Your privacy, in plain sight.

1. The Controller of Your Personal Data

For the purposes of the Nigeria Data Protection Regulation (NDPR) and General Data Protection Regulation (GDPR), Payble acts as:

Data Controller

For personal data relating to our direct users, including merchants, business owners, individual account holders, next of kin, and administrative team members.

Data Processor

For transactional and customer personal data processed on behalf of merchants using our payment link, invoice, and storefront services.

2. Information We Collect

We collect and process personal data in connection with our services and account structures:

A. Core User Account Profile Data

Collected during registration and account setup:

• Identity Details: Hashed First Name, Hashed Last Name, and Hashed Date of Birth.
• Contact Details: Hashed Email Address and unique Phone Number.
• Credentials: Hashed Passwords, Hashed Alternative Passcodes, and security PIN settings.
• Account Metadata: Country of origin, account status, email verification status, assigned system roles (such as standard users, agents, and administrators), privilege groups (such as owners, managers, and cashiers), paytag handle, tier level, and IP addresses.

B. Personal Profile & KYC Data

Collected to comply with national and international financial regulations (Tier 1, 2, and 3 KYC upgrades):

• Identification Documents: Document types (e.g., Voters Card, Drivers License, National ID) and Hashed Identity Document Numbers.
• KYC Identifiers: Hashed Bank Verification Number (BVN) and Hashed National Identification Number (NIN).
• Residential Details: Hashed physical address, city, ZIP code, state, country, nearest landmark, and building/apartment identifiers.
• Media Uploads: Verification selfie image links, document upload links (e.g., ID card scans, proof of address utility bills).

C. Next of Kin Data

Collected for account recovery, compliance, and emergency contacts:

• Details: Hashed full name, relationship, Hashed phone number, Hashed address, city, and state.

D. Business Profile Data

Collected from business owners registering their business entities:

• Corporate Details: Business classification (such as unregistered businesses, registered business names, or limited liability companies), Business Name, Storefront URL, and Category.
• Identifications: Hashed Company Registration Number (CAC/RC) and Hashed Value Added Tax (VAT) Number.
• Contact & Location: Primary phone number, business address, city, country, ZIP code, and landmarks.
• Uploaded Documents: Corporate registration certificates, corporate profiles, and verification documents.

E. Financial & Settlement Data

Collected to process payouts and verify merchant eligibility:

• Details: Hashed Bank Name and Hashed Settlement Account Number.

F. Transactional & Customer Payment Data

Processed when facilitating payments, invoices, or storefront checkouts:

• Payer Details: Payer/Customer Name, Payer Email, Payer Phone Number, and Billing/Shipping Address.
• Payment Details: Transaction date, currency code, transaction type, amount, transaction breakdown, and transaction status (such as successful, pending, or failed).
• Processing Details: Unique transaction reference, retrieval reference numbers (RRN), system terminal identifiers, auditing serial numbers (STAN), receipt numbers, card scheme (such as Visa or Mastercard), card expiry date, and partially masked or hashed card details.

3. Lawful Bases for Processing (Under GDPR & NDPR)

We process personal data only when we have a valid lawful basis to do so:

Contractual Performance

Processing is necessary to provide the services you requested, such as executing registration, payment processing, storefront sales, and payouts.

Legal Obligation

Processing is mandatory to comply with statutory Anti-Money Laundering (AML) and Know Your Customer (KYC) compliance laws (e.g., collecting BVN, NIN, and verified government IDs).

Consent

Where you have explicitly opted to receive newsletters or authorized biometric authentication and device-level credentials.

Legitimate Interests

For maintaining system security, optimizing platform performance, security auditing, preventing duplicate accounts, and ensuring service reliability.

4. Technical Safeguards & Data Security

We implement strict technical and organizational measures to secure your data:

Data Encryption at Rest

Highly sensitive personal data—including names, email addresses, dates of birth, Bank Verification Numbers (BVN), government-issued identification numbers, settlement bank accounts, and residential or business addresses—is encrypted prior to storage in our databases using industry-standard cryptographic methods.

Data Encryption in Transit & Hashing

All data transmitted between user-facing interfaces and our server environment is encrypted using Transport Layer Security (TLS/HTTPS). Passwords and PIN codes are securely hashed using strong cryptographic hashing algorithms and are never stored in plaintext. Access to decrypted data is strictly restricted to authorized systems and processing layers.

5. Third-Party Data Transmissions

To perform payment clearing, message routing, and service execution, we share specific elements of your data with verified third-party partners:

Terminal Management Systems

For provisioning physical POS terminal accounts and syncing merchant approval records.

SMS Delivery Providers

For delivering one-time passcodes (OTP) and verification SMS alerts.

Payment Processing Networks

For processing instant card transactions, generating digital payment links, and verifying bank account details.

Email Communication Services

For dispatching transactional notification emails and password reset instructions.

Push Notification Services

For delivering alerts and notifications via secure cloud tokens.

We ensure that all third-party integrations maintain security standards equivalent to or higher than our own. We do not sell or rent your personal data.

6. Data Subject Rights (GDPR & NDPR)

Depending on your residency and nationality, you have the following legal rights regarding your personal data:

01. Right of Access

You can request a summary and copy of the personal data we hold about you.

02. Right to Rectification

You can update or correct inaccurate or incomplete data.

03. Right to Erasure ('Right to be Forgotten')

You can request that we delete your personal data, subject to statutory retention limits (e.g., financial ledger logs and AML regulations which we are legally required to retain).

04. Right to Restriction of Processing

You can ask us to suspend processing your data under certain circumstances.

05. Right to Data Portability

You can request your data in a structured, machine-readable format.

06. Right to Object / Withdraw Consent

You can object to processing based on legitimate interest or withdraw consent at any time.

To exercise any of these rights, please contact our Data Protection Officer (DPO) at dpo@payble.io.

7. Data Retention

We retain personal data only as long as:

• Your active account is maintained on our system.
• Necessary to fulfill the business, analytical, or credit services related to your account.
• Required to satisfy statutory financial record-keeping obligations under central banking regulations, which mandate retention periods of up to 6 years for financial transaction logs.

8. Cross-Border Data Transfers

In facilitating international transactions, storefront services, or hosting resources on secure cloud servers outside your home country, your data may be transferred across international borders. We ensure all such transfers are protected by adequate safeguarding mechanisms (e.g., Standard Contractual Clauses or NDPR-approved transfer frameworks).

9. Contact Us

If you have questions, concerns, or complaints regarding this Privacy Policy or how your data is handled, please reach out to us at:

Email Addresses

privacy@mypayble.com

hello@payble.io

Headquarters

Plot 654 Sani Abacha Way, by FCDA/NTA HQRS, Area 11, Garki, Abuja, Nigeria

Nigeria