BPAYEX GLOBAL PRIVACY POLICY
Effective date: 1st May 2026
Last updated: 1st May 2026
This Privacy Policy explains how Bpayex Digital Solution Limited (“Bpayex”, “we”, “our” or “us”) collects, uses, stores, shares and protects personal information when you use the Bpayex mobile application, websites, business portal, APIs and related products and services (collectively, the “Services”).
Bpayex is committed to handling personal information responsibly and in accordance with applicable privacy and data-protection laws, including, where applicable, the Nigeria Data Protection Act 2023, UK GDPR, EU GDPR, applicable United States state privacy laws, PIPEDA, POPIA and other applicable privacy legislation.
This Privacy Policy should be read together with our Terms of Service, Product Terms, Business Terms and Cookie Policy.
1. Who controls your information?
The entity responsible for determining how personal information collected through the Services is processed is:
Bpayex Digital Solution Limited
Registered office: B39B Chessville Estate, Kafe District, FCT, Nigeria.
Company registration number: 9231787
Email: support@bpayex.com
Compliance and regulatory enquiries: compliance@bpayex.com
Where a Bpayex service is provided through a regulated bank, payment service provider, card issuer, digital-asset provider or other partner, that partner may also act as an independent data controller under its own privacy policy.
2. Information we collect
The information we collect depends on the Services you use.
2.1 Information you provide to us
- Full name;
- Username and Bpayex account identifier;
- Email address;
- Telephone number;
- Residential or business address;
- Nationality;
- Country of residence;
- Date of birth;
- Occupation or business information;
- Password and authentication information;
- Security questions and account-recovery information;
- Bank-account details;
- Payment-method information;
- Cryptocurrency wallet addresses;
- Beneficiary and recipient information;
- Transaction details;
- Communications with customer support;
- Information submitted through surveys, promotions or referral programmes.
2.2 Identity and verification information
To meet legal, regulatory, fraud-prevention and security obligations, we may collect information such as:
We collect such information only where appropriate for the Services provided and applicable law.
- National Identification Number or similar government identifiers;
- Bank Verification Number where applicable;
- Passport;
- National identity card;
- Driving licence;
- Proof of address;
- Tax or business registration information;
- Photograph or selfie;
- Liveness or facial-verification results where identity verification requires them;
- Source-of-funds or source-of-wealth information;
- Occupation or employment information.
2.3 Financial and transaction information
When you use Bpayex to make payments, exchange currencies, buy or sell supported digital assets, pay bills, purchase airtime or other services, we may process:
We may be legally required to retain some transaction and identity information after an account is closed.
- Amount and currency;
- Sender and recipient information;
- Beneficiary information;
- Wallet addresses;
- Payment references;
- Bank or payment account information;
- Transaction status;
- Exchange rates and fees;
- Transaction history;
- Merchant information;
- Device and authentication information connected with the transaction.
2.4 Information collected automatically
When you access Bpayex, we may automatically collect:
We do not intentionally collect persistent device identifiers such as IMEI or SIM serial numbers unless expressly permitted by law and platform policy for a necessary function.
- IP address;
- Device model;
- Operating system and version;
- App version;
- Browser type;
- Device or app identifiers;
- Language and regional settings;
- Network and mobile-carrier information;
- Login dates and times;
- Pages and features used;
- Application interactions;
- Crash information;
- Diagnostic information;
- Security events;
- Fraud-risk signals.
3. Device permissions
Depending on the functionality you use, Bpayex may request access to certain device features.
3.1 Camera
We may request camera access so that you can:
- Photograph identity documents;
- Take a verification selfie;
- Scan QR codes;
- Upload documents required for a transaction or verification process.
3.2 Photos and files
Where necessary, you may choose documents or images for identity verification or customer support.
Bpayex should use privacy-preserving system files or photo pickers wherever technically practical rather than requesting unrestricted access to your photo library.
3.3 Location
We may process approximate or precise location where necessary for:
Where possible, you may be offered an alternative method of providing your location.
- Fraud prevention;
- Security;
- Regulatory restrictions;
- Determining whether a regulated service is available in your jurisdiction.
3.4 Notifications
With your permission, Bpayex may send push notifications about:
You can manage notification permissions through your device.
- Transactions;
- Account security;
- Service alerts;
- Verification;
- Products and promotions where permitted.
3.5 Contacts
Bpayex does not access your entire device contact list unless a feature clearly requires it and you expressly authorise that access.
Where possible, Bpayex should use a limited contact-picker experience instead of unrestricted address-book access.
3.6 SMS and call logs
Bpayex does not require unrestricted access to users’ SMS messages or call logs for ordinary authentication.
Where supported, one-time-code verification should use privacy-preserving platform mechanisms rather than reading users’ SMS inboxes.
4. Why we process your information
We may use personal information to:
- Create and administer your account;
- Verify your identity;
- Perform Know Your Customer or Know Your Business checks;
- Provide wallets, payments and other requested Services;
- Process deposits and withdrawals;
- Facilitate transfers;
- Process supported digital-asset transactions;
- Provide currency conversion;
- Process bill payments, airtime, data, gift cards and other supported products;
- Issue or administer payment products provided with authorised partners;
- Detect and prevent fraud;
- Protect accounts and systems;
- Investigate suspicious transactions;
- Comply with anti-money-laundering, counter-terrorist-financing, sanctions and other laws;
- Conduct transaction monitoring;
- Respond to regulators and lawful government requests;
- Provide customer support;
- Communicate important account information;
- Improve reliability and performance;
- Perform analytics;
- Troubleshoot technical issues;
- Enforce our agreements;
- Resolve disputes;
- Provide promotions where permitted;
- Comply with legal obligations.
5. Legal bases for processing
Where laws such as the GDPR or UK GDPR apply, we generally rely on one or more of the following legal bases:
Contract: Processing necessary to provide the Services you request.
Legal obligation: Processing required by anti-money-laundering, sanctions, accounting, tax, fraud-prevention or other laws.
Legitimate interests: Processing reasonably necessary to protect Bpayex, our customers and our systems; improve Services; prevent fraud; and operate our business, provided those interests do not override your rights.
Consent: Processing based on your permission, such as certain marketing, device permissions or optional features.
You may withdraw consent where consent is the applicable legal basis. Withdrawal does not make previous lawful processing unlawful.
6. Automated fraud and compliance checks
Bpayex and our service providers may use automated systems to identify:
- Suspicious transactions;
- Unusual account behaviour;
- Fraud patterns;
- Security threats;
- Sanctions or compliance risks.
A transaction may consequently be delayed, rejected, restricted or referred for human review.
Where applicable law provides rights relating to significant automated decisions, you may contact us to exercise those rights.
7. Who we may share information with
We may share information where necessary with:
- Courts;
- Law-enforcement agencies;
- Regulators;
- Tax authorities;
- Financial-intelligence authorities;
- Other government bodies.
Financial-service partners:
Including banks, payment processors, payment institutions, card issuers, settlement providers and other financial institutions involved in delivering a transaction.
Digital-asset providers:
Including liquidity providers, exchanges, custody providers, blockchain infrastructure providers and wallet-service providers where necessary to provide digital-asset Services.
Identity and compliance providers:
Including identity-verification, KYC, KYB, sanctions-screening, AML, transaction-monitoring and fraud-prevention providers.
Product fulfilment providers:
Including telecommunications providers, bill-payment providers, gift-card suppliers and other providers necessary to fulfil a product purchased through Bpayex.
Technology providers:
Including hosting, cloud infrastructure, security, communication, analytics, customer-service and technical-support providers.
Professional advisers:
Including accountants, auditors, insurers and legal advisers.
Authorities:
We may disclose information where required or permitted by law to:
Corporate transactions: Information may be transferred as part of a merger, financing, acquisition, restructuring or sale of all or part of our business, subject to appropriate confidentiality and legal safeguards.
8. Sale of personal information and advertising
Bpayex does not sell customers’ identity, financial, payment or government-identification information.
We do not use sensitive financial, identification or verification information for behavioural advertising.
Where our websites use optional advertising or marketing technologies, we will provide required choices and consent mechanisms under applicable law.
If the mobile application introduces advertising or tracking technologies in the future, Bpayex will update its privacy disclosures and obtain any permissions required by Google Play, Apple and applicable law before using them.
9. International transfers
Bpayex and its service providers may process information in countries other than the country in which you live.
When personal information is transferred internationally, we take appropriate measures required by applicable law. These may include:
- Contractual safeguards;
- Standard contractual clauses;
- Adequacy mechanisms;
- Transfer-risk assessments;
- Agreements imposing appropriate data-protection obligations;
- Other legally recognised transfer safeguards.
For transfers of personal data outside Nigeria, we apply the safeguards required by the Nigeria Data Protection Act 2023, including an applicable adequacy decision, contractual safeguards, consent, or another lawful transfer mechanism recognised under that Act.
10. Security
We use organisational and technical security safeguards appropriate to the sensitivity of the information processed.
These may include:
- Encryption in transit;
- Encryption or other appropriate protection for stored sensitive information;
- Access controls;
- Multi-factor authentication;
- Secure credential management;
- Monitoring and logging;
- Network security controls;
- Fraud-detection systems;
- Security testing;
- Employee confidentiality controls;
- Vendor-security assessments;
- Incident-response procedures.
No online system can guarantee absolute security.
You are responsible for keeping your password, PIN, authentication codes and other security credentials confidential.
11. Data retention
We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy or as required by law.
Some information may need to be retained after account closure, particularly:
- Identity-verification records;
- AML/KYC records;
- Transaction information;
- Accounting records;
- Tax records;
- Fraud-prevention records;
- Dispute and complaint records;
- Information subject to litigation or regulatory preservation requirements.
Where there is no continuing need or legal requirement to retain information, we will delete, anonymise or securely isolate it.
12. Your privacy rights
Depending on your country, you may have rights to:
- Know whether we process your information;
- Access your information;
- Receive a copy of certain information;
- Correct inaccurate information;
- Request deletion;
- Restrict certain processing;
- Object to certain processing;
- Withdraw consent;
- Request portability;
- Object to certain direct marketing;
- Complain to an appropriate data-protection regulator.
Some rights are subject to exceptions.
For example, we may be unable to delete information that applicable AML, tax or financial-services laws require us to retain.
To make a privacy request, contact: support@bpayex.com We may need to verify your identity before completing a request.
13. Account deletion
You may request deletion of your Bpayex account directly through the Bpayex application.
Recommended in-app path:
Settings → Account & Privacy → Delete Account
You may also request account deletion through:
https://bpayex.com/delete-account
When an account deletion request is completed:
- access to the account will end;
- personal information that is not required to be retained will be deleted or anonymised;
- legally required records may be retained for the applicable statutory period;
- retained information will no longer be used for ordinary account operation or marketing.
Account deactivation is not treated as a substitute for an account-deletion request.
14. Marketing communications
Where permitted by law, Bpayex may send information about new products, offers and promotions.
You may unsubscribe from marketing communications at any time.
You may still receive essential messages concerning:
- Security;
- Transactions;
- Legal changes;
- Account administration;
- Service interruptions.
15. Children
Bpayex Financial Services are intended for persons 18 years of age or older, unless a specific product expressly states otherwise and is lawfully offered to younger users.
We do not knowingly offer ordinary Bpayex financial accounts to children under 18.
If we become aware that information was collected from an ineligible minor, we may take appropriate steps to restrict the account and delete the information unless retention is required by law.
Where a specific product is lawfully offered to a younger user, we will process that user's personal data only with verifiable parental or guardian consent and any other safeguard required by the Nigeria Data Protection Act 2023 and other applicable law.
16. Third-party links and services
The Services may contain links to or integrations with third-party services.
Their handling of personal information is governed by their own terms and privacy policies.
17. Cookies and similar technologies
Our websites use cookies and similar technologies as explained in our Cookie Policy.
Our mobile applications may use SDKs, local device storage and similar technologies for authentication, security, analytics and functionality.
18. Changes to this Privacy Policy
We may update this Privacy Policy to reflect:
- New Services;
- Regulatory developments;
- Changes in our processing practices;
- Security improvements.
The current version will display its effective date.
For material changes, we may provide additional notice through the app, website or email where appropriate.
19. Contact us
For privacy questions, requests or complaints:
Bpayex Digital Solution Limited
Email: support@bpayex.com
Compliance and regulatory enquiries: compliance@bpayex.com
Registered address: B39B Chessville Estate, Kafe District, FCT, Nigeria.
If applicable, you may also lodge a complaint with the data-protection regulator responsible for your jurisdiction.
You may also contact our Data Protection Officer at: dpo@bpayex.com
If you are in Nigeria and are dissatisfied with our response, you may complain to the:
Nigeria Data Protection Commission (NDPC):
Website: https://ndpc.gov.ng;
Email: info@ndpc.gov.ng;
Address: No. 12 Clement Isong Street, Asokoro, Abuja, Nigeria.