NEPAY PRIVACY POLICY

1. Introduction

Circle Technology Limited ("Circle Technology", "NePay", "we", "us" or "our") respects your privacy and is committed to processing personal data lawfully, fairly, transparently and securely. This Privacy Policy explains how personal data is collected, used, disclosed, stored and otherwise processed when you use the NePay mobile application, website and related services. Circle Technology Limited is responsible for the personal data it determines the purposes and means of processing, subject to circumstances in which an independent service provider acts as a separate controller under applicable law.

2. Scope

This Policy applies to personal data processed in connection with NePay, including account registration, identity verification, payment services, digital asset transactions, utility payments, gift card transactions, security, fraud prevention, rewards, communications and customer support. NePay is intended only for persons aged eighteen years or older.

3. Personal Data We Process

Depending on how you use NePay, we may process the following categories of information.

3.1 Account and Profile Information

This may include: a. first and last name; b. email address; c. telephone number; d. username; e. profile photograph; f. account and User identifiers; g. preferred currency; h. verification status; i. account status; j. communication preferences; and k. account creation, modification and deletion information.

3.2 Authentication and Security Information

We may process: a. securely hashed passwords and PINs; b. authentication and session information; c. multifactor authentication status; d. device identifiers used for account security; e. login history; f. IP addresses; g. approximate location derived from login or network information; h. failed authentication attempts; i. security and verification records; and j. fraud and security indicators. We do not intend to store passwords or transaction PINs in plaintext. Where you enable device biometric authentication, your device's operating system or secure hardware ordinarily performs biometric matching. NePay does not ordinarily receive your fingerprint or Face ID biometric template from the device.

3.3 Identity Verification Information

To satisfy identity verification, financial crime prevention and applicable KYC requirements, information may be submitted to independent verification providers. Depending on the applicable verification process, this may include information relating to your BVN, NIN, identification documents, photograph or facial verification. Circle Technology may process verification status, verification type, provider references, submission and decision information, risk information and hashed identifiers used for purposes such as duplicate account prevention. Raw identification numbers are not intended to be retained by Circle Technology where the applicable verification architecture only requires their transmission to the verification provider.

3.4 Financial and Transaction Information

We may process information concerning: a. wallet and ledger records; b. deposits and withdrawals; c. transaction amounts and currencies; d. exchange rates; e. transaction status; f. holds and reversals; g. virtual account information; h. bank account information used in connection with withdrawals or rewards where applicable; i. provider and transaction references; and j. transaction timestamps and descriptions. Underlying financial institutions and payment service providers may independently process additional financial information necessary to provide their services.

3.5 Digital Asset Information

We may process: a. digital asset type; b. blockchain network; c. deposit address; d. memo or tag; e. asset quantity; f. expected and received amounts; g. transaction and provider identifiers; h. confirmations; i. applicable exchange rate; j. settlement information; and k. transaction status and failure information. Blockchain transactions may also be recorded permanently on public or otherwise accessible distributed ledgers that Circle Technology does not control.

3.6 Utility Payment Information

Depending on the service purchased, we may process information such as: a. telephone number; b. electricity meter number; c. television smart card number; d. service or package selection; e. customer or recipient identifier; f. beneficiary information; g. payment amount; h. provider reference; i. verification result; j. customer name returned by the relevant service infrastructure; and k. redemption or service tokens where applicable.

3.7 Gift Card Information

Where you use gift card conversion services, we may process: a. gift card brand and denomination; b. quantity; c. card code; d. photographs of the card; e. transaction and provider references; f. quoted and payout rates; g. verification results; h. fraud and compliance review information; i. payout information; and j. dispute and recovery information. Gift card codes and images may be encrypted, hashed or otherwise protected where appropriate.

3.8 Fraud Prevention and Compliance Information

We may process device, account, transaction and network information to identify duplicate accounts, fraud, suspicious activity and abuse. This may include device identifiers, hashed identifiers, risk signals, investigation information, account relationships and actions taken in response to identified risks.

3.9 Rewards and Referral Information

Where you participate in a referral, cashback, rewards or leaderboard programme, we may process: a. referral codes and relationships; b. qualifying transaction activity; c. points; d. ranking; e. reward status; f. prize claim information; and g. payment details required to distribute an applicable reward.

3.10 Device, Analytics and Technical Information

We may process information such as: a. device model; b. operating system; c. application version; d. IP address; e. push notification token; f. application events and usage information; g. crash and diagnostic information; and h. performance information. We use analytics and error monitoring technologies to understand use of the Services, diagnose failures, protect the platform and improve performance.

3.11 Communications

We may process emails, complaints, enquiries and other communications you send to us. If in application customer support functionality is introduced, this may include support conversations and related service records.

4. How We Obtain Personal Data

We may obtain personal data: a. directly from you; b. automatically from your device or use of NePay; c. from financial and payment service providers; d. from identity verification providers; e. from digital asset infrastructure providers; f. from utility and bill payment providers; g. from fraud prevention and security providers; h. from blockchain networks and publicly available distributed ledger information; and i. from other service providers involved in a transaction you request.

5. Purposes of Processing

We process personal data where necessary to: a. create and administer your account; b. authenticate you and protect account security; c. provide payment and transaction functionality; d. process digital asset transactions and Naira settlement; e. provide utility and gift card services; f. perform or facilitate identity verification; g. prevent, investigate and respond to fraud and security incidents; h. maintain financial and audit records; i. enforce transaction limits; j. comply with applicable legal and regulatory requirements; k. administer rewards and referrals; l. communicate with you; m. provide customer support; n. diagnose technical failures; o. analyse and improve the Services; and p. establish, exercise or defend legal claims.

6. Lawful Bases

Depending on the processing activity, we may rely upon one or more lawful bases recognised under applicable data protection law, including: a. performance of our contract with you; b. compliance with legal obligations; c. your consent where consent is required; d. our legitimate interests or those of another person, where those interests are not overridden by your rights and interests; e. public interest where applicable; and f. other lawful bases recognised by applicable law. Where processing depends on consent, you may withdraw that consent, subject to processing already lawfully undertaken and any other lawful basis that permits continued processing.

7. Sharing and Disclosure

We do not sell your personal data. We may disclose or make personal data available, where necessary and lawful, to categories of recipients including: a. licensed financial institutions and payment service providers; b. identity and KYC verification providers; c. digital asset infrastructure and transaction service providers; d. liquidity and settlement service providers; e. utility and bill payment providers; f. cloud hosting and data storage providers; g. media processing and storage providers; h. analytics, monitoring and security providers; i. communications providers; j. professional advisers, auditors and insurers; k. regulators, courts and law enforcement authorities where disclosure is legally required or otherwise lawfully permitted; and l. a successor or acquiring entity in connection with a lawful merger, acquisition, restructuring or transfer of the NePay business. Service providers are granted access only to information reasonably necessary for the relevant function, subject to applicable contractual and legal safeguards.

8. International Transfers

Personal data may be processed or stored outside Nigeria, including through infrastructure located in other jurisdictions. Where personal data is transferred internationally, Circle Technology will implement a lawful transfer mechanism and appropriate safeguards as required by applicable Nigerian data protection law. We will take reasonable steps to ensure that transferred personal data receives an appropriate level of protection having regard to the nature of the processing and applicable legal requirements.

9. Analytics and Monitoring

NePay uses analytics, diagnostics and error monitoring technologies to understand application usage, identify technical failures, improve performance and maintain security. Information processed through these technologies may include device, application, event, performance and diagnostic information. Where consent is required for a particular analytics or tracking technology, we will obtain or manage such consent as required by applicable law.

10. Marketing Communications

Where permitted by law, NePay may send information about products, promotions, rewards or other offers through email, SMS, push notifications or other available channels. Where consent is required, marketing communications will be sent subject to that consent. You may manage available communication preferences or unsubscribe from marketing communications. This does not prevent us from sending essential security, transactional, legal or service communications.

11. Data Security

Circle Technology uses technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss and destruction. Measures may include encryption, hashing, access controls, multifactor authentication, audit logging, secure communications, fraud monitoring and other safeguards appropriate to the relevant risk. No electronic system can be guaranteed to be completely secure. Accordingly, we cannot guarantee absolute security.

12. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and for applicable legal, regulatory, financial record keeping, security, fraud prevention, dispute resolution and legal claim requirements. Retention periods vary according to the nature of the information, account status, transaction type, applicable legal obligations and legitimate operational requirements. Where information is no longer required, we will delete, anonymise or otherwise securely dispose of it in accordance with our applicable retention procedures, unless continued retention is required or permitted by law.

13. Account Deletion

You may request deletion of your NePay account through the available account settings. We may require OTP or other authentication before acting on a deletion request. Account deletion may initially result in deactivation or soft deletion while required records are retained for legitimate and lawful purposes. Closing your account does not automatically erase transaction, fraud, audit, security or compliance records that Circle Technology is required or permitted to retain. Information that is no longer required will be deleted or anonymised in accordance with our retention procedures.

14. Your Data Protection Rights

Subject to applicable law and any lawful limitations, you may have the right to: a. obtain information about our processing of your personal data; b. request access to personal data concerning you; c. request correction of inaccurate or incomplete information; d. request deletion where the applicable legal requirements are satisfied; e. object to or request restriction of certain processing; f. withdraw consent where processing is based on consent; g. request data portability where applicable; h. object to certain automated processing where applicable; and i. lodge a complaint with the competent data protection authority. Requests may be submitted to compliance@nepay.com.ng. We may need to verify your identity before fulfilling a request.

15. Automated Fraud and Risk Assessment

NePay may use automated rules, risk indicators or fraud detection systems to identify suspicious activity, duplicate accounts and security risks. Where a decision produces a legal or similarly significant effect and applicable law grants you rights concerning automated decision making, we will provide the protections required by law. Some transactions may also be referred for manual review.

16. Children's Privacy

NePay is not intended for persons under eighteen years of age. We do not knowingly permit persons under eighteen to maintain NePay accounts. Where we determine that an ineligible minor has created an account, we may restrict or close the account and handle associated information in accordance with applicable law.

17. Third Party Services

Our Services may interact with independent third party services. Where a third party independently determines how and why it processes your personal data, its own privacy terms may apply in addition to this Policy.

18. Changes to This Privacy Policy

We may amend this Policy to reflect changes in law, technology, Services or our processing practices. Where changes are material, we will provide appropriate notice through the application, website, email or another suitable channel. The current version will display its effective or last updated date.

19. Complaints

If you believe your personal data has been processed improperly, please contact us first at: compliance@nepay.com.ng You also retain the right to complain to the competent Nigerian data protection authority where applicable.

20. Contact

Circle Technology Limited Nigeria Website: nepay.com.ng Privacy and Compliance: compliance@nepay.com.ng General Support: support@nepay.com.ng