Payefy | Nigeria's Premier Student Finance Platform

1. Preamble and Scope

This Privacy Policy ("Policy") governs the collection, processing, use, and disclosure of Personal Data by Payefy ("Payefy", "we", "us", "our") in connection with your use of our web platform, mobile applications, and API services (collectively, the "Services"). This Policy is legally binding and has been drafted in strict adherence to theNigeria Data Protection Regulation (NDPR) 2019, the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, and principles outlined in the General Data Protection Regulation (GDPR).

2. Definition of Terms

"Data Subject" refers to any living individual who can be identified, directly or indirectly, by an identifier such as a name, ID number, location data, or online identifier.
"Personal Data" means any information relating to an identified or identifiable natural person.
"Processing" means any operation or set of operations performed on personal data, such as collection, recording, storage, retrieval, use, disclosure, or erasure.
"Data Controller" refers to Payefy, the entity that determines the purposes and means of processing personal data.

3. Information We Collect

To provide our specialized academic financial services, we collect specific categories of data:

A. Identity Data (KYC)
Full Legal Name, Matriculation Number (mandatory for Students), Faculty, Department, Level, Staff ID (for Excos), Date of Birth, BVN (Bank Verification Number), and NIN (National Identity Number).

B. Financial Data
Bank Account Name, Account Number, Bank Name, Transaction History, Wallet Balance, and Payment References.
CRITICAL: We do NOT store Debit Card PANs (Primary Account Numbers), CVVs, or PINs. All card data is tokenized and processed via PCI-DSS Level 1 compliant gateways (Paystack/Flutterwave).

C. Technical & Device Data
Internet Protocol (IP) address, login timestamps, browser type/version, time zone setting, browser plug-in types, operating system, device UUID, and geolocation data (used strictly for fraud prevention).

4. Lawful Basis for Processing

We process your data based on the following legal grounds:

Performance of Contract: To fulfill our obligation to process your tuition/dues payments and generate valid receipts.
Legal Obligation: To comply with CBN (Central Bank of Nigeria) mandates regarding KYC (Know Your Customer) and AML (Anti-Money Laundering).
Legitimate Interest: To improve our algorithms, detect fraud, and ensure the security of the campus financial network.

5. Data Retention and Destruction

We retain Personal Data only for as long as necessary.

Transactional Data: Retained for a minimum of 7 years post-transaction, in compliance with the Money Laundering (Prohibition) Act.
Account Data: Retained for the duration of your studentship plus 2 years after graduation/exit to facilitate alumni clearance verification.

Upon expiration of the retention period, data is securely destroyed using industry-standard overwriting protocols or permanently anonymized.

6. Data Sovereignty and International Transfers

Your data resides primarily in secure data centers located within the African continent. However, for redundancy, encrypted backups may be stored in AWS (Amazon Web Services) regions in Europe. Payefy ensures that any cross-border transfer complies with the NDPR and protects your data rights via Standard Contractual Clauses (SCCs).

7. Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms, Payefy will notify the relevant supervisory authority (NITDA) within 72 hours of becoming aware of the breach. Affected Data Subjects will also be notified without undue delay.

Privacy Policy