Privacy Policy

1. Information We Collect

1.1 Account and Identity Information

When you register for a Payve account, we collect information to verify your identity and comply with applicable know-your-customer (KYC) and know-your-business (KYB) regulations. This includes:

• Full legal name, date of birth, and nationality (for individual account holders)
• Business name, registration number, registered address, and business type (for business accounts)
• Government-issued identification documents (National ID, passport, driver's licence)
• Proof of address (utility bills, bank statements)
• Beneficial ownership information for corporate entities
• Business activity descriptions and expected transaction volumes
• Email address, phone number, and login credentials

1.2 Transaction and Financial Data

In the course of providing payment services, we collect and process:

• Payment transaction details: amounts, currencies, timestamps, reference numbers
• Sender and beneficiary information (name, bank account, mobile money number)
• FX conversion rates, fees charged, and net amounts disbursed
• Wallet balances and transaction history
• Payout and collection records
• API request logs associated with financial operations

1.3 Technical and Usage Data

When you access the Payve platform or use our API, we automatically collect:

• IP address and approximate geographic location
• Device identifiers, operating system, and browser type
• API key identifiers (never the key secret itself)
• Request and response logs (excluding sensitive financial data beyond metadata)
• Error logs and performance data
• Pages visited, features used, and session duration
• Referral URLs and marketing attribution data

1.4 Communications Data

We retain records of communications you have with our support, compliance, and sales teams, including emails, chat transcripts, and call recordings (where permitted and disclosed).

2. How We Use Your Information

We use the information we collect for the following purposes:

3. Information Sharing

We do not sell your personal data. We share information only in the following limited circumstances:

• Banking and payment partners

  We share transaction data with licensed banks, mobile money operators, and payment processors that are necessary to execute payments on your behalf. These parties are bound by confidentiality agreements and regulatory obligations.

• Regulators and law enforcement

  We may disclose information to the Central Bank of Nigeria, Financial Intelligence Unit, or other regulators as required by law, and to law enforcement in response to valid legal process.

• Identity verification providers

  We share KYC/KYB data with licensed identity verification providers (such as Smile ID or Dojah) to verify the identities of account holders as required by AML regulations.

• Infrastructure and technology providers

  We use cloud infrastructure, monitoring, and operational tooling providers (e.g., AWS, Datadog) who process data on our behalf under data processing agreements that require them to protect your data.

• Professional advisors

  We may share information with lawyers, auditors, and accountants under duties of confidentiality in the course of legitimate professional services.

• Business transfers

  In the event of a merger, acquisition, or sale of all or part of Payve, your information may be transferred as part of that transaction, subject to the same privacy protections.

4. Data Security

We implement industry-leading security measures to protect your data:

• AES-256 encryption for all data at rest
• TLS 1.3 encryption for all data in transit
• Role-based access control limiting internal access to only what is necessary
• Multi-factor authentication required for all staff accessing production systems
• Regular penetration testing conducted by third-party security firms
• Continuous monitoring and anomaly detection
• SOC 2 Type II audit (in progress)

Despite these measures, no system is completely secure. If you believe your account has been compromised, contact us immediately at security@payve.com.

5. Data Retention

We retain your data for as long as necessary to provide our services and comply with legal obligations:

• Account and KYC data: Retained for a minimum of 7 years after account closure, as required by Nigerian AML regulations and CBN guidelines.
• Transaction records: Retained for 7 years from the date of the transaction.
• API and system logs: Retained for 90 days for operational purposes; summarized audit logs retained for 2 years.
• Marketing data: Retained until you opt out or we determine the data is no longer needed for its original purpose.
• Support records: Retained for 3 years after the last interaction.

6. Your Rights

Subject to applicable law — including the Nigeria Data Protection Act 2023 (NDPA) and, where applicable, the EU General Data Protection Regulation (GDPR) — you have the following rights:

To exercise any of these rights, email privacy@payve.com. We will respond within 30 days. Note that certain rights may be limited where we are required to retain data by law or where deletion would impair our ability to comply with regulatory obligations.

7. Cookies

We use cookies and similar technologies on our website and dashboard for the following purposes:

• Strictly necessary cookies

  Session management, authentication tokens, and CSRF protection. These cannot be disabled.

• Analytics cookies

  We use privacy-preserving analytics (e.g., Plausible Analytics) to understand traffic patterns without tracking individuals across websites.

• Preference cookies

  Remembering your settings such as language preference and dashboard layout.

8. International Data Transfers

Payve is headquartered in Nigeria and operates across multiple African countries. Where we transfer data outside Nigeria, we do so in compliance with the NDPA 2023 and applicable cross-border data transfer frameworks.

Where data is transferred to service providers in countries outside Africa (for example, cloud infrastructure in the EU or US), we ensure appropriate safeguards are in place, including standard contractual clauses, processor agreements, and where relevant, adequacy decisions. Data processed in the EU is subject to GDPR protections.

9. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact our Data Protection Officer:

We may update this Privacy Policy from time to time. Material changes will be communicated by email to account holders and by posting a prominent notice on our website at least 30 days before the changes take effect.