Privacy Policy

VixoPay is operated by VixoPay Technologies, Okigwe Road, Owerri, Imo State, Nigeria. We are the data controller for the personal data described here.

Our Data Protection Officer can be reached at dpo@vixopay.ng. We aim to respond to any data protection request within 30 days.

This policy is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation 2019 (NDPR).

• Account details — name, email address, phone number.
• Verification data — where required, government ID and Bank Verification Number (BVN).
• Transaction data — what you bought, when, the amount, the recipient number or meter, and the result.
• Technical data — device type, browser, IP address and app usage, used for security and fraud prevention.

The NDPA requires us to state the legal ground for each purpose, not just list the purposes:

• Providing the service you asked for (processing a top-up, running your wallet) — performance of our contract with you.
• Identity verification, fraud monitoring and AML checks — compliance with a legal obligation.
• Securing accounts and investigating abuse — our legitimate interest in running a safe service.
• Marketing messages — your consent, which you can withdraw at any time without affecting the service.

The NDPA requires recipients to be identifiable, so we name them rather than referring to “trusted partners”:

• PalmPay — our payment partner, which processes payments and holds wallet balances.
• Network operators and billers — MTN, Glo, Airtel, 9mobile, cable providers and electricity discos receive the phone number, meter number or account reference needed to fulfil your purchase.
• Vercel Inc. — hosts the application.
• Regulators and law enforcement — where we are legally required to disclose.

We do not sell your personal data.

Some of our infrastructure providers, including Vercel, process data on servers outside Nigeria, principally in the United States. The NDPA requires an adequate legal basis for such transfers. [The transfer mechanism relied on — adequacy, standard contractual clauses, or another NDPA basis — is to be confirmed with counsel and stated here.]

“As long as necessary” is not a retention policy, so the actual periods belong here:

• Transaction records — retained for the minimum period required of financial records under Nigerian law. [Period to be confirmed.]
• Identity and BVN records — retained for the period required by AML rules after your account closes. [Period to be confirmed.]
• Account details — deleted on request once no legal retention obligation applies.

Under the NDPA you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Have your data deleted, where no legal obligation requires us to keep it
• Object to processing based on legitimate interest
• Ask us to restrict processing while a dispute is resolved
• Receive your data in a portable format
• Withdraw consent at any time, where consent is the basis

Exercise any of these by emailing dpo@vixopay.ng. We respond within 30 days.

If you are unhappy with how we have handled your personal data, you can complain to the Nigeria Data Protection Commission (NDPC). You do not need our permission, and you can complain to the NDPC whether or not you have raised it with us first — though we would rather have the chance to put it right.

Traffic is encrypted in transit. Every payment requires your 4-digit PIN. Card details are handled by our payment partner and are not stored on VixoPay servers. No system is perfectly secure, so we also monitor for unusual activity and will act on it.

The NDPA requires us to notify the NDPC within 72 hours of becoming aware of a personal data breach that presents a risk to you. Where the risk to you is high, we will also tell you directly and explain what to do.

We use cookies and local storage to keep you signed in, remember your theme choice, and understand how the app is used. [A cookie consent mechanism is not yet implemented, so this section must be revisited before any non-essential or analytics cookies are set.]

VixoPay is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, email dpo@vixopay.ng and we will delete it.

When this policy changes, the “Last updated” date at the top of the page changes with it. Where a change materially affects your rights, we will tell you in the app or by email.