Privacy Policy

RexiptPay (“RexiptPay”, “we”, “us”, or “our”) respects your privacy and is committed to protecting personal data. This Privacy Policy describes our practices for the RexiptPay website, progressive web application, mobile experiences, WhatsApp or chat payment channels, customer support, and related services (the “Services”).

By creating an account, completing KYC, funding a wallet, making payments, or otherwise using the Services, you acknowledge that you have read this Privacy Policy. Where the NDPA or other law requires consent for a specific processing activity, we will request that consent separately in a clear manner.

• Customers and prospective customers who register or attempt to register for RexiptPay.
• Users of landing pages, help content, and marketing communications where we process contact data.
• Individuals whose data appears in payment instructions (for example beneficiary account names) when another user initiates a transfer.
• Visitors whose device and usage data are collected through cookies or similar technologies as described below.

This Policy does not cover third-party websites, apps, or services that we do not control (including WhatsApp as operated by Meta, bank apps, or bill provider portals), even if you reach them from RexiptPay. Their privacy practices are governed by their own policies.

The categories of personal data we process depend on how you use the Services. We collect information you provide, information generated by your use of the Services, and information from verification and fulfilment partners.

Account and profile data: full name, email address, phone number, password hashes or authentication secrets (we do not store plaintext passwords), preferred notification settings, profile display information, and account identifiers.

Identity and KYC data: National Identification Number (NIN); identity attributes retrieved or confirmed during verification (such as legal name, date of birth, gender, photograph or biometric templates where required by the verification partner); residential address and related address-verification evidence; and, for higher tiers, additional identity or address documents you upload.

Financial and transaction data: wallet balances and ledger records; RexiptPay Account / NUBAN details; funding events (card tokens or masked PAN via processors—we do not store full card numbers on RexiptPay servers when a processor tokenises them); transfer amounts, fees, statuses, references, and timestamps; beneficiary bank details and account names; bill purchase details (phone numbers, meter / smartcard / customer IDs, tokens, provider responses); statements you generate.

Security and authentication data: transaction PIN (stored hashed / protected), 2FA status and related secrets where applicable, OTP delivery metadata, device identifiers, IP addresses, browser or app version, approximate location derived from IP when needed for fraud controls, session logs, and freeze / recovery events.

Communications and support: messages you send to support, chat or WhatsApp payment instructions and confirmations within channels we operate or integrate, call notes if phone support is offered, and survey or feedback responses.

Marketing and preference data (where collected): newsletter preferences, campaign engagement metrics, and consents or opt-outs.

Cookies and similar technologies: see the Cookies section below for details on essential, preference, and analytics cookies.

• Directly from you during registration, KYC, profile updates, funding, transfers, bill payments, and support requests.
• Automatically through the Services (logs, device signals, cookies, in-app analytics necessary for security and reliability).
• From identity-verification and KYC partners that return matched identity attributes against your NIN or documents.
• From banks, switches, card processors, and bill providers as status updates, name enquiry results, settlement confirmations, or failure codes.
• From messaging platforms when you use integrated WhatsApp or chat payment flows (message content needed to interpret and confirm payment instructions).
• From publicly available or commercially available sources where lawful and necessary for fraud, AML, or sanctions screening.

We process personal data for the following purposes:

• Creating and administering accounts, authenticating users, and providing wallet, transfer, funding, statement, and bill-pay features.
• Performing KYC, ongoing due diligence, AML/CFT monitoring, sanctions screening, and fraud prevention.
• Executing and reconciling payments with banks, processors, and bill providers; issuing receipts and references.
• Operating conversational payment assistance (in-app and WhatsApp where offered), including understanding instructions and requesting confirmation.
• Sending transactional notices (OTP, security alerts, payment confirmations) that are necessary to operate the Services.
• Customer support, dispute investigation, chargeback handling, and complaint resolution.
• Improving product reliability, usability, and security through aggregated or de-identified analytics where feasible.
• Complying with legal, regulatory, tax, accounting, and audit obligations; enforcing our Terms of Service; and establishing, exercising, or defending legal claims.
• With your consent where required, sending marketing communications about RexiptPay features and offers.

Depending on the activity, we rely on one or more of the following lawful bases under the Nigeria Data Protection Act, 2023:

• Contract: processing necessary to provide the Services you request (account creation, transfers, bill payments, support related to your account).
• Legal obligation: KYC/AML/CFT, record retention, responding to lawful requests from competent authorities, and other duties under Nigerian law.
• Legitimate interest: securing the platform, preventing fraud and abuse, improving service reliability, and limited product analytics—balanced against your rights and freedoms.
• Consent: where required for optional marketing, certain non-essential cookies, or specific processing that is not otherwise justified. You may withdraw consent without affecting processing that rests on another lawful basis.
• Vital interests or public interest: in rare cases required to protect life or for tasks carried out in the public interest as recognised by law.

Sensitive or specially protected data (such as certain biometric data used in identity verification) is processed only where permitted under the NDPA—typically for legal compliance, with consent, or under another applicable exception—and with heightened safeguards.

We do not sell your personal data. We share data only as needed to operate the Services, comply with law, or with your direction:

• Identity and KYC partners: to verify NIN and documents and return matched identity attributes.
• Banking and payment partners: partner banks, switches, card processors, and settlement providers to fund wallets, move money, and reconcile transactions.
• Bill providers and biller networks: to fulfil airtime, data, electricity, cable TV, betting, education, and similar purchases.
• Messaging channel partners: to deliver chat / WhatsApp payment experiences you choose to use.
• Cloud hosting, security, analytics, email/SMS delivery, and customer-support tooling providers acting as processors under contractual confidentiality and security obligations.
• Professional advisers (lawyers, auditors) under confidentiality duties.
• Regulators, law enforcement, courts, and other competent authorities when required or permitted by law.
• Corporate transaction counterparties in a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards and notice where required.
• Other users: limited data such as your RexiptPay display name or account identifiers necessary to complete a peer transfer you or they initiate.

RexiptPay primarily serves users in Nigeria. Some processors (for example cloud hosting, email delivery, or analytics) may store or access data in other countries. Where personal data is transferred outside Nigeria, we take steps required by the NDPA and NDPC guidance, which may include adequacy assessments, contractual clauses, or other approved transfer mechanisms, and we apply appropriate technical and organisational safeguards.

You may contact support@rexipt.com for more information about the safeguards applicable to a specific transfer category.

We retain personal data only for as long as necessary for the purposes described in this Policy, including to meet legal, regulatory, AML, accounting, and dispute-resolution requirements. Typical retention practices include:

• Account profile data: for the life of the account and a reasonable period thereafter to close out obligations and respond to residual claims.
• KYC and identity records: for periods required under applicable AML and financial-services record-keeping rules (often several years after account closure or the end of the business relationship).
• Transaction, funding, and bill purchase records: for periods required for financial audit, scheme rules, tax, and consumer dispute windows.
• Security logs and fraud signals: for periods proportionate to investigation and threat-detection needs.
• Support correspondence: for periods needed to resolve issues and improve service quality.
• Marketing preferences: until you opt out or your consent is withdrawn, subject to evidence of consent retention where required.

When retention periods expire, we delete or irreversibly anonymise data, except where continued storage is required by law or necessary for the establishment, exercise, or defence of legal claims.

We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or destruction. These measures may include encryption in transit, encrypted or hashed storage of sensitive secrets (such as passwords and PINs), access controls and least-privilege administration, monitoring and logging, vulnerability management, and staff confidentiality obligations.

No method of transmission or storage is completely secure. You must also protect your devices, passwords, OTP channels, transaction PIN, and linked messaging accounts. Immediately report suspected unauthorised access to support@rexipt.com.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the NDPC and affected individuals as required by the NDPA and applicable regulations.

Subject to the NDPA and applicable exemptions (including those relating to AML, ongoing investigations, and legal privilege), you may have the right to:

• Be informed about how your personal data is processed (this Policy forms part of that notice).
• Request access to personal data we hold about you.
• Request rectification of inaccurate or incomplete personal data.
• Request erasure where processing is no longer necessary or is unlawful, subject to legal retention duties.
• Object to or request restriction of certain processing, including processing based on legitimate interests.
• Withdraw consent where processing is based on consent, without affecting prior lawful processing.
• Data portability where technically feasible and required by law for data you provided on the basis of consent or contract.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data protection rights have been infringed.

To exercise rights, email support@rexipt.com with the subject “Privacy / Data Protection”, describe your request, and provide enough information for us to verify your identity. We may ask for additional verification before fulfilling requests that could expose account data. We aim to respond within the timelines required by the NDPA.

We use cookies and similar technologies to operate the Services securely and reliably.

• Essential cookies: required for authentication sessions, security, load balancing, and remembering critical preferences such as theme. These cannot be disabled if you wish to use the Services.
• Preference cookies: remember choices such as UI settings where offered.
• Analytics cookies: help us understand aggregate usage and improve performance. Where consent is required for non-essential analytics, we will request it.

You can control cookies through your browser settings. Blocking essential cookies may prevent sign-in or core features from working. Our progressive web app may also use local storage and service-worker caches for offline capability and push notifications; those stores are limited to operating the installed experience.

The Services are intended for individuals who are at least eighteen (18) years old. We do not knowingly collect personal data from children under 18. If you believe a minor has provided personal data, contact support@rexipt.com so we can delete the information and close the account where appropriate.

We may send service and security messages without marketing consent because they are necessary to operate your account. Separately, we may send product updates or promotional messages where permitted by law and, where required, with your consent. You can opt out of marketing emails by using the unsubscribe link or updating notification preferences in the app. Opting out of marketing does not stop transactional or security notices.

We use automated systems to score fraud risk, enforce velocity and KYC limits, screen sanctions lists, and detect anomalous behaviour. These systems may delay, decline, or flag transactions for manual review. Where automated decisions produce legal or similarly significant effects and the NDPA grants you rights to human review or to contest the decision, you may contact support@rexipt.com to request review.

Rexipt AI and chat / WhatsApp payment assistants process the content of your instructions to identify payees, amounts, and intents, then present confirmations before money moves. Conversation content used for payments is processed for fulfilment, security, and quality improvement (including de-identified analysis where feasible). Do not include unnecessary sensitive information in free-text chat beyond what is needed to complete a payment.

The Services may contain links to third-party sites or rely on third-party platforms (banks, processors, WhatsApp, app stores). We are not responsible for their privacy practices. Review their policies before providing data to them directly.

We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or the Services. The “Last updated” date will change when we do. Material changes will be communicated through the Services or email where practicable. We encourage you to review this page periodically.

For privacy questions, data-subject requests, or complaints about how RexiptPay handles personal data, contact us at support@rexipt.com with the subject line “Privacy / Data Protection”.

If you are not satisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) through the channels published on the NDPC’s official website. We ask that you give us a reasonable opportunity to resolve your concern first.