Privacy notice

1. Who is responsible for your data

Sample Company Ltd (sample) Ltd, RC RC 0000000 (sample), 1 Sample Street, Lagos (sample), is the data controller for personal data processed through KudiVend, including for customers who buy on a KudiVend-powered white-label storefront. This notice is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the guidance of the Nigeria Data Protection Commission (NDPC).

Our Data Protection Officer can be reached at [email protected].

2. What we collect

• Account details: phone number, email address, your name, and your 4-digit PIN (stored only as a one-way hash).
• Identity checks (tier 1): BVN or NIN and date of birth. We send these to our KYC provider and keep the result (name, date of birth, match outcome). We store the BVN or NIN itself only as a one-way hash plus its last 4 digits.
• Identity checks (tier 2): an ID document photo, a selfie for face matching, and proof of address.
• Device data: browser and device type, IP address, approximate location from the IP address, and sign-in times, used to recognise your devices and detect fraud.
• Transaction data: wallet funding (sender name, bank, amount), orders (recipient numbers, meter and smartcard numbers, products), refunds, tickets and messages you send us.
• Business details for resellers, tenants and API clients: CAC certificate, director BVN, TIN, bank account and contact person.

3. Why we use it and our lawful basis

4. Consent for identity lookups

Before we look up your BVN or NIN, or match your selfie, we ask you to agree on screen. We record when you agreed. You can withdraw consent at any time, but we will then lower your account to tier 0, which means you cannot fund your wallet. Withdrawing consent does not affect checks already carried out or records the law requires us to keep.

5. Who we share it with

We share data only with processors that help us run KudiVend, under written contracts that require them to protect it:

• Identity verification provider: [KYC PROVIDER]
• SMS delivery: [SMS PROVIDER]; email delivery: [EMAIL PROVIDER]
• Payment service providers and banks that issue virtual accounts and pay refunds: Monnify (sample)
• VTU and bill providers, only the recipient number, meter or smartcard number needed to deliver your order
• Hosting and infrastructure: [HOSTING PROVIDER]
• White-label tenants see the name, phone, orders and tickets of their own storefront customers so they can support them. They do not see BVN, NIN or ID documents.

We may disclose data to law enforcement, regulators or courts where the law requires it. We do not sell personal data.

6. Transfers outside Nigeria

Some processors, such as our email and hosting providers, may store data outside Nigeria. We transfer data only where the NDPA allows it, for example to a country with adequate protection or under contractual safeguards approved by the NDPC, and we keep a record of each transfer.

7. How long we keep it

• Transaction records and KYC records: 5 years after your account is closed, as anti-money-laundering rules require.
• Guest checkout (buying without an account): the payer's name and bank account (from the transfer), the phone or email you give for the receipt, your IP address and device id. We keep these 5 years from the checkout date, use them to deliver the order, prevent fraud and send any refund back to the account that paid.
• OTP and sign-in logs: [PERIOD].
• Marketing preferences: until you change them or close your account.
• Selfies used only for face matching: [PERIOD] after verification, unless needed for a fraud investigation.

After these periods we delete or anonymise the data.

8. Your rights

Under the NDPA you have the right to:

• be told how your data is used (this notice) and get a copy of it;
• correct inaccurate data;
• ask us to delete data, unless we must keep it by law;
• restrict or object to processing based on legitimate interests;
• withdraw consent;
• receive your data in a portable format;
• not be subject to a decision based only on automated processing that significantly affects you. If an automatic check holds your funding or declines your KYC, you can ask a person to review it.

To use a right, email [email protected] from your verified email, or open a ticket in the app. We will confirm your identity and reply within 30 days. If you are unhappy with our answer you can complain to the Nigeria Data Protection Commission.

9. Security and breaches

We encrypt data in transit and at rest, hash PINs and identity numbers, restrict staff access by role and log every admin action. If a breach is likely to put your rights at risk, we will notify the NDPC within 72 hours of becoming aware of it and tell you without undue delay, with what happened and what you should do.

10. Changes and contact

We will post updates here and tell you in the app before material changes. Questions: [email protected], or Sample Company Ltd (sample) Ltd, 1 Sample Street, Lagos (sample).