Privacy Policy

This Privacy Policy explains how XexoPay (“XexoPay”, “we”, “us”), collects, uses, shares and protects your personal data when you use the XexoPay mobile app, the website at xexopay.com and our related services (together, the “Services”).

We are the data controller for the personal data described in this policy. We process personal data in line with the Nigeria Data Protection Act 2023 (the “NDPA”) and any regulations and directives issued under it.

1. Personal data we collect

Data you give us

• Account details: full name, email address, phone number, password, XexoPay tag (username) and transaction PIN.
• Profile details: date of birth, address and a profile photo if you choose to add one. If you add a photo, the app asks for permission to use your camera or photo library only for that purpose.
• Identity verification data: your Bank Verification Number (BVN) or National Identification Number (NIN), and where needed an identity document and a selfie, where we are required to verify your identity.
• Payment details: the recipients, amounts and notes for the payments you make, and the phone numbers, meter numbers, smartcard numbers or customer IDs you enter to buy airtime, data or pay bills.
• Support communications: messages you send us by email, the contact form or live chat, and the reason you give if you delete your account.

Data we collect automatically

• Transaction data: wallet balance, funding transfers into your XexoPay account number, and the date, time, amount, status and reference of every transaction.
• Device and usage data: IP address, device type, operating system, app version, and logs of sign-ins and errors, used to keep the Services secure and working.
• Website data: basic technical data when you visit our website. See our Cookie Policy.

Data we get from others

• Our payments partner tells us when money arrives in your XexoPay account number and the name of the sending account.
• If someone referred you, we record who referred you so we can pay their reward.

2. How we use your data and our lawful basis

We do not sell your personal data.

3. Who we share your data with

We share personal data only where we need to, with:

• Paga (Pagatech Limited), our licensed payments partner, which provides account numbers, receives funding transfers and processes payments, airtime, data and bill payments.
• Billers and network operators, who receive the customer ID, meter number or phone number needed to deliver what you paid for.
• Other XexoPay users, who see your name and tag when you send them money or they search for you to pay you.
• Service providers who work for us under contract: cloud hosting (DigitalOcean), email delivery (Mailgun), image storage for profile photos (Cloudinary) and live chat support (tawk.to).
• Regulators, law enforcement and courts, including the Central Bank of Nigeria, the Nigerian Financial Intelligence Unit and the Nigeria Data Protection Commission, where the law requires it.
• A buyer or successor if our business is sold or restructured, under the same protections.

4. International transfers

Some of our service providers store or process data outside Nigeria, including in the United States and the European Union. When we transfer personal data outside Nigeria, we rely on a lawful transfer basis under Part VIII of the NDPA, such as an adequacy decision, appropriate contractual safeguards or your consent.

5. How long we keep your data

• While your account is open, we keep the data needed to provide the Services.
• After you close your account, we keep identity and transaction records for at least 5 years after the end of our relationship, as required by the Money Laundering (Prevention and Prohibition) Act 2022 and Central Bank of Nigeria regulations.
• Profile photos and other data not needed for those records are deleted within 30 days of account closure.
• Support messages are kept for up to 2 years.

When the retention period ends, we delete or anonymise the data.

6. How we protect your data

We use encryption in transit (HTTPS), hashed passwords, PIN confirmation for every payment, access controls for staff, and regular security reviews. No system is completely secure, so please keep your PIN and password private. We will never ask for them.

If a personal data breach is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission within 72 hours and tell you without undue delay, as the NDPA requires.

7. Your rights

Under the NDPA you have the right to:

• be told how your data is used, which is what this policy is for;
• get a copy of your personal data;
• have inaccurate data corrected;
• have your data deleted, subject to the legal retention periods above;
• restrict or object to some processing, including direct marketing;
• receive your data in a commonly used format (data portability);
• withdraw consent at any time where we rely on consent; and
• not be subject to a decision based solely on automated processing that significantly affects you, without human review.

To use any of these rights, email contact@xexopay.ng from your registered email address. We will respond within 30 days. You can delete your account in the app at any time; see Delete your account.

If you are not happy with how we handled your data, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

8. Children

The Services are for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has opened an account, contact us and we will close it.

9. Changes to this policy

We may update this policy. If the changes are significant, we will tell you in the app or by email before they take effect. The date at the top shows when it was last updated.

10. Contact us

XexoPay
Email: contact@xexopay.ng
Data protection enquiries: contact@xexopay.ng