Privacy Policy

Datafy Technologies Limited | Last updated: 24 September 2026

This Privacy Policy explains how Datafy Technologies Limited ("Datafy", "we", "us" or "our") collects, uses, shares, stores and protects personal data when you use the Datafy Pay website, Android application and related financial technology services (collectively, the "Services"). It also explains the choices and rights available to you.

1. Services covered

This policy applies when you use Datafy Pay to:

• create and manage an account or wallet;
• fund a wallet or transfer money to a bank account or another user;
• buy airtime or data and pay electricity, cable television or education bills;
• save beneficiaries and bill-payment details for repeat transactions;
• participate in supported Ajo/Esusu savings features;
• use supported virtual-card or digital-asset services; or
• contact support, receive receipts, or manage account security.

2. Personal data we collect

3. How and why we use personal data

We process personal data only where we have a lawful reason, including performance of our contract with you, compliance with legal obligations, your consent, and our legitimate interests in operating and protecting the Services.

4. When we share personal data

We do not sell personal data. We disclose only what is reasonably necessary to operate the Services, comply with law or protect users. Recipients may include:

• Payment and banking partners, including Flutterwave and Paystack, for wallet funding, transfers, account-name resolution, identity checks and supported financial products;
• Bill-payment providers, including VTpass, to validate and fulfil airtime, data, electricity, cable television and education purchases;
• Communication providers, including Brevo and KudiSMS, for email, OTPs, receipts, SMS and service alerts;
• Technology and hosting providers that store data, monitor availability or help secure the Services;
• Professional advisers, auditors and insurers where necessary for lawful business operations;
• Regulators, courts and law-enforcement bodies when disclosure is required or permitted by applicable law; and
• A successor organisation in connection with a lawful merger, acquisition or transfer, subject to appropriate safeguards.

5. International data transfers

Some service providers may process information outside Nigeria. Where personal data is transferred internationally, we take reasonable steps to use a lawful transfer mechanism and require appropriate confidentiality and security safeguards.

6. Data retention

We retain personal data only for as long as needed for the purposes described in this policy. Because Datafy provides financial services, transaction, KYC, fraud-prevention, dispute, tax and audit records may be retained after account closure for the period required by applicable law, a regulator, an investigation or the resolution of a legal claim. Nigerian financial recordkeeping rules may require certain transaction and identification records to be kept for at least five years. Data that is no longer required is deleted, anonymized or securely isolated.

7. Security

We use administrative, technical and organisational safeguards designed to protect personal data. These include HTTPS encryption in transit, access restrictions, hashed credentials, transaction authentication, monitoring and controlled access to production systems. No system is completely secure, so you should keep your password, transaction PIN and OTPs confidential.

8. Your privacy rights

Subject to applicable law, you may have the right to:

• receive information about our processing and obtain a copy of your personal data;
• correct incomplete or inaccurate personal data;
• request deletion or restriction of personal data;
• object to certain processing;
• withdraw consent where processing depends on consent;
• request data portability where applicable;
• request human review of a significant automated decision where applicable; and
• complain to the Nigeria Data Protection Commission.

We may need to verify your identity before acting on a privacy request. Some rights are limited where retaining or processing information is required by financial, anti-fraud, tax, legal or regulatory obligations.

9. Account deactivation and deletion

You may temporarily deactivate your account or start an account-deletion request from Settings > Account management in Datafy Pay. Before deletion can begin, you must withdraw available balances and resolve pending transactions and active Ajo/Esusu obligations. Account access is disabled when a valid deletion request is accepted. We then delete or anonymize information that is no longer required while retaining only records we are legally permitted or required to keep.

If you cannot sign in, follow the instructions on our account deletion page.

10. Cookies and similar technologies

Datafy Pay may use essential browser storage and similar technologies to maintain sessions, remember necessary preferences, prevent fraud and keep the Service reliable. Where non-essential analytics or marketing technologies are introduced, we will provide any consent controls required by law.

11. Children's privacy

Datafy Pay is intended only for people aged 18 or older. We do not knowingly provide accounts to or collect personal data from children.

12. Changes to this policy

We may update this policy when our Services, providers or legal obligations change. We will publish the revised policy here, update the date above and provide additional notice where a change materially affects your rights.

13. Contact and complaints

If you are dissatisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission.