Privacy Policy

This notice explains how YOMPAY LIMITED ("Yompay", "we", "us") collects and uses personal data under the Nigeria Data Protection Act 2023 (NDPA). It covers the Yompay mobile app, this website ( yompay.com.ng), and related services.

1. Who we are

The data controller is YOMPAY LIMITED, a private company limited by shares, RC 8121161, registered office 19, University Road, Yaba, Abule-Oja, Lagos State, Nigeria.

Yompay is not a bank. Wallet accounts are provided by 9 Payment Service Bank Limited.

Our Data Protection Officer is Musiliu Abayomi Azeez. Contact: [email protected].

2. Data we collect

Account

• Phone number, email address, and name
• Passcode, transaction PIN, and device-trust information
• Referral codes you enter

Identity and KYC

• BVN, NIN, date of birth, gender, and address
• Photos of identity documents and proof of address
• Next-of-kin name and phone number
• Politically exposed person (PEP) declaration, relationship to a public function, office, and supporting documents if we ask for them

Biometrics

Face liveness and ID matching for KYC are processed by our identity partner (Dojah). That is separate from Face ID or fingerprint on your phone, which stay on the device and are used only to unlock the app if you turn that setting on.

Transactions and wallet

• Amounts, dates, recipients, bill references, and status
• Dedicated account details issued for your wallet, and funding method (transfer, card, USSD)

Technical and support

• Device type, OS, app version, IP address, and crash logs
• Messages you send to support

We do not use website cookies in the mobile app. This website may use strictly necessary cookies to load pages securely. We do not run a marketing newsletter.

3. Why we use your data

We only use the bases allowed under the NDPA that apply to this product: contract, legal obligation, and consent. We do not rely on legitimate interest.

4. Sharing

We share data only as needed to provide the service or to comply with the law:

• 9 Payment Service Bank Limited: wallet accounts, identity used to open them, and payment instructions
• Dojah: BVN/NIN lookup, liveness, and related KYC
• Paystack: card funding
• Bill and airtime processors (for example electricity, cable, data, exam pins, and betting-wallet funding)
• Cloud hosting, SMS, and push notification providers
• FormSubmit (formsubmit.co): website Contact Us messages sent to our support inbox
• CBN, NFIU, law enforcement, or a court when Nigerian law requires it

5. Security

We protect data in transit with TLS, encrypt stored secrets where we control the store, restrict staff access, and use passcode, PIN, and optional device biometrics. We do not claim end-to-end encryption of wallet transactions: Yompay and 9 Payment Service Bank must see them to process and to meet AML rules.

6. Retention

We keep account, KYC, and transaction records for the life of the account and generally about seven years after closure, as required for CBN and anti-money-laundering record keeping. You cannot require us to erase those records while that legal hold applies. Optional marketing or analytics data is kept only while your consent is in place.

7. Your rights

Subject to the NDPA and financial-services law, you may ask us to:

• Access a copy of your personal data
• Correct inaccurate information
• Delete data that we are not required to keep (account closure does not wipe KYC or transaction records we must retain)
• Receive a portable copy by emailing the DPO (there is no in-app download button yet)
• Withdraw consent for marketing or optional analytics

Email [email protected] to exercise these rights. You may also complain to the Nigeria Data Protection Commission.

8. Children

Yompay is for people aged 18 and over. We do not knowingly create accounts for children. If we learn that we have, we will close the account.

9. Where we store data and international transfers

Yompay is a Nigerian company, but we do not house all personal data in Nigeria. Today:

• Primary application database: United States (AWS US East, N. Virginia)
• Application servers: South Africa
• Wallet accounts and related wallet records: 9 Payment Service Bank Limited
• Other processors (for example Dojah, Paystack, object storage, SMS, and push) may also handle data outside Nigeria

Where we transfer personal data abroad, we do so with safeguards required by the NDPA and the Nigeria Data Protection Commission (for example contractual protections and other approved mechanisms).

10. Breach notification

If a personal-data breach is likely to risk your rights, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, where the NDPA requires that, and we will tell affected users without undue delay when the risk is high.

11. Changes

We may update this notice. For material changes we will give at least 30 days' notice in the app or by email, and we will ask you to accept the new version before you continue to use Yompay.

12. Contact