This policy explains how Sofapay (“we”, “us”) handles personal data when you use our website, dashboard, API and checkout, whether you're a merchant using Sofapay or a customer paying a merchant. We process personal data in line with the Nigeria Data Protection Act 2023 and the regulations of the Nigeria Data Protection Commission (NDPC).
What we collect
From merchants
- Account details: name, email address, phone number and password (stored only as a secure hash by our authentication provider).
- Business verification (KYB) information: business name, type, registration number, address and documents such as a CAC certificate, government ID and proof of address.
- Settlement bank account details.
- Records of your activity: payments, refunds, payouts, disputes, API requests and security events such as sign-ins.
From customers paying a merchant
- The details the merchant asks for at checkout, typically name, email address and phone number.
- Payment information needed to complete the payment. Card details are handled by our licensed processing partners and are not stored by Sofapay.
- Transaction records: amount, method, time and outcome.
Automatically
- Technical data such as IP address, browser type and request logs, used to run the service securely.
- Essential cookies that keep you signed in. We don't use advertising cookies.
How we use it
- To provide the service: process payments, settle funds, send payouts and notifications.
- To verify merchants and meet our legal obligations, including anti-money-laundering and know-your-customer requirements.
- To detect and prevent fraud, abuse and security incidents.
- To support you and improve Sofapay.
- To send product updates if you've subscribed. You can unsubscribe at any time.
Our lawful bases are performance of a contract, compliance with legal obligations, our legitimate interests (such as fraud prevention), and your consent where we ask for it.
Who we share it with
- The merchant you're paying, who receives your payment and the details they asked for.
- Licensed banks and payment processors that move the money.
- Service providers that host and run Sofapay on our behalf, under contracts that protect your data.
- Regulators, law enforcement or courts when the law requires it.
We don't sell personal data. Where data is transferred outside Nigeria, we do so only with the safeguards the NDPA requires.
How long we keep it
We keep personal data only as long as we need it for the purposes above. Financial and verification records are kept for as long as the law requires, typically at least five years after the end of the relationship.
How we protect it
Encryption in transit and at rest, strict access controls enforced in our database, two-factor authentication and audit logging. See our Security page.
Your rights
Under the NDPA you can ask to access, correct or delete your personal data, object to or restrict certain processing, receive your data in a portable format, and withdraw consent. Some data must be kept to meet legal obligations. If you're a customer of a merchant, you can also contact that merchant. You may complain to the Nigeria Data Protection Commission.
Contact
For privacy questions or requests, use our contact form.