Veira Pay Privacy Policy

01Scope

1.1 This Policy applies to personal data we process when you visit our website, register for or use Veira Pay, communicate with us, or otherwise interact with the Service.

1.2 It should be read together with the Veira Pay Terms of Use.

1.3 Veira Pay is delivered principally through WhatsApp. This Policy covers the personal data we receive and process when you message our business account through the WhatsApp Business Platform.

1.4 It does not cover WhatsApp itself, or your WhatsApp account, which are operated by Meta Platforms under its own privacy policy. Deleting data held by us does not delete data held by Meta.

02Personal data we collect

2.1 Identity and contact data. Full name, date of birth, gender, nationality, residential and business address, email address, phone number, WhatsApp number, and photograph or selfie where required for verification.

2.2 Identity verification data. National Identification Number, Bank Verification Number, Tax Identification Number, company registration details for business accounts, and the results of verification, sanctions, politically exposed person and fraud checks.

2.3 Identity document data. An image of a government-issued identity document, captured by camera or uploaded. Accepted documents include passports, national identity cards, driver's licences and residence permits. We process the data read from the document by optical character recognition, together with the outcome of document authenticity and document-liveness analysis.

2.4 Facial image and biometric data. Depending on the verification route presented to you:

1. (a) a photograph of your face, which in the document-capture route is taken by your device's front camera during capture without a separate shutter action, and in the biometric route is a live selfie;
2. (b) the outcome of passive liveness analysis, which assesses whether the photograph is of a live person rather than a reproduction;
3. (c) the outcome of a one-to-one facial comparison between your photograph and the portrait on your identity document, or a stored or supplied reference portrait; and
4. (d) the outcome of a face-search check, which compares your facial image against facial images already held in the verification provider's system in order to detect duplicate or fraudulent registrations.

The facial templates and comparison scores generated by these checks are biometric data, which is sensitive personal data under the Nigeria Data Protection Act 2023. Clause 4A explains the basis on which we process it.

2.5 Financial and transaction data. Bank account details, settlement account details, transaction amounts, dates, references, counterparties, descriptions of goods and services, delivery status, fees, and account balances held with our Partner Institutions.

2.6 Dispute data. Evidence submitted in a dispute, including photographs, delivery records, screenshots and correspondence between buyer and seller.

2.7 Communications data. Records of your contact with our support team by email, phone, chat or messaging channel, including call recordings where we notify you that a call is recorded.

2.8 Technical and usage data. IP address, device identifiers, device and operating system type, browser type, language settings, approximate location derived from IP address, login records, pages and features used, and timestamps.

2.9 WhatsApp interaction data. Your WhatsApp sender identifier and display name, the content of messages you send to our business account, message identifiers, timestamps, and delivery and read status. Our command-processing system records recognised commands and the related processing records rather than a complete transcript of every message.

2.10 Cookie data. As described at clause 11.

Apart from the biometric data described at clause 2.4, we do not intentionally collect sensitive personal data such as data revealing health, religious belief, political opinion or trade union membership. Please do not submit such data to us unless we specifically request it.

Please do not send your Bank Verification Number, National Identification Number, identity documents, passwords, PINs or payment card details in a WhatsApp message. Use the secure verification channel we direct you to. We will never ask you for a password or PIN.

03How we collect personal data

3.1 Directly from you, when you register, complete verification, create or fund a transaction, raise a dispute, or contact us.

3.2 From other users, where a counterparty creates a transaction naming you, or submits evidence in a dispute involving you.

3.3 Automatically, through cookies and similar technologies when you use our website or dashboard.

3.4 From third parties, including identity and KYC verification providers, our banking infrastructure partner and its underlying licensed financial institutions, credit and fraud prevention agencies, sanctions and watch list databases, the Nigeria Inter-Bank Settlement System, and publicly available registers including those of the Corporate Affairs Commission.

04Why we process personal data, and our lawful bases

Under section 25 of the Nigeria Data Protection Act 2023, we rely on the following lawful bases.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may ask us for information about that assessment.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before withdrawal.

4A. Biometric data

4A.1 Biometric data is sensitive personal data under the Nigeria Data Protection Act 2023 and attracts additional protection.

4A.2 We process the biometric data described at clause 2.4 on the basis of your explicit consent, given at the point of verification, and because the processing is necessary for compliance with our legal obligations relating to customer identification under Nigerian anti-money laundering law.

4A.3 Biometric checks are carried out by our verification provider. We receive the outcome of those checks and the associated identity and image data returned by the provider.

4A.4 You may withdraw consent to biometric processing at any time by contacting hello@veirapay.com. Because identity verification is a condition of holding a verified account, withdrawal will mean we can no longer provide a verified account to you, and your account will be closed in accordance with clause 10. Records we are legally required to retain will be retained as described at clause 7.

4A.5 We do not use your facial image or biometric data for advertising, profiling unrelated to verification and fraud prevention, or training generalised facial recognition models.

05Who we share personal data with

5.1 The other party to your transaction. A buyer and a seller in the same transaction will see limited details of one another, which may include the display name, business name, transaction details and delivery information reasonably needed to complete the transaction and resolve any dispute.

5.2 Meta Platforms, operator of the WhatsApp Business Platform, in order to receive and respond to your messages and to process messaging events.

5.3 Anchor Software Ltd, our banking-as-a-service partner, and the licensed financial institutions behind it, in order to create and maintain customer and account records, open and operate the accounts in which funds are held, and move and settle funds.

5.4 Didit, our identity verification provider, in order to operate verification sessions and return their outcomes. Depending on the verification route, the checks configured include optical character recognition of a government-issued identity document, document authenticity and document-liveness analysis, capture of a facial photograph, passive liveness analysis, one-to-one comparison of that photograph against the document portrait or a stored reference portrait, face-search comparison against facial images held in the provider's system, and, for the anti-money laundering routes, sanctions and politically exposed person screening. Business accounts are additionally verified against company-registry records and corporate documents evidencing legal presence and ownership structure.

5.5 Fraud prevention and screening providers, in order to screen accounts and transactions against sanctions, watch list and fraud data.

5.6 Technology and operational service providers, including cloud hosting, database, storage, email, communications, analytics, customer support and security providers, acting as data processors under written contract on our instructions. You may request the current list of these providers at any time by emailing hello@veirapay.com.

5.7 Professional advisers, including lawyers, auditors, accountants and insurers, where necessary.

5.8 Regulators, law enforcement, courts and government authorities, including the Central Bank of Nigeria, the Nigeria Data Protection Commission, the Nigerian Financial Intelligence Unit, the Economic and Financial Crimes Commission, the Federal Inland Revenue Service and the Corporate Affairs Commission, where we are required or lawfully permitted to disclose.

5.9 A successor, in connection with a merger, acquisition, financing or sale of assets, subject to appropriate confidentiality and data protection safeguards.

Where a transaction involves another participant, the deal information reasonably needed to provide the service is made available to that participant. Private conversations between you and us are not forwarded to other customers.

Each provider also processes personal data under its own privacy notice, which should be read alongside this Policy.

We do not sell personal data.

06Transfers outside Nigeria

6.1 Some of our service providers, including cloud hosting, messaging and verification providers, store or process personal data outside Nigeria.

Processing and storage locations: our providers process and store personal data in Nigeria and outside Nigeria. We will publish the specific countries and regions in the next update of this Policy. You may request the current list at any time by emailing hello@veirapay.com.

6.2 We transfer personal data outside Nigeria only where permitted under Part IX of the Nigeria Data Protection Act 2023, that is:

1. (a) where the recipient country, sector or organisation is subject to an adequate level of protection; or
2. (b) where an appropriate safeguard is in place, including contractual clauses binding the recipient to standards equivalent to those in the Act; or
3. (c) where a permitted derogation applies, including where the transfer is necessary for performance of a contract with you, or you have consented after being informed of the risk.

6.3 You may request further information about the safeguards applied to a particular transfer by contacting us at hello@veirapay.com.

07How long we keep personal data

7.1 We keep personal data only for as long as necessary for the purposes for which it was collected.

7.2 Where the law prescribes a retention period, we apply it. In particular, records relating to customer identification and transactions are retained for at least five years after the end of the customer relationship or the date of the transaction, in line with Nigerian anti-money laundering requirements.

7.3 Our retention periods by category are:

7.4 Records may be retained for longer where necessary for an ongoing investigation, dispute, regulatory enquiry or legal claim.

7.5 Where information must be retained after your account closes or after a deletion request, we will tell you what is retained, why, and for how long.

7.6 Identity document images and facial images are deleted 12 months after verification. The outcome of the verification, including the checks performed, the result and the date, is retained for the anti-money laundering period described at clause 7.2, so that we can evidence that you were properly verified without continuing to hold your images.

7.7 Where a backup copy still contains personal data that has been deleted from our live systems, that copy is not restored into live use and is overwritten on the cycle stated above.

7.8 When personal data is no longer required, we delete it or irreversibly anonymise it.

08Security

8.1 We apply technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, access controls on a least-privilege basis, multi-factor authentication for administrative access, logging and monitoring, secure development practices, vendor due diligence, and staff confidentiality obligations and training.

8.2 We do not store full card numbers. Card and account credentials are handled by our Partner Institutions and their payment processors.

8.3 No system is entirely secure. You must protect your own credentials and devices, and tell us immediately at support@veirapay.com if you suspect unauthorised access to your account.

8.4 Where a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and will notify you where the breach is likely to result in a high risk to you.

09Your rights

9.1 Under the Nigeria Data Protection Act 2023 you have the right to:

1. (a) be informed about how your personal data is processed;
2. (b) request access to the personal data we hold about you;
3. (c) request correction of inaccurate or incomplete data;
4. (d) request deletion of your data where there is no lawful ground for us to continue holding it;
5. (e) request restriction of processing in certain circumstances;
6. (f) object to processing carried out on the basis of legitimate interests, and to object at any time to direct marketing;
7. (g) receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible;
8. (h) withdraw consent where processing is based on consent; and
9. (i) not be subject to a decision based solely on automated processing that produces a legal or similarly significant effect, without the right to human review.

9.2 You may withdraw consent to biometric processing as described at clause 4A.4.

9.3 These rights are not absolute. We may be unable to delete or stop processing data that we are legally obliged to retain, in particular identity and transaction records held for anti-money laundering purposes.

9.4 To exercise a right, contact hello@veirapay.com. We will respond within 30 days. We may ask you to verify your identity before acting on a request. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee or decline it, and will explain why.

10Requesting account closure or data deletion

10.1 To close your account or request deletion of your personal data, email hello@veirapay.com with the subject line:

Veira Pay Data Deletion Request

10.2 Include your account reference or the contact details registered to your account so that we can locate your records. Do not include your BVN, NIN, passwords, PINs or full financial account details in the request.

10.3 We may take proportionate steps to verify that the request comes from the account holder before disclosing or deleting information.

10.4 We respond within 30 days. Where an open transaction, an unresolved dispute, or a legal or regulatory obligation requires us to retain records, we will tell you what is retained, why, and for how long. Identity and transaction records subject to anti-money laundering retention cannot be deleted on request.

10.5 A request to Veira Pay does not delete your WhatsApp account, messages retained by the person you were transacting with, or records independently controlled by a provider. We can tell you which provider to contact separately.

11Cookies and similar technologies

11.1 We use cookies and similar technologies on our website and dashboard.

11.2 Strictly necessary cookies enable core functions such as authentication, session management, load balancing and security. These are set without consent because the Service cannot operate without them.

11.3 Analytics and performance cookies help us understand how the Service is used. Preference cookies remember your settings. These are set only with your consent.

11.4 You can manage your preferences through the cookie banner or in your browser settings. Blocking strictly necessary cookies may prevent parts of the Service from working.

12Automated decision-making

12.1 We use automated processing to interpret supported WhatsApp commands, to handle provider events, and to screen transactions and accounts for fraud, money laundering and sanctions risk. Verification outcomes received from our providers can affect whether your account is available, and may result in a transaction being delayed or declined or an account being restricted pending review.

12.2 Where an automated decision significantly affects you, you may request human review by contacting hello@veirapay.com, express your point of view, and contest the decision. Certain outcomes required by law, including sanctions matches, cannot be reversed by us.

13Children

13.1 The Service is not intended for anyone under 18. We do not knowingly collect personal data from children.

13.2 If we learn that we have collected personal data from a person under 18, we will delete it and close any associated account. Contact hello@veirapay.com if you believe this has occurred.

14Marketing

14.1 We will send you marketing about Veira Pay only where you have consented.

14.2 You can opt out at any time using the unsubscribe link in any marketing message, by replying STOP to a marketing SMS, or by contacting hello@veirapay.com.

14.3 We will continue to send service messages relating to your account, your transactions and changes to our terms. These are not marketing and cannot be opted out of while your account is open.

15Data protection contact

Enquiries and requests relating to this Policy should be sent to:

Data Protection Officer (interim), Veira Africa Ltd
No. 10 Ogombo Road, Abraham Adesanya, Lekki-Epe, Lagos, Lagos State, Nigeria
Email: hello@veirapay.com

16Complaints

16.1 If you are dissatisfied with how we have handled your personal data, please contact us first at hello@veirapay.com so that we can try to resolve the matter.

16.2 You also have the right to lodge a complaint with the Nigeria Data Protection Commission, No. 6 Nairobi Street, off Aminu Kano Crescent, Wuse II, Abuja.

17Changes to this Policy

17.1 We may update this Policy. The current version will always be available at veirapay.com/privacy.

17.2 Where a change is material, we will notify you by email, in-app notification or notice on our website before it takes effect.