Terms of service

These Terms of Service (the "Terms") govern your access to and use of the Pokopay platform, including our dashboard, mobile applications, POS software and associated services (together, the "Services"). By using the Services you agree to these Terms. Commercial specifics — pricing, settlement cadence, SLAs, exclusivity — live in a separate signed commercial contract; where the two documents disagree, the commercial contract governs.

1. Introduction & who we are

The Services are provided by Pokopay ("Pokopay", "we", "us", "our"), a company organised under the laws of the Federal Republic of Nigeria with its head office in Lagos. Our RC number is RC pending and will be published here once registration is finalised. General enquiries: hello@pokopayng.com.

2. Definitions

• Merchant — a business onboarded to accept payments through Pokopay.
• Partner — an acquirer, CSA (Card Scheme Associate) or reseller working with Pokopay under a written agreement.
• Terminal — a PCI PTS approved PIN entry device deployed to a Merchant to accept card-present transactions.
• Transaction — any payment authorisation, capture, refund or reversal processed through the Services.
• Settlement — the transfer of a Merchant's net proceeds (gross Transactions less fees and adjustments) to their nominated bank account.
• MID — Merchant Identifier issued by the acquirer.
• TID — Terminal Identifier bound to a specific Terminal at a specific Merchant location.
• JWT — the signed JSON Web Token issued by Pokopay to authenticate a dashboard or API session.
• CHD — cardholder data, as defined by the PCI DSS.
• HSM — hardware security module used for cryptographic key operations.

3. Eligibility & KYC

To use the Services you must be lawfully able to form a binding contract under applicable Nigerian law. All Merchants are subject to Know Your Customer (KYC) and Know Your Business (KYB) checks aligned with the Nigerian AML/CFT regime, including the Central Bank of Nigeria's AML/CFT Regulations, the Money Laundering (Prevention and Prohibition) Act 2022 and applicable NFIU guidance.

We screen against Nigerian and international sanctions and PEP (Politically Exposed Persons) lists. PEP relationships are permitted but subject to enhanced due diligence and, where applicable, senior-management approval. We may decline or exit relationships that we cannot risk-rate to our satisfaction, without being required to give reasons beyond what regulation obliges.

4. Account creation & credentials

Access to the dashboard is issued by invitation. Every user has an explicit role that scopes what they can see and do:

• SUPER_ADMIN — Pokopay platform operators.
• ADMIN — Pokopay staff with elevated but scoped rights.
• CSA — Card Scheme Associate operators, scoped to their portfolio.
• OWNER — the Merchant principal, with full rights inside their tenancy.
• MANAGER — delegated Merchant operator (staff, terminals, reporting).
• CASHIER — read-mostly role, transaction acceptance at the terminal.

You are responsible for keeping credentials confidential, for enforcing MFA where offered, and for every action taken under your account. Notify us immediately of any suspected unauthorised access at security@pokopayng.com.

5. Merchant onboarding

Onboarding requires, at a minimum, incorporation documents (CAC certificate, status report, memorandum & articles), the beneficial owners' identification, proof of the Merchant's business address, tax identification (TIN) and settlement account details. Additional documents may be requested for higher-risk MCCs. Onboarding timelines are set in your commercial contract; this page does not create a service level around them.

6. Fees, settlement & taxes

Fees, MDR splits and settlement cadence — typically T+0 or T+1 depending on the acquirer — are set out in your commercial contract. No fee waivers or grace periods apply by default: any waiver must be documented in writing and signed by an authorised Pokopay signatory. Amounts are stated exclusive of VAT and other applicable taxes unless expressly stated otherwise; you are responsible for taxes you owe on your own income.

7. Chargebacks, refunds & disputes

Chargebacks, refunds and retrieval requests are governed by the applicable card scheme rules (Visa Core Rules, Mastercard Chargeback Guide and equivalents for Verve and other domestic schemes). You agree to respond to retrieval requests within the window set by the scheme, generally not more than seven (7) business days from our notice, and to provide the supporting evidence we reasonably request. Where a chargeback is upheld against a Merchant we will debit the disputed amount plus any scheme-imposed fees from the next Settlement.

8. Terminals

Terminals deployed to a Merchant are, unless a separate purchase agreement says otherwise, loaned. Title remains with Pokopay, the Merchant is responsible for reasonable care while in possession, and Terminals must be returned in working condition on termination. Damage beyond fair wear and tear will be assessed and chargeable. Cryptographic key material provisioned to a Terminal never leaves the HSM path (see our PCI Notice) and Merchants must not attempt to open, reflash or tamper with Terminals.

9. Acceptable use

Your use of the Services is subject to our Acceptable Use Policy, which lists prohibited use categories and the reporting mechanism for abuse. Breach of the Acceptable Use Policy is a breach of these Terms.

10. Data & privacy

Our handling of personal data is described in our Privacy Policy. Our use of cookies is described in our Cookies Policy. Both policies are incorporated into these Terms by reference.

11. Cardholder data & PCI

We handle cardholder data as described in our PCI Notice. The dashboard never accepts full PAN, PIN, CVV or track data; PAN is masked to last four digits at every render.

12. Third-party services

Delivering the Services depends on third parties — acquirers, card schemes, processors, cloud infrastructure, email vendors and telemetry providers. Their availability, SLAs and terms flow through to you on a pass-through basis: we cannot commit to more than the underlying provider commits to us. Where a third party fails, we will use commercially reasonable efforts to mitigate and to communicate.

13. Uptime & maintenance

We target high availability for the dashboard and APIs. Any specific uptime commitment, credit or remedy is a matter for the commercial contract; the target on this page is aspirational, not contractual. Planned maintenance is communicated in the dashboard and by email where practical.

14. Intellectual property

The Services, including all associated software, documentation, brand assets and other intellectual property, are the property of Pokopay and its licensors. Nothing in these Terms transfers ownership. You get a non-exclusive, non-transferable, revocable licence to use the Services for their intended purpose during the term of the commercial contract.

15. Confidentiality

Each party will treat the other's non-public information as confidential and will use it only to perform under these Terms and the commercial contract. Standard exceptions apply (public information, information received from a third party without duty of confidence, information independently developed, disclosures required by law or regulator).

16. Indemnification

Each party will indemnify the other against third-party claims arising from its own breach of these Terms, its violation of applicable law, or its infringement of third-party intellectual property. Indemnification is capped at the amount set in the commercial contract; absent a specific cap, at the fees paid or payable in the twelve (12) months preceding the claim.

17. Disclaimers & limitation of liability

The Services are provided "as is" and "as available" without warranty of any kind, express or implied, except as expressly stated in the commercial contract. To the maximum extent permitted by Nigerian law, Pokopay's aggregate liability under these Terms is limited to the fees paid by you to Pokopay in the twelve (12) months preceding the event giving rise to the claim. Neither party is liable for indirect, consequential or loss of profit damages. Nothing in this clause limits liability that cannot be limited under Nigerian law.

18. Force majeure

Neither party is liable for delay or failure caused by events beyond its reasonable control — including natural disasters, civil unrest, governmental action, telecommunications and power failures, and cyber attacks — provided it takes reasonable steps to mitigate and to resume performance.

19. Suspension & termination

We may suspend or terminate access for cause — including non-payment, breach of these Terms, breach of the Acceptable Use Policy, or conduct that risks the security, reputation or regulatory standing of the platform — with immediate effect where the risk requires it, or after notice and opportunity to cure where the breach is capable of cure. Termination for convenience is governed by the commercial contract; absent a specific notice period there, thirty (30) days' written notice by either party.

20. Governing law & dispute resolution

These Terms are governed by the laws of the Federal Republic of Nigeria. Disputes will be resolved in the courts of Lagos, unless the commercial contract provides for arbitration, in which case that clause governs.

21. Changes to these Terms

We may update these Terms from time to time. Material changes will be notified via the dashboard or by email at least thirty (30) days before they take effect. Continued use of the Services after the effective date constitutes acceptance of the updated Terms.

22. Notices

Notices to Pokopay should be sent to legal@pokopayng.com and, for security matters, to security@pokopayng.com. Notices to you may be given via the email address on file or through the dashboard.

23. Contact

General — hello@pokopayng.com. Privacy — privacy@pokopayng.com. Abuse — abuse@pokopayng.com.