2. What Personal Data do we collect?
We collect Personal Data about you when you use the services offered on our website and digital platform, including the following:
- Sign-up information: When you register to use the services offered on our digital platform, we will collect the Personal Data necessary to on-board you; including your name, email address, mobile number and debit card details. We may require you to provide additional, necessary personal details as you use our services.
- Transaction information: When you use our digital platform to send and receive money, make purchases from merchants, pay bills, deposit & withdraw cash, we collect information about the transaction, as well as other associated information; such as: the amount sent or received, amount paid for products or services, merchant information – including information about your device and geolocation.
- Participant Personal Data: When you use our services, we collect Personal Data about the other participants associated with the transaction, including your phone contacts so you can easily manage account transfers and to enable instant messaging (IM). We collect Personal Data such as name and financial account information about the participant who is receiving money from (or sending money to) you.
- Information from other sources: We may collect information from other sources, such as our social media platforms when you reach out to us to lodge a complaint about some our services. However, we will only ask for information relevant to the help required of us to you.
- Other information we collect related to your use of our website or Services: We may collect additional information from or about you when you communicate with us, contact our customer support teams or respond to a survey.
- When you apply for a job with us: We may request Personal Data about your education, employment and state of health. As part of your application, you will be asked to provide your express consent to our use of this information to assess your application and any monitoring activities which may be required of us under applicable laws as an employer.
We may also carry out screening checks (including reference, background and criminal record checks).
We may exchange your Personal Data with academic institutions, recruiters, health maintenance organisations, law enforcement agencies, referees and your previous employers.
Without your Personal Data, we may not be able to process your application for positions with us.
We do not collect the information of minors.
If you are under the age of 18, you are not eligible to use the service offered on our digital platform.
3. How Do We Retain Personal Data?
4. What do we do with your Personal Data?
We collect your personal data to provide you an efficient and secure customer experience. We process your information to:
- Provide services, including to:
- Initiate a payment, send or request money, or pay a bill
- Authenticate your access to an account
- Communicate with you about your account
- Manage risk, fraud and abuse of our services and prevent you from fraud (by developing and adopting measures of verifying your identity)..
- Comply with our legal and regulatory obligations and to enforce the terms of our sites and services, including to comply with all applicable laws and regulations.
- Trail information breach and remediate such identified breaches.
- Resolve disputes and troubleshoot problems.
- With your consent:
- Market OPay products and services to you.
We will not send unsolicited marketing communications to you by SMS or email if you have not opted in to receive them.
Additionally, you can withdraw your consent at any time and free of charge.
5. Sharing your Personal Data
We may share your Personal Data or other information about you with others for the following reasons:
- With other companies that provide services to us: We may share Personal Data with third-party service providers that perform services and functions at our direction and on our behalf. These third-party service providers may, for example, provide you with services, verify your identity, assist in processing transactions, send you advertisements for our products and services, or provide customer support. Rest assured that we make double sure that these companies have compliant, legal measures in place to ensure the confidentiality of your Personal Data.
- With other financial institutions: We may share Personal Data with other financial institutions that we have partnered with to only offer OPay-related services, unless your consent extends to other uses. We may also share Personal Data to process transactions and keep your financial information up to date.
- With the other parties to transactions when you use the services, such as other users and their service providers. This includes other users you are sending or receiving funds from and their service providers. The information might include:
- Personal Data and account information necessary to facilitate the transaction; and
- Personal Data to help other participant(s) resolve disputes and detect and prevent fraud.
- Where permitted or required by law. We may share information about you with other parties for OPay’s business purposes or as permitted or required by law, including:
- If we need to do so to comply with a court proceeding, other legal process or an applicable regulation;
- To law enforcement authorities or other government officials, or other third parties pursuant to a court order or other legal process or requirement applicable to OPay or an affiliated entity;
- Where we reasonably believe that the disclosure is necessary or appropriate to prevent an imminent physical harm or financial loss, or in connection with an investigation of suspected (or actual) illegal activity;
- With credit agencies and data processors for credit reference checks and anti-fraud and compliance purposes – all in accordance to applicable data privacy regulations and laws;
- To investigate violations of or enforce a user agreement or other legal terms applicable to any service;
- To protect our property, services and legal rights;
- As reasonably and legally permitted, to facilitate a purchase or sale of all or part of OPay’s business, or in the instance of some merger and acquisition;
- To support our audit, compliance, and corporate governance functions.
- With your consent: We also will share your Personal Data and other information with your consent or direction.
7. What Are Your Rights?
- Requests to Access, Rectify or Erase.
- Access Request
As permitted under law and applicable data privacy regulations, you have the right to ask us whether we hold any Personal Data relating to you and, if we do, to be provided with a copy of that Personal Data in electronic form, unless you want to receive it in another way (for example, a paper copy). In addition, you can ask us for information on how we use your Personal Data, who we share it with, how long we keep it, where it is stored, and other information to help you understand how we use it.
- Rectification Request
You have the right to ask us to correct your Personal Data (including by means of providing a supplementary statement) if it is inaccurate, or update outdated or incomplete Personal Data without undue delay. Where we cannot correct the Personal Data, we include a note on our files regarding your request to correct your Personal Data.
- Erasure Request
You have the right to ask us to erase your Personal Data if:
- Your Personal Data are no longer necessary for the purpose(s) they were collected for.
- Your Personal Data have been unlawfully processed.
- Your Personal Data must be erased to comply with a regulation.
- You withdraw your consent for the processing of the Personal Data (and if this is the only basis on which we are processing your Personal Data).
- You object to the possession, provided there are no overriding legitimate grounds for continued processing, or
- You object to processing for direct marketing purposes.
If an erasure request is received, we will also take reasonable steps to inform other data controllers processing the data so they can seek to erase links to or copies of your Personal Data. We may refuse to act on your request to erase your Personal Data if the processing of your Personal Data is necessary:
- To exercise our right of freedom of expression and information.
- To comply with the NDPR and relevant Nigerian laws.
- For the performance of a task carried out in the public interest or to exercise some official authority vested in us.
- To establish, exercise or defend legal claims.
In these cases, we can restrict the processing instead of erasing your Personal Data if requested to do so by you.
- Requests to Object: You have the right to object at any time to the processing of your Personal Data if we process it based on our legitimate interests. This includes any so-called “profiling”. Our privacy notice informs you when we rely on legitimate interests to process your Personal Data. In these cases, we will stop processing your Personal Data unless we can demonstrate compelling legitimate reasons for continuing the processing. We may reject your request if the processing of your Personal Data is needed to establish, exercise or defend legal claims. You have the right to object at any time if we process your Personal Data for direct marketing purposes. You may also object at any time to profiling supporting our direct marketing. In such cases, we will stop processing your Personal Data when we receive your objection.
- Requests to Restrict: You have the right to ask us to restrict the processing of your Personal Data if:
- You contest the accuracy of your Personal Data and we are in the process of verifying the Personal Data we hold.
- The processing is unlawful and you do not want us to erase your Personal Data.
- We no longer need your Personal Data for the original purpose(s) of processing, but you need them to establish, exercise or defend legal claims and you do not want us to delete the Personal Data as a result, or
- You have objected to processing carried out because of our legitimate interests while we verify if our legitimate grounds override yours.
If processing is restricted, we may process your Personal Data (excepting for storage purposes), only:
- If you have given us your consent.
- For establishing, exercising or defending legal claims.
- For protecting the rights of another natural or legal person, or
- For reasons of important public interest as defined under the NDPR and relevant Nigerian laws.
Once processing is restricted following your request, we will inform you before we lift the restriction.
- Requests for Portability: If our processing is performed by computer and is necessary to fulfil a contract with you, or is based on your consent, you have the right to:
- Receive any Personal Data you have provided to us in a structured, commonly used and machine-readable electronic format.
- Send your Personal Data to another organization or have us do so for you if it is technically feasible for us to do so.
If your request relates to a set of Personal Data that also concerns other individuals, we may restrict the transfer to only the portion relevant to you, unless you establish that you have also gotten their consent.
Even if you request the portability of your Personal Data, you retain your right to also request their erasure.
- Requests to Object to Automated Decisions: Generally, you have the right to object to any legal decision concerning you or which otherwise significantly affects you if this is based solely on the automated processing of your Personal Data. This includes automated decisions based on profiling. In such instance, you may undertake a legal process to prevent or advance your rights.
Otherwise, we may refuse your request regarding such automated decisions where:
- Necessary to enter into a contract with you, or for the performance of your contract with us.
- Permitted by regulations, or
- Based on your explicit consent.
Our actions on the automated processing involving your sensitive Personal Data (where you have given your explicit consent or the processing is necessary for reasons of substantial public interest), are in complete compliance with the NDPR and relevant laws.
8. How Do We Protect Your Personal Data?
We maintain technical, physical, and administrative security measures designed to provide reasonable protection for your Personal Data against loss, misuse, unauthorised access, disclosure, and alteration. The security measures include firewalls, data encryption, physical access controls to our premises, CCTV cameras for public safety and quality control, as well as information access authorisation controls. While we are dedicated to securing our systems and services, please note that you are responsible for securing and maintaining the privacy of your password(s) and account/profile registration information and verifying that the Personal Data we maintain of you is accurate and current.
We will inform you of any breaches which may affect your Personal Data.
9. Remedies for Violation and Timeframe for Remedy
In the event of violation of this policy, our Data Protection Officer shall within 7 days redress the violation. Where the violation pertains to the disclosure of your Personal Data without your consent, such information shall be retracted immediately, and confirmation of the retraction sent to the you within 48 hours of the redress.
10. Governing Law
12. Contact Us
I have read all the terms and conditions within this Notice and hereby agree/ disagree to use of my personal data for above mentioned purposes.
OPAY DIGITAL SERVICES LIMITED
Alexander House, Otunba Jobi Fele Way. Ikeja. Lagos, Nigeria.