Skip to content
Legal

Privacy Policy

Last updated: January 1, 2025

On this page

1. Introduction

Billvend ("we," "our," or "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you access or use the Billvend platform, including our website, mobile application, and all related services (collectively, the "Service").

We process personal data in compliance with the Nigeria Data Protection Regulation 2019 (NDPR), the Nigeria Data Protection Act 2023 (NDPA), and other applicable data protection laws and regulations of the Federal Republic of Nigeria. For the purposes of these laws, we are the Data Controller of your personal data.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this Policy, you must not use the Service.

2. Information We Collect

2.1 Personal Information You Provide to Us

  • Identity Data: Full name, date of birth, and government-issued identification documents where required for identity verification.
  • Contact Data: Email address, phone number, and residential address.
  • Financial Data: Bank account details (account name, account number, bank name, BVN where required), wallet balance, transaction history, and payment card information.
  • Transaction Data: Details of all Transactions conducted through the Service, including service type, amount, date and time, network provider or Service Provider, Transaction ID, and Transaction status.
  • Communications Data: Records of correspondence when you contact our customer support team via email, phone, or any other channel, including the content and metadata of such communications.

2.2 Information Collected Automatically

  • Device Information: Device type, operating system name and version, device manufacturer, unique device identifiers (such as IMEI, advertising ID), and mobile network information.
  • Log Data: Internet Protocol (IP) address, browser type and version, access dates and times, pages viewed, features used, and crash reports.
  • Usage Data: How you interact with the Service, including features accessed, time spent on pages, click patterns, and navigation paths.
  • Location Data: Approximate geographic location derived from your IP address. We do not collect precise GPS location data unless you grant explicit permission.

2.3 Information from Third Parties

We may receive information about you from third-party sources, including:

  • Payment processors and financial institutions for transaction verification and fraud prevention;
  • Identity verification services for KYC (Know Your Customer) compliance;
  • Service Providers (telecommunication networks, electricity companies, etc.) for transaction reconciliation;
  • Publicly available sources to verify information you provide.

3. How We Use Your Information

We use the information we collect for the following purposes:

  • Service Delivery: To create and manage your account, process Transactions, maintain your Wallet, facilitate payments to Service Providers, and provide customer support.
  • Identity Verification and Security: To verify your identity, conduct KYC checks as required by applicable regulations, detect and prevent fraudulent Transactions, protect against unauthorised account access, and maintain the security and integrity of the Service.
  • Compliance: To comply with applicable laws, regulations, legal processes, and enforceable governmental requests, including anti-money laundering (AML) and counter-terrorism financing (CTF) obligations.
  • Communication: To send Transaction confirmations, receipts, account notifications, service updates, security alerts, and support responses. To send marketing communications where you have provided consent (with opt-out available at any time).
  • Service Improvement: To analyse usage patterns, diagnose technical issues, optimise performance, develop new features, and improve user experience.
  • Dispute Resolution: To investigate and resolve disputes, claims, and complaints relating to the Service.
  • Risk Management: To assess credit and fraud risk, monitor Transaction patterns for suspicious activity, and protect the legitimate interests of the Company and other Users.

4. Legal Basis for Processing

We process your personal data on the following lawful bases:

  • Contractual Necessity: Processing is necessary for the performance of our contract with you (these Terms of Service), including providing the Service, processing Transactions, and maintaining your account.
  • Legal Obligation: Processing is necessary to comply with our legal and regulatory obligations, including KYC, AML/CTF, financial record-keeping, and reporting requirements under Nigerian law.
  • Legitimate Interests: Processing is necessary for our legitimate business interests, including fraud prevention, security, service improvement, and marketing (where permitted), provided these interests are not overridden by your rights and freedoms.
  • Consent: Where you have given explicit consent for specific processing activities, such as receiving marketing communications. You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties for their marketing purposes.

We may share your personal data in the following limited circumstances:

  • Service Providers: With trusted third-party vendors who perform services on our behalf, including payment processors, identity verification services, cloud hosting providers, analytics services, and customer support platforms. These providers are contractually bound to protect your data and process it only in accordance with our instructions.
  • Payment Partners: With banks, payment gateways, and financial institutions to facilitate Wallet funding, withdrawals, and Transaction processing.
  • Transaction Service Providers: With telecommunications networks, electricity distribution companies, cable TV providers, examination bodies, and airlines to the extent necessary to complete your requested Transactions.
  • Legal and Regulatory Authorities: When required by law, regulation, court order, subpoena, or governmental authority, including the Nigerian Financial Intelligence Unit (NFIU), the Economic and Financial Crimes Commission (EFCC), the Central Bank of Nigeria (CBN), and the Nigeria Data Protection Commission (NDPC).
  • Business Transfers: In connection with a merger, acquisition, reorganisation, sale of assets, or bankruptcy, provided the recipient agrees to respect your personal data in a manner consistent with this Privacy Policy.
  • Professional Advisers: With our legal counsel, auditors, accountants, and insurers as reasonably necessary for the operation of our business.
  • With Your Consent: We may share your information for any other purpose disclosed to you with your specific consent.

6. Data Security

We implement and maintain appropriate technical and organisational security measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

  • Encryption: All data transmitted between your device and our servers is encrypted using industry-standard TLS (Transport Layer Security) protocols. Sensitive data at rest is encrypted using AES-256 encryption.
  • Access Controls: Strict role-based access controls ensure that only authorised personnel with a legitimate business need can access personal data. All access is logged and audited.
  • Secure Infrastructure: Our servers are hosted in secure data centres with physical security controls, including 24/7 monitoring, biometric access controls, and redundant power and network systems.
  • Monitoring and Testing: We continuously monitor our systems for vulnerabilities and suspicious activity. We conduct regular penetration testing and security audits by independent security firms.
  • Data Minimisation: We collect and retain only the personal data necessary for the purposes described in this Policy.

No method of electronic storage or transmission over the Internet is 100% secure. While we strive to protect your personal data using commercially acceptable means, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of your account credentials.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

  • Account Data: Retained for the duration of your account's active status and for a period of 5 years after account closure, in compliance with Nigerian financial record-keeping requirements.
  • Transaction Data: Retained for a minimum of 5 years from the date of the Transaction, in compliance with CBN regulations and other applicable laws.
  • KYC Documentation: Retained for 5 years after the termination of the business relationship, in compliance with AML/CTF regulations.
  • Communications: Retained for 2 years from the date of the last communication.
  • Log and Usage Data: Retained for 18 months from the date of collection.

Where we anonymise your personal data so that it can no longer be associated with you, we may retain and use such anonymised data indefinitely for research, statistical, and analytical purposes.

8. Your Data Protection Rights

Under the Nigeria Data Protection Act 2023 and the NDPR, you have the following rights regarding your personal data:

  • Right of Access: You have the right to request confirmation of whether we process your personal data and to obtain a copy of the personal data we hold about you.
  • Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you.
  • Right to Erasure (Right to be Forgotten): You have the right to request deletion of your personal data in certain circumstances, subject to legal retention requirements and our legitimate business needs.
  • Right to Restrict Processing: You have the right to request restriction of processing of your personal data in certain circumstances, such as where you contest the accuracy of the data.
  • Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another data controller without hindrance.
  • Right to Object: You have the right to object to processing of your personal data based on our legitimate interests or for direct marketing purposes.
  • Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
  • Right to Complain: You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe that your data protection rights have been violated. You may contact the NDPC at Website: https://ndpc.gov.ng or Email: [email protected].

To exercise any of these rights, please contact us using the details at the end of this policy. We will respond to your request within 30 days. We may require you to verify your identity before processing your request. We reserve the right to charge a reasonable fee or refuse to act on requests that are manifestly unfounded, excessive, or repetitive.

9. Cookies and Tracking Technologies

Our website may use cookies, web beacons, and similar tracking technologies to enhance your browsing experience, remember your preferences, analyse website traffic, and understand usage patterns.

  • Essential Cookies: Necessary for the operation of the Service, including maintaining your session and ensuring security. These cannot be disabled.
  • Analytics Cookies: Help us understand how users interact with the Service, allowing us to improve functionality. We use these only with your consent.
  • Preference Cookies: Remember your settings and preferences to provide a personalised experience.

You can manage cookie preferences through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling cookies may affect the functionality of certain parts of the Service.

10. Children's Privacy

The Service is not intended for or directed at individuals under the age of 18 ("Children"). We do not knowingly collect personal data from Children. If we become aware that a Child has provided us with personal data without verifiable parental consent, we will take prompt steps to delete such data from our systems. If you are a parent or guardian and believe your Child has provided us with personal data, please contact us immediately.

11. International Data Transfers

Your personal data is primarily stored and processed on servers located within the Federal Republic of Nigeria. In certain circumstances, we may transfer your data to service providers located outside Nigeria for purposes such as cloud hosting, analytics, or customer support. Where such transfers occur, we ensure that:

  • The recipient country provides an adequate level of data protection as determined by the NDPC;
  • Appropriate safeguards are in place, such as standard contractual clauses approved by the NDPC;
  • The transfer is necessary for the performance of our contract with you or for your benefit.

By using the Service, you consent to the transfer of your personal data to countries outside Nigeria in accordance with this Policy.

12. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time at our sole discretion. Material changes will be communicated to you via email to the address associated with your account or through a prominent notice on the Service at least 30 days before the changes take effect. The "Last updated" date at the top of this Policy indicates when it was last revised.

Your continued use of the Service after any modifications to this Privacy Policy constitutes your acceptance of the revised Policy. If you do not agree to the revised Policy, you must stop using the Service and close your account.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, or if you wish to exercise any of your data protection rights, please contact us:

  • Email: [email protected]
  • Phone: +234 800 000 0000
  • Address: 1, Example Street, Lagos, Nigeria