers (tokenized), expiration dates, and card verification codes (processed through secure payment processors)
• Transaction History: Detailed records of all transactions including amounts, dates, times, merchant information, and transaction purposes
• Wallet and Balance Information: Digital wallet balances, transaction limits, and account status information
• Credit and Risk Information: Credit scores, risk assessments, and financial behavior patterns
• Investment and Asset Information: Investment portfolios, asset holdings, and financial goals

2.3 Technical and Usage Information

We automatically collect technical information about how you interact with our platform:

• Device Information: Device type, operating system, browser type, device identifiers, and hardware specifications
• Network Information: IP addresses, network provider information, and connection quality metrics
• Usage Analytics: Page views, feature usage, session duration, and user interaction patterns
• Location Information: GPS coordinates, IP-based location, and location history (with your consent)
• Security Information: Login attempts, security events, and fraud prevention data
• Performance Data: Application performance metrics, error logs, and system diagnostics

2.4 Communication and Support Information

We collect information from your communications with us:

• Customer Support Records: Support tickets, chat transcripts, email correspondence, and phone call recordings
• Feedback and Surveys: User feedback, survey responses, and product reviews
• Marketing Communications: Email engagement data, SMS delivery status, and marketing preferences
• Social Media Interactions: Public social media posts mentioning our services and social media engagement data

2.5 Third-Party Information

We may receive information about you from third-party sources:

• Credit Bureaus: Credit reports, credit scores, and financial history information
• Identity Verification Services: Identity verification results and fraud prevention data
• Licensed Financial Institution Partners: Account verification data and transaction processing information
• Business Partners: Referral information and joint service usage data
• Public Records: Publicly available information from government databases and official registries

3. How We Use Your Information

We use the information we collect for various legitimate business purposes that enable us to provide secure, efficient, and personalized financial services:

3.1 Service Provision and Account Management

• Creating and maintaining your account with appropriate security measures
• Processing financial transactions including payments, transfers, and withdrawals
• Providing customer support and resolving service-related issues
• Managing your digital wallet and account balances
• Facilitating bill payments and utility services
• Enabling money transfer and remittance services
• Processing merchant payments and business transactions

3.2 Identity Verification and Compliance

• Verifying your identity in accordance with Know Your Customer (KYC) requirements
• Conducting Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) procedures
• Screening against sanctions lists and politically exposed persons (PEP) databases
• Monitoring transactions for anti-money laundering (AML) and counter-terrorism financing (CTF) compliance
• Reporting suspicious activities to relevant authorities as required by law
• Maintaining records for regulatory compliance and audit purposes

3.3 Risk Management and Fraud Prevention

• Assessing and managing credit risk for lending and credit services
• Detecting and preventing fraudulent activities and unauthorized access
• Monitoring transaction patterns for unusual or suspicious behavior
• Implementing security measures to protect your account and information
• Conducting risk assessments for new products and services
• Managing operational and cybersecurity risks

3.4 Product Development and Improvement

• Analyzing usage patterns to improve our services and user experience
• Developing new financial products and services based on customer needs
• Conducting market research and customer satisfaction surveys
• Testing new features and functionalities
• Optimizing our platform performance and reliability
• Personalizing services and recommendations based on your preferences

3.5 Communication and Marketing

• Sending transactional notifications and account updates
• Providing customer support and service communications
• Delivering marketing communications about our products and services (with your consent)
• Sending security alerts and fraud prevention notifications
• Conducting customer education and financial literacy programs
• Sharing important policy updates and regulatory changes

4. Legal Basis for Processing

We process your personal information based on several legal grounds:

5. Information Sharing and Disclosure

We may share your information with various parties under specific circumstances and with appropriate safeguards:

5.1 Licensed Financial Institution Partners

We share information with our licensed financial institution partners who provide the underlying banking and payment processing services. This includes:

• Transaction processing and settlement through licensed institutions
• Account verification and validation via banking partners
• Regulatory compliance and reporting through licensed partners
• Risk management and fraud prevention via institutional partners

5.2 Regulatory Authorities and Government Agencies

We may disclose information to regulatory authorities and government agencies as required by law:

• Central Bank of Nigeria (CBN) for regulatory compliance
• Nigerian Financial Intelligence Unit (NFIU) for AML/CTF reporting
• Federal Inland Revenue Service (FIRS) for tax compliance
• Law enforcement agencies for criminal investigations
• Courts and legal authorities pursuant to court orders

5.3 Service Providers and Business Partners

We work with trusted service providers who assist us in delivering our services:

• Technology service providers for platform hosting and maintenance
• Identity verification services for KYC compliance
• Credit bureaus for credit assessment and risk management
• Customer support providers for service delivery
• Marketing and communication service providers
• Professional service providers including legal, audit, and consulting firms

5.4 Business Transactions

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to appropriate confidentiality and data protection measures.

5.5 Consent-Based Sharing

We may share your information with third parties when you provide explicit consent, such as:

• Sharing information with financial advisors or accountants you designate
• Providing information to family members or authorized representatives
• Sharing data with third-party applications you choose to connect

6. Data Security and Protection Measures

ZPayNG implements comprehensive security measures to protect your information from unauthorized access, use, disclosure, alteration, or destruction:

6.1 Technical Security Measures

• Encryption: End-to-end encryption for all data transmission and storage using industry-standard protocols (AES-256, TLS 1.3)
• Access Controls: Multi-factor authentication, role-based access controls, and principle of least privilege
• Network Security: Firewalls, intrusion detection systems, and network segmentation
• Data Tokenization: Sensitive data tokenization to minimize exposure of actual data
• Secure Development: Secure coding practices and regular security code reviews
• Vulnerability Management: Regular security assessments, penetration testing, and vulnerability patching

6.2 Operational Security Measures

• Employee Training: Comprehensive security awareness training for all employees
• Background Checks: Thorough background verification for all personnel with access to sensitive data
• Incident Response: 24/7 security monitoring and incident response procedures
• Data Classification: Systematic classification and handling of data based on sensitivity levels
• Physical Security: Secure data centers with biometric access controls and environmental monitoring

6.3 Compliance and Certifications

• ISO 27001 certification for information security management
• PCI DSS compliance for payment card industry security standards
• SOC 2 Type II compliance for service organization controls
• Regular third-party security audits and assessments
• Compliance with international cybersecurity frameworks

7. Your Privacy Rights and Choices

Under Nigerian data protection laws and international standards, you have several rights regarding your personal information:

7.1 Access Rights

• Right to access your personal data and obtain copies of information we hold about you
• Right to receive information about how your data is processed
• Right to obtain details about third parties with whom we share your information

7.2 Correction and Update Rights

• Right to correct inaccurate or incomplete personal information
• Right to update your contact information and preferences
• Right to complete incomplete personal data

7.3 Deletion and Erasure Rights

• Right to request deletion of your personal data (subject to legal and regulatory requirements)
• Right to erasure when data is no longer necessary for the original purpose
• Right to deletion when consent is withdrawn (where consent is the legal basis)

7.4 Processing Restriction Rights

• Right to restrict processing of your personal data in certain circumstances
• Right to object to processing based on legitimate interests
• Right to opt-out of direct marketing communications

7.5 Data Portability Rights

• Right to receive your personal data in a structured, commonly used format
• Right to transmit your data to another service provider
• Right to have your data transmitted directly to another controller where technically feasible

7.6 Consent Management

• Right to withdraw consent at any time (where consent is the legal basis)
• Right to manage your communication preferences
• Right to opt-out of non-essential data processing activities

8. Data Retention and Deletion

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected and to comply with legal and regulatory requirements:

8.1 Retention Periods

• Account Information: Retained for the duration of your account relationship plus 5 years after account closure
• Transaction Records: Retained for 5 years as required by CBN regulations
• Identity Verification Documents: Retained for 5 years after relationship termination
• Communication Records: Retained for 3 years for customer service purposes
• Marketing Data: Retained until consent is withdrawn or for 2 years of inactivity
• Legal and Compliance Records: Retained as required by applicable laws and regulations

8.2 Secure Deletion

When information is no longer needed, we securely delete or anonymize it using industry-standard data destruction methods to ensure it cannot be recovered or reconstructed.

9. International Data Transfers

Your personal information may be transferred to and processed in countries outside Nigeria for specific business purposes:

9.1 Transfer Purposes

• Cloud hosting and data storage services
• Technical support and system maintenance
• Fraud prevention and security monitoring
• Business continuity and disaster recovery

9.2 Transfer Safeguards

We ensure adequate protection for international transfers through:

• Standard contractual clauses approved by data protection authorities
• Adequacy decisions recognizing equivalent protection levels
• Binding corporate rules for intra-group transfers
• Certification schemes and codes of conduct

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience and improve our services:

10.1 Types of Cookies

• Essential Cookies: Necessary for basic website functionality and security
• Performance Cookies: Help us understand how visitors interact with our website
• Functional Cookies: Enable enhanced functionality and personalization
• Marketing Cookies: Used to deliver relevant advertisements and measure campaign effectiveness

10.2 Cookie Management

You can manage your cookie preferences through your browser settings or our cookie preference center. Note that disabling certain cookies may affect website functionality.

11. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If we discover that we have collected information from a child under 18, we will take immediate steps to delete such information and terminate the account.

Parents or guardians who believe their child has provided personal information to us should contact us immediately using the contact information provided in this policy.

12. Privacy Policy Updates

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or business operations. We will notify you of significant changes through:

• Email notifications to your registered email address
• In-app notifications when you next access our services
• Prominent notices on our website
• SMS notifications for material changes affecting your rights

The updated policy will be effective from the date specified in the notice. Your continued use of our services after the effective date constitutes acceptance of the updated policy.

13. Contact Information and Data Protection Officer

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or need to report a privacy concern, please contact us:

13.1 General Privacy Inquiries

• Email: privacy@zpayng.com
• Phone: +2349067587444
• Address: ZPayNG Digital Services Limited, Benin City, Edo State, Nigeria

13.2 Data Protection Officer

• Email: dpo@zpayng.com
• Role: Responsible for overseeing data protection compliance and handling privacy-related inquiries

13.3 Regulatory Complaints

If you are not satisfied with our response to your privacy concerns, you have the right to lodge a complaint with the Nigerian Data Protection Commission (NDPC) or other relevant supervisory authorities.

14. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of the Federal Republic of Nigeria. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of Nigerian courts, while respecting your rights under applicable international data protection laws.