1. Who we are
This policy explains how [Credipay's registered company name] (“CrediPay”, “we”) handles personal data when you use CrediPay. It applies to our merchants, their users, and people who visit our sign-up and sign-in pages. It should be read with our Terms of Service.
We play two roles. For the data about our merchants and their users (their accounts, sign-in, business details and how they use CrediPay) we decide why and how it is used, so we are the controller. For the data a merchant puts into CrediPay about its own customers (for example customer lists, orders, loyalty and wallet balances) the merchant decides what is collected and why, and we handle it on the merchant's behalf as a processor. If you are a merchant's customer and have a question about your data, please ask that merchant first.
2. What we collect
| Information | Examples | From |
|---|---|---|
| Account and business details | Names, email addresses, phone numbers, role, business name and registration details, branch and paypoint details, documents needed to verify a business | You and your users |
| Sign-in and security | Password and transaction PIN (we do not keep them in plain text), one-time codes, sign-in and consent records including IP address and browser | You, our systems |
| Money and transaction data | Amounts, references, dates, status, the account name and number of the sender or beneficiary, bank, narration, charges, wallet and branch balances, payout and transfer records | You, your customers' payments, Providers and banks |
| Subscription and billing | Plan, billing cycle, charges, unpaid balances and which source a charge was taken from | Our systems |
| Your customers' data (as processor) | Customer names, contact details, addresses, orders and purchases, loyalty and wallet balances, delivery details | You, and your customers' orders |
| Operational data | Orders, products, stock, receipts, reports, activity logs and error logs | You, our systems |
| Messages | Emails, push notifications and messages we send you, and your messages to our support team | You, our systems |
3. How we use it
- to create and secure your account, verify your business and sign you in;
- to issue account numbers, record and settle payments, run payouts and transfers, and show your balances and statements;
- to charge your subscription and fees, including collecting from your wallets and branch balances as set out in the Terms, and to show your billing history;
- to run the till, orders, stock, customers, loyalty, reports and integrations you ask for;
- to send you service messages (receipts, credit alerts, one-time codes, billing and security notices);
- to prevent fraud, money laundering and misuse, and to meet legal, tax and regulatory duties;
- to support you, fix problems and improve and secure the service.
We do not sell personal data, and we do not use it for advertising by third parties.
4. Why we may use it
Under the Nigeria Data Protection Act 2023 and other laws that apply to us, we rely on: contract (to give you the service you signed up for); legal obligation (for example anti-money-laundering checks and record keeping); legitimate interests (for example keeping the service secure and preventing fraud, where this does not override your rights); and consent (where we ask for it, which you can withdraw).
5. Who we share it with
- Payment Providers, banks and card and payment networks, to create account numbers, receive and send money, check beneficiary names and settle transactions.
- Your Partner, if you joined through one: limited account, subscription and billing information as needed to run the partnership.
- Service providers that host our systems and send email, SMS and push notifications for us, under contracts that protect your data.
- Regulators, courts, tax and law-enforcement authorities, where the law requires or allows it.
- Professional advisers and, in a sale or restructuring of our business, the other party, under confidentiality.
6. Where it goes
Our systems and some of our service providers may be located outside Nigeria. When data is sent abroad, we use safeguards that the law allows, such as contracts that require equivalent protection [confirm hosting regions and transfer safeguards].
7. How long we keep it
We keep personal data while your account is active and afterwards for as long as needed for the purposes above, including the periods the law requires us to keep financial and transaction records [confirm retention periods with counsel]. When we no longer need it, we delete it or make it anonymous.
8. Keeping it safe
We protect data with measures such as encrypted connections, restricted access by role, storing credentials in protected form, one-time codes and a transaction PIN for moving money, activity logging, and monitoring. No system is perfectly secure. If a breach affects your personal data, we will tell you and the regulator as the law requires. You can help by keeping your password and PIN private and by signing out of shared devices.
9. Your rights
You may ask us to: give you a copy of your personal data; correct it; delete it; restrict or object to some uses; give it to you in a portable format; and withdraw consent you gave. Some requests are limited where we must keep records by law. You may also complain to the Nigeria Data Protection Commission. To use a right, contact us (section 13); we may need to confirm who you are first. For data a merchant holds about its customers, we will pass the request on to that merchant.
10. Cookies and browser storage
CrediPay uses a session cookie to keep you signed in and a few cookies and browser storage entries to make the service work. For example, tickets you have open at the till are saved in your browser's local storage on that device. We do not use advertising cookies [confirm analytics tools in use]. You can clear this storage in your browser, which signs you out and removes unsent tickets.
11. Children
CrediPay is for businesses and adults. We do not knowingly collect personal data from anyone under 18 for our own purposes.
12. Changes
We may update this policy. We will tell you in the app or by email before an important change takes effect, and the version published at this address is the one in force.
13. Contact us
Data protection contact: [name or Data Protection Officer] · [privacy email] · [registered address]