Privacy policy

This Privacy Policy explains how Pokopay collects, uses and protects personal data. It is written to align with the Nigeria Data Protection Act 2023 ("NDPA") and guidance issued by the Nigeria Data Protection Commission ("NDPC"). Where the NDPA uses the term "data subject", we say "you".

1. Who this policy applies to

This policy applies to visitors to pokopayng.com, users of the Pokopay dashboard and mobile applications, staff of Merchants and Partners onboarded to the platform, and cardholders whose Transactions we process on behalf of a Merchant. Pokopay is the data controller for account, staff and marketing data; for Transaction data we generally act as a data processor on behalf of the Merchant and their acquirer.

2. Data we collect

• Account data — name, work email, phone, role, employer, MFA status.
• Merchant data — business name, RC / TIN, addresses, MID, TIDs, settlement account.
• Transaction metadata — timestamps, amounts, response codes, RRN, masked PAN (last 4).
• Device & network data — IP address, user agent, session identifiers, timestamps.
• KYC / KYB documents — ID documents, proof of address, corporate registrations, beneficial-owner declarations.
• Staff invite data — email, role, invite state, acceptance timestamps.
• Terminal telemetry — serial, firmware, last-seen, health signals, key check values (KCVs).

3. What we don't collect

We do not collect or retain full Primary Account Numbers (PAN), Personal Identification Numbers (PIN), Card Verification Values (CVV / CVV2) or magnetic stripe / chip track data through the dashboard. Where these are processed at the Terminal, they are encrypted at capture and handled entirely inside the PCI-scoped path (see the PCI Notice).

4. Lawful bases

We rely on the following lawful bases under section 25 of the NDPA:

• Contract — to onboard a Merchant, provision Terminals, settle Transactions, and provide support.
• Legal obligation — to meet CBN, NFIU, FIRS and NDPC obligations; to respond to lawful requests from regulators, law enforcement and the courts.
• Legitimate interests — to secure the platform, detect fraud, prevent abuse, keep audit trails, and improve the Services with non-identifying analytics. Where we rely on legitimate interests we balance them against your rights and freedoms and record the assessment.
• Consent — for optional communications and any non-essential cookies (we currently use none).

5. How we use it

• Operate the dashboard, mobile apps and Terminals, and provide support.
• Authenticate users, enforce role scopes, and issue and rotate credentials.
• Route and reconcile Transactions with acquirers and processors.
• Detect, investigate and prevent fraud, abuse and security incidents.
• Meet AML / CFT, tax, data-protection and audit obligations.
• Improve the Services using aggregated, non-identifying analytics.
• Communicate service messages (billing, outages, security notices).

6. Sharing

We share personal data only with the following categories of recipient:

• Acquirers and card schemes — to authorise, clear and settle Transactions.
• Payment processors — to route Transactions and manage disputes.
• Cloud infrastructure providers — hosting, storage, managed databases.
• Email & messaging vendors — to deliver invites, receipts and service notices.
• Auditors and professional advisers — under confidentiality.
• Regulators and law enforcement — where lawfully required.

We do not sell personal data and we do not share personal data for cross-context behavioural advertising.

7. International transfers

We prefer processing in Africa-adjacent AWS regions and keep the primary data plane close to Nigerian users. Where a transfer outside Nigeria is necessary — for example to a card scheme or to a global processor — we rely on the safeguards permitted under section 41 of the NDPA, including adequacy, binding contractual protections, and, where applicable, your specific and informed consent.

8. Retention

• Transaction records — retained for at least seven (7) years in line with CBN record-keeping requirements.
• KYC / KYB documents — retained for five (5) years after the end of the customer relationship, in line with the AML / CFT regime.
• Terminal telemetry — kept on a rolling window sized to operational need, then aggregated or deleted.
• Marketing contact data — retained until you opt out or two (2) years of inactivity.
• Security & audit logs — retained for at least one (1) year, longer where the incident record demands it.

9. Your rights under the NDPA

Subject to the limits and exceptions in the NDPA you have the right to:

• Access personal data we hold about you.
• Have inaccurate or incomplete personal data rectified.
• Request erasure of personal data (subject to our retention obligations).
• Receive your personal data in a portable, machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with the NDPC.

10. How to exercise rights

Contact privacy@pokopayng.com. We will verify your identity before acting on a request — typically by matching against the email, phone or role on file, and, for higher-risk requests, by asking for corroborating information. We aim to respond substantively within thirty (30) days; if we need more time we will tell you why and by when.

11. Security

We encrypt data at rest and in transit, scope access by role, log admin actions, and monitor for anomalies. For the broader security posture see our Security page and, for cardholder data specifically, the PCI Notice.

12. Cookies

Our use of cookies is described in the Cookies Policy. The marketing site uses essential cookies only; the dashboard uses secure authentication cookies withSameSite=Strict. We do not use cross-site advertising cookies.

13. Automated decision-making

We do not use fully automated decisions that produce legal or similarly significant effects on you. We do use automated signals to score fraud and risk, but any decision to suspend a Merchant, block a Transaction or exit a relationship involves human review.

14. Children

The Services are not directed at people under 18 and we do not knowingly collect personal data from children. If you believe we hold personal data of a child, contact privacy@pokopayng.com and we will delete it.

15. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or through the dashboard at least thirty (30) days before they take effect. The "Last updated" date at the top of the page always reflects the current version.

16. Contact & complaints

Privacy questions or complaints — privacy@pokopayng.com. If you are not satisfied with our response you may escalate to the Nigeria Data Protection Commission (NDPC).