Privacy Policy & Data Protection Notice

1. Data Controller & Technology Status

This Privacy Policy details how OuiPay Technologies Limited (“OuiPay”, “we”, “us”, or “our”), acting as Data Controller, collects, processes, stores, protects, and discloses personal data obtained from users of our digital payment technology platform.

OuiPay Technologies Limited is a technology provider, not a bank or depository institution. Customer funds and payment values are strictly held, maintained, and safeguarded by licensed partner financial institutions in accordance with statutory regulations.

We are committed to maintaining the security and privacy of your personal and financial information in strict compliance with the Nigeria Data Protection Act (NDPA / NDPR), General Data Protection Regulation (GDPR), and statutory data protection regulations across our operating jurisdictions.

For data protection inquiries or to exercise your statutory privacy rights, contact our Data Protection Officer (DPO) at privacy@ouipay.africa.

2. Categories of Personal Data Collected

We collect personal information necessary to deliver technology services, verify identity, prevent financial fraud, and fulfill statutory obligations. Data collected includes:

• Identity & Verification Information: Legal full name, residential address, telephone number, email address, and date of birth. Identity numbers, identity documents, and biometric checks are captured and held by licensed identity verification providers; OuiPay does not collect or store them and receives only the verification result.
• Financial & Payment Information: Linked payment methods, debit/credit card metadata, bank account details, mobile money account details, transaction history, utility account numbers (electricity meter numbers, smartcard IDs), transaction timestamps, currency exchange records, and payment receipts.
• Technical & Device Information: IP address, mobile device model, operating system version, unique device identifier, network operator details, application diagnostics, and security session data.
• Customer Support Communications: Records of customer support interactions, dispute inquiries, in-app messaging logs, and feedback submissions.

3. Legal Bases for Data Processing

OuiPay processes your personal data strictly under valid statutory legal bases:

• Contractual Performance: Processing necessary to register your Account, execute payments through licensed providers, convert currencies, fulfill utility purchases, and deliver requested technology services.
• Statutory & Regulatory Obligations: Processing mandated by Anti-Money Laundering (AML), Counter-Terrorist Financing (CTF), Know Your Customer (KYC), and tax compliance regulations.
• Legitimate Business Interests: Processing required to safeguard platform security, detect fraud, conduct internal audits, and optimize application reliability.
• Explicit Consent: Processing conducted based on your direct authorization, such as receiving optional promotional communications or non-essential cookies.

4. Third-Party Data Sharing & Zero-Sale Guarantee

OuiPay does not sell, rent, trade, or monetize your personal data to third parties under any circumstances. We disclose personal information strictly to authorized processing partners and licensed providers under binding data protection agreements:

• Licensed Partner Banks & Payment Networks: Financial institutions and payment providers licensed by the relevant financial regulatory authorities in our operating countries responsible for holding customer funds and settling transactions.
• Telecommunication & Utility Providers: Mobile network operators and electricity distribution companies required to credit airtime, data bundles, or electricity units.
• Identity Verification Partners: Authorized identity verification service providers operating under strict security protocols to validate government identity records.
• Cloud Infrastructure & Security Providers: Certified cloud server infrastructure and threat mitigation services providing encrypted data storage.
• Statutory Authorities: Regulatory bodies, law enforcement agencies, or tax authorities when legally compelled by valid court subpoena or regulatory directive.

5. Cross-Border Data Transfers

To facilitate cross-border payment technology services, your data may be processed across secure regional infrastructure.

All international data transfers adhere to statutory cross-border transfer mechanisms, including Standard Contractual Clauses (SCCs) and encryption controls, ensuring that your data receives an equivalent standard of protection regardless of processing location.

6. Security Controls & Data Retention

OuiPay employs bank-grade security controls to protect personal information against unauthorized access, alteration, disclosure, or destruction:

• 256-bit encryption for all data transmitted over public networks.
• Bank-grade data encryption for personal and financial records at rest.
• Strict access controls and internal security authentication protocols.

Personal data is retained for the duration of your active Account status plus a mandatory statutory retention period of 5 to 7 years following Account closure, as required by financial recordkeeping laws. Upon expiration of the statutory retention window, data is permanently deleted or anonymized.

7. User Data Rights

Under applicable data protection statutory laws (including NDPR and GDPR), you possess the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data held by OuiPay about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal records.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data, subject to mandatory statutory financial retention rules.
• Right to Restrict Processing: Request temporary restriction of data processing during dispute investigations.
• Right to Data Portability: Receive your personal transaction data in a structured, machine-readable format.

To exercise any of these rights, submit a written request to privacy@ouipay.africa. We will respond to verified requests within 30 days.

8. Cookies & Performance Telemetry Policy

Cookies on OuiPay are strictly used for essential authentication, application performance, and session security. We use cookies exclusively to maintain your secure login session, optimize application load performance, and protect your account from security threats.

OuiPay does not use advertising, third-party tracking, or behavior profiling cookies.

9. Updates & Regulatory Contact

We reserve the right to update this Privacy Policy periodically to reflect statutory regulatory changes or operational enhancements. Updates will be announced via platform notifications with an updated effective date.

For formal data privacy inquiries, write to our Data Protection Officer at dpo@ouipay.africa or contact the statutory Data Protection Authority in your jurisdiction.