1. Introduction and Definitions
This Privacy Policy ("Policy") describes how Kay's Limited (RC 9705891) ("Kay's Limited", "we", "us" or "our"), the operator of KaysPay, collects, uses, discloses, retains and protects the personal data of its customers and website visitors ("you" or "your").
We process personal data in accordance with the Nigeria Data Protection Act 2023 ("NDPA") and the General Application and Implementation Directive 2025 ("GAID").
In this Policy:
"Banking Partner" means 9 Payment Service Bank Limited ("9PSB"), the licensed institution with which wallet accounts are provided;
"KYC" means the identity verification and due diligence measures that we are required to carry out under Nigerian law;
"Personal Data" means any information relating to an identified or identifiable individual; and
"Services" means the services provided through the KaysPay mobile application and website.
KaysPay is not a bank. Wallet accounts are provided in partnership with the Banking Partner, and other Services are delivered through licensed payment, telecommunications, utility and technology providers.
2. Data Controller and Data Protection Officer
Kay's Limited is the data controller of the Personal Data described in this Policy. Our registered office is at Shop 25, Chindah Shopping Plaza, Rivers State University Main Gate, Port Harcourt, Rivers State, Nigeria.
Our Data Protection Officer may be contacted by email at support@kayspay.com.ng. Requests should be marked "Data Protection Request".
3. Personal Data We Collect
We collect the following categories of Personal Data, limited to what is necessary to provide the Services and to meet our legal obligations:
| Category | Description |
|---|---|
| Account data | Full name, email address (verified by a one-time code), phone number and password. |
| Security data | A transaction PIN, stored only as a secure hash. Biometric data used to unlock the application remains on your device and is not transmitted to us. |
| Identity and KYC data | Bank Verification Number (BVN) and National Identification Number (NIN) and the details returned on verification, namely name, date of birth, gender, phone number and the photograph on record. Depending on your account tier, also a selfie, an image of a government identity document, your signature, residential address, a utility bill or proof of address, and a declaration on whether you are a politically exposed person. |
| Wallet and transaction data | Purchases and transfers, amounts, recipient phone numbers, meter and smartcard numbers, bank account details, dedicated account and funding references, timestamps and transaction status. |
| Crypto asset data | Orders, quotes, deposit and withdrawal addresses, and the bank account that receives the proceeds of a sale. |
| Device and usage data | Device type, application version, error logs, a randomly generated installation identifier and session identifier, and application events such as onboarding, verification and funding steps and their outcome. These events do not contain your name, email address, phone number, PIN, one-time code, BVN or NIN, balance, transaction amounts or recipient details. |
| Contacts | Collected only where you grant permission, solely to allow you to select recipients. Your address book is not uploaded to us. |
| Profile photograph | Collected only where you choose to upload one. |
| Communications | Messages and attachments that you send to our support channels. |
| Website data | Pages viewed, approximate location and device type, collected only where you accept analytics cookies. |
4. Purposes and Lawful Basis of Processing
We process Personal Data for the purposes and on the lawful bases set out below:
| Purpose | Lawful basis under the NDPA |
|---|---|
| Opening and operating your account, wallet and dedicated funding account; processing purchases, transfers and crypto asset orders; providing customer support | Performance of a contract with you |
| Verifying your identity, assigning your account tier, screening, monitoring transactions, maintaining records and reporting to the competent authorities | Compliance with a legal obligation |
| Preventing and detecting fraud, securing accounts and systems, investigating disputed transactions and maintaining the reliability of the Services | Our legitimate interests, which do not override your rights and freedoms |
| Selecting contacts, uploading a photograph, receiving optional notices and offers, and the use of analytics cookies on our website | Your consent, which may be withdrawn at any time |
We do not sell Personal Data and we do not use it for third party advertising.
We do not take decisions that produce legal effects concerning you solely by automated means. Automated alerts are reviewed by an authorised person before an account is restricted.
5. Disclosure of Personal Data
We disclose Personal Data only to the extent necessary and only to the following categories of recipient:
our Banking Partner, 9PSB, for the opening and management of wallet accounts, identity verification, tier upgrades, funding and transfers;
payment processors, including Flutterwave, for funding, transfers and bank account verification;
providers of airtime, data, electricity, cable television and examination PIN services, including VTUNaija, for delivery of the product purchased;
identity verification providers, including Prembly, for verification of your BVN or NIN against official records;
our crypto asset exchange partner, Quidax, for the execution of crypto asset purchases, sales and withdrawals;
providers of eSIM and foreign number services, including Airalo and SMSPVA;
technology providers that host and operate KaysPay, including database and application hosting, email delivery and push notification services;
Google Analytics, solely where you have accepted analytics cookies on our website;
regulators, law enforcement agencies and courts, including the Central Bank of Nigeria (CBN), the Nigerian Financial Intelligence Unit (NFIU), the Economic and Financial Crimes Commission (EFCC) and the Nigeria Data Protection Commission (NDPC), where required or permitted by law; and
professional advisers, including lawyers and auditors, who are bound by duties of confidentiality.
Each recipient receives only the Personal Data needed for its function. An airtime provider does not receive your BVN or NIN, and an identity verification provider does not receive your transaction history.
Service providers that process Personal Data on our behalf are required to protect it and to use it only for the purpose for which it was shared.
6. International Transfers
Certain service providers, including hosting, email delivery and analytics providers, process data on servers located outside Nigeria. We transfer Personal Data outside Nigeria only as permitted by the NDPA and the GAID, to recipients that provide an adequate level of protection, and only to the extent necessary.
7. Retention
We retain Personal Data only for as long as necessary for the purposes for which it was collected and to meet our legal obligations, as follows:
| Category | Retention period |
|---|---|
| Account, identity and KYC records | For the duration of the relationship and for seven years after the account is closed |
| Transaction and wallet records | Seven years from the date of the transaction |
| Complaint records and security logs | Seven years |
| BVN or NIN verification results held to avoid repeated charges | 24 hours, after which only the historical record is retained |
| Mobile application analytics not linked to an account | Up to 90 days |
| Mobile application analytics linked to an account | Up to 400 days |
Where a legal or regulatory requirement obliges us to retain records, such as transaction and KYC records, a deletion request will be honoured only to the extent that the law permits, and we will inform you of the reason for any records retained.
8. Your Rights
Subject to the NDPA, you have the right to:
be informed about the processing of your Personal Data;
access the Personal Data that we hold about you;
request the correction of inaccurate or incomplete Personal Data;
request the erasure of Personal Data for which we have no lawful ground to retain;
request the restriction of processing or object to processing;
receive your Personal Data in a structured, commonly used format where the law so provides;
withdraw your consent at any time, without affecting the lawfulness of prior processing; and
not be subject to a decision based solely on automated processing that significantly affects you.
To exercise these rights, send a request marked "Data Protection Request" to support@kayspay.com.ng from your registered email address, or use the account deletion page on our website. We may require you to verify your identity before acting on a request.
We will respond without undue delay and in any event within one month of receiving a valid request.
You have the right to lodge a complaint with the Nigeria Data Protection Commission.
9. Security
We maintain technical and organisational measures appropriate to the sensitivity of the Personal Data we process, including:
storage of PINs and passwords only in hashed form, and exclusion of BVN and NIN values from our system logs;
server side verification of a fresh PIN or biometric confirmation for each transaction, so that a signed in session alone cannot move funds;
encryption of data in transit, and database access rules that restrict each account to its own records;
storage of provider credentials in protected server side secret stores and never within the application;
restriction of administrative access to named individuals, protected by multi-factor authentication, with administrative actions recorded; and
device session controls that allow you to review signed in devices, sign out other devices and receive an email notice when a new device signs in.
No system is completely secure and we cannot guarantee absolute security. KaysPay will never request your password, PIN or one-time code, and you must not disclose them to any person.
10. Personal Data Breaches
Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it. Where the risk to you is high, we will also notify you without undue delay and advise on the steps you should take.
11. Children
The Services are intended for persons aged 18 years and above. We do not knowingly collect Personal Data from persons under 18 years and will delete any such data upon becoming aware of it.
12. Cookies and Analytics
Our website uses Google Analytics only after you select "Accept analytics". If you decline, the analytics tag is not loaded. Your choice is stored in your browser and may be changed at any time through the "Analytics preferences" link on the website. No names, email addresses, phone numbers, KYC information, wallet details or transaction data are sent to Google Analytics. Google may process analytics data under its own privacy terms.
The mobile application sends the limited operational events described in clause 3 to our own secured systems, for the purpose of measuring onboarding reliability and identifying technical faults. These events are not sold and are not used for advertising.
13. Amendments
We may amend this Policy to reflect changes in the Services or in applicable law. The effective date at the head of this Policy will be updated, and we will give notice in the application before any significant change takes effect.
14. Contact
Kay's Limited, Shop 25, Chindah Shopping Plaza, Rivers State University Main Gate, Port Harcourt, Rivers State, Nigeria. Email: support@kayspay.com.ng. WhatsApp: +234 906 844 6111.