PRIVACY POLICY

PYPAY TECHNOLOGIES LIMITED

Last Updated: September 2, 2026

Effective Date: September 2, 2026

1. INTRODUCTION

PyPay Technologies Limited ("PyPay," "we," "us," "our") is committed to protecting the privacy and personal data of its users ("you," "your"). This Privacy Policy explains how we collect, use, disclose, store, and protect your personal data when you use our mobile application, website, APIs, and related services (the "Services"), in compliance with the Nigeria Data Protection Act 2023, the Nigeria Data Protection Regulation, CBN guidelines on data governance and consumer protection, and other applicable data protection laws.

By using the Services, you consent to the data practices described in this Policy. If you do not agree, you should not use the Services.

2. DATA CONTROLLER

PyPay Technologies Limited is the Data Controller responsible for your personal data. Our contact details are:

- Registered Address: No 3 RA Adeleye, Utako

- Data Protection Officer (DPO): TBD

- Email: Support@pypay.ng

- NDPC Registration Number: TBD

3. PERSONAL DATA WE COLLECT

We collect the following categories of personal data:

3.1 Identity and KYC Data

Full name, date of birth, gender, nationality, Bank Verification Number (BVN), National Identification Number (NIN), passport/driver's license/voter's card details, photograph, and signature.

3.2 Contact Data

Phone number, email address, residential and business address.

3.3 Financial Data

Account numbers, wallet balances, transaction history, card details (tokenized/masked where possible), income information (where relevant for tiered KYC or credit assessment), and linked bank account details.

3.4 Biometric Data

Fingerprint, facial recognition data, or voice data, where used for authentication (collected only with your explicit consent, in compliance with NDPA requirements for sensitive personal data).

3.5 Technical and Usage Data

Device identifiers (IMEI, device model), IP address, geolocation data, browser type, operating system, app usage logs, login timestamps, and crash/diagnostic data.

3.6 Communications Data

Records of customer support interactions, complaints, call recordings (where applicable and disclosed), and correspondence.

3.7 Data from Third Parties

Information from credit bureaus, identity verification providers, banking partners, mobile network operators, and fraud prevention databases, subject to applicable data sharing agreements.

4. LAWFUL BASIS FOR PROCESSING

We process your personal data on the following lawful bases under the NDPA:

(a) Consent — where you have given clear, specific consent (e.g., biometric authentication, marketing communications);

(b) Contractual necessity — to perform our obligations under the Terms and Conditions and provide the Services;

(d) Legitimate interest — for fraud prevention, service improvement, and risk management, balanced against your rights and freedoms;

(e) Vital interest — in rare cases involving protection of life or safety.

5. HOW WE USE YOUR PERSONAL DATA

We use your personal data to:

1. Create and manage your account and verify your identity (KYC/KYB);

2. Process transactions and provide the Services;

3. Detect, investigate, and prevent fraud, money laundering, and other financial crimes;

4. Comply with regulatory, legal, and reporting obligations (CBN, NFIU, FIRS, NDPC, etc.);

5. Communicate with you regarding your account, transactions, and customer support;

6. Improve, personalize, and develop new features of the Services;

7. Conduct credit risk assessments (where applicable, e.g., for lending products);

8. Send you marketing communications, where you have opted in (you may opt out at any time);

9. Enforce our Terms and Conditions and protect our legal rights.

6. DISCLOSURE OF PERSONAL DATA

We may share your personal data with:

- Regulatory and Government Authorities: CBN, NFIU, Nigeria Data Protection Commission (NDPC), Federal Inland Revenue Service (FIRS), law enforcement agencies, and courts, where legally required.

- Banking and Payment Partners: Settlement banks, card networks (Visa, Mastercard, Verve), switching companies (e.g., NIBSS), and payment processors necessary to complete transactions.

- Service Providers: Cloud hosting providers, identity verification vendors, SMS/email delivery providers, customer support tools, and fraud detection vendors, under strict data processing agreements requiring equivalent data protection standards.

- Credit Bureaus: Where applicable to lending or credit-related products, subject to your consent and applicable credit reporting laws.

- Professional Advisors: Auditors, legal counsel, and consultants, under confidentiality obligations.

- Business Transfers: In connection with a merger, acquisition, or asset sale, subject to equivalent privacy protections for your data.

We do not sell your personal data to third parties for their independent marketing purposes.

6.1 Cross-Border Data Transfers

Where personal data is transferred outside Nigeria (e.g., to cloud service providers), we ensure such transfers comply with NDPA requirements, including verification that the receiving country provides an adequate level of data protection, or through appropriate safeguards such as standard contractual clauses, and where required, approval from the NDPC.

7. DATA RETENTION

We retain your personal data for as long as necessary to:

(a) provide the Services and maintain your account;

(b) comply with statutory retention obligations (CBN generally requires transaction records to be retained for a minimum of 5 years after the termination of a business relationship, or longer if required by law or ongoing investigation);

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized, except where continued retention is required by law.

8. DATA SECURITY

We implement appropriate technical and organizational measures to protect your personal data, including:

- Encryption of data in transit and at rest;

- Multi-factor authentication and access controls;

- Regular security audits, vulnerability assessments, and penetration testing;

- PCI-DSS compliance for card data handling (where applicable);

- Employee data protection training and confidentiality obligations;

- Incident response and data breach management procedures.

In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of the breach, and notify affected users without undue delay, in accordance with NDPA requirements.

9. YOUR RIGHTS

Subject to applicable law, you have the right to:

1. Access — request a copy of the personal data we hold about you;

2. Rectification — request correction of inaccurate or incomplete data;

3. Erasure — request deletion of your data, subject to our legal retention obligations;

4. Restriction — request that we limit processing of your data in certain circumstances;

5. Data Portability — request your data in a structured, machine-readable format;

6. Object — object to processing based on legitimate interest or for direct marketing purposes;

7. Withdraw Consent — withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing;

8. Lodge a Complaint — file a complaint with the Nigeria Data Protection Commission (NDPC) or other competent supervisory authority.

To exercise these rights, contact our Data Protection Officer at Support@pypay.ng. We will respond within the timeframe prescribed by the NDPA (generally within one month, extendable in complex cases).

10. COOKIES AND TRACKING TECHNOLOGIES

Our website and app may use cookies, SDKs, and similar tracking technologies to enhance user experience, analyze usage patterns, and support security functions. You can manage cookie preferences through your browser or device settings. Essential cookies required for core functionality (e.g., session authentication) cannot be disabled.

11. CHILDREN'S PRIVACY

The Services are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a minor without appropriate consent, we will take steps to delete such data promptly.

12. MARKETING COMMUNICATIONS

Where you have opted in, we may send you promotional messages regarding new features, offers, and services via SMS, email, or push notification. You may opt out at any time via the app settings or by clicking "unsubscribe" in marketing emails.

13. THIRD-PARTY LINKS

The Services may contain links to third-party websites or services. We are not responsible for the privacy practices of such third parties, and we encourage you to review their privacy policies independently.

14. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. Material changes will be communicated via the app, email, or SMS at least 14 days before taking effect. The "Last Updated" date at the top of this Policy indicates when it was last revised.

15. CONTACT US

For questions, concerns, or requests regarding this Privacy Policy or your personal data, contact:

Data Protection Officer

PyPay Technologies Limited

No 3 RA Adeleye, Utako

Support@pypay.ng

+234 913 147 0291

You may also contact the Nigeria Data Protection Commission (NDPC) at [www.ndpc.gov.ng] to lodge a complaint.