Privacy Policy
Draft for review — please have a qualified Nigerian lawyer / data-protection expert review before publishing.
Last updated: [Date]
This Privacy Policy explains how [Easy Recharge Legal Entity Name] ("Easy Recharge", "we", "us", or "our") collects, uses, shares, and protects your personal data when you use the Easy Recharge website and mobile app (together, the "Service") at easyrecharge.ng.
We are committed to handling your personal data responsibly and in line with the Nigeria Data Protection Act, 2023 (NDPA), the Nigeria Data Protection Regulation (NDPR), and other applicable Nigerian laws. By using the Service, you confirm that you have read and understood how we handle your personal data as described here.
Easy Recharge is a recharge and bill-payments service. We are not a bank, deposit-taker, or financial institution. Your prepaid wallet is a balance you load to pay for products and services through the Service; it is not a bank deposit or savings account.
Who We Are (Data Controller)
For the purposes of the NDPA, the data controller responsible for your personal data is:
[Easy Recharge Legal Entity Name], [Registered address]. Email: [support email]. Phone: [support phone].
Our Data Protection Officer (DPO) can be reached at [Data Protection Officer email].
Personal Data We Collect
We collect only the personal data we need to provide the Service, keep your account secure, prevent fraud, and meet our legal obligations:
- Account and contact information — your phone number (used as your primary identifier), name, and email address where provided.
- Identity and verification (KYC) details — information you provide to verify your identity and unlock higher account tiers and transaction limits. Depending on your tier, this may include your date of birth, address, a government-issued identification number (such as BVN or NIN where required by law or our payment partners), and similar identifying details.
- Transaction information — records of your wallet funding, purchases, transfers, amounts, dates, recipients (such as the meter, smartcard, or phone number you are paying for), and the status of each transaction.
- Device and technical information — device type and model, operating system, app version, language settings, general location inferred from your IP address, and unique identifiers used to keep your account secure and the Service working.
- Usage information — how you interact with the Service, collected through analytics tools.
- Communications — messages, requests, and feedback you send to our support team, and our responses.
What we do not collect or store: Your transaction PIN is never stored on our servers and never leaves your device. We do not see it and cannot recover it for you. We also do not store full card numbers — card payments are handled by our licensed payment partner.
Why We Collect Your Data and Our Lawful Basis
Under the NDPA, we must have a lawful basis for processing your personal data:
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account; processing your wallet funding, purchases, and transfers | Performance of a contract with you |
| Verifying your identity (KYC) and complying with anti-fraud and regulatory requirements | Legal obligation; legitimate interest in preventing fraud |
| Keeping the Service, your account, and your wallet secure | Legitimate interest in a safe, secure service |
| Providing customer support | Performance of a contract; legitimate interest |
| Improving the Service and troubleshooting | Legitimate interest in maintaining and improving the Service |
| Sending service-related messages (transaction confirmations, security alerts) | Performance of a contract; legitimate interest |
| Sending marketing or promotional messages (where applicable) | Your consent, withdrawable at any time |
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
How We Use Your Data
We use your personal data to register, verify, and manage your account and wallet; process the transactions you request and deliver what you pay for; confirm transactions, send receipts, and provide transaction history; automatically refund your wallet when a transaction fails; detect, investigate, and prevent fraud and unauthorised access; provide customer support; maintain, secure, troubleshoot, and improve the Service; comply with our legal and regulatory obligations; and, where permitted, send you updates or offers.
How We Share Your Data
We do not sell your personal data. We share it only as needed to deliver the Service and meet our obligations, with:
- Licensed payment partners — to process your wallet funding and card or transfer payments, under their own terms and applicable regulations.
- Service providers and billers — telecom networks, electricity distribution companies, cable TV providers, examination bodies, broadband providers, and betting platforms — strictly to fulfil the specific transaction you request.
- Technology and infrastructure providers — hosting, cloud, communications (SMS/email), and analytics providers who process data on our behalf under contract and only on our instructions.
- Identity-verification providers — to confirm the KYC details you provide, where required.
- Professional advisers — auditors, lawyers, and accountants, where necessary.
- Regulators, law enforcement, and authorities — where legally required, or to establish, exercise, or defend legal claims, or to protect the rights, safety, and property of users, the public, or Easy Recharge.
- In a business transfer — your data may be transferred as part of a merger, acquisition, financing, or sale of assets, subject to this Policy.
We share only the minimum personal data necessary for each purpose.
International Data Transfers
Some service providers may process data outside Nigeria. Where personal data is transferred outside Nigeria, we take steps to ensure it is protected in line with the NDPA — for example, by transferring only to recipients in jurisdictions with adequate protection or under appropriate contractual safeguards.
How Long We Keep Your Data
We keep your personal data only for as long as necessary: for the life of your account and afterwards as needed to provide records and support; to comply with legal, regulatory, tax, accounting, and anti-fraud obligations (transaction and KYC records are typically retained for the period required by Nigerian law); and to establish, exercise, or defend legal claims. When data is no longer required, we securely delete, destroy, or anonymise it.
How We Protect Your Data
We apply appropriate technical and organisational measures, including: encryption of transactions and sensitive data in transit and at rest; a design in which your transaction PIN is never stored on our servers and never leaves your device; account verification (KYC) and ongoing monitoring; access controls limiting who can access personal data on a need-to-know basis; and secure infrastructure, monitoring, and regular review. No method of transmission or storage is completely secure, so please also keep your PIN, OTP, and login details confidential (see our Security page).
Your Rights Under the NDPA
Subject to the conditions and exceptions in the NDPA, you have the right to access your data, request correction or deletion, request restriction of processing, object to processing based on legitimate interests or to direct marketing, request data portability, withdraw consent, and lodge a complaint with the Nigeria Data Protection Commission (NDPC).
Some rights are not absolute — for example, we may be unable to delete data we are legally required to retain (such as certain transaction or KYC records), and we may need to verify your identity before acting on a request.
How to Exercise Your Rights
Contact our Data Protection Officer at [Data Protection Officer email], or our support team at [support email] / [support phone]. We will respond within the timeframe required by the NDPA, free of charge unless a request is manifestly unfounded, excessive, or repetitive.
Cookies and Analytics
Our website and app use cookies and similar technologies to keep you signed in, remember your preferences, keep the Service secure, and understand how it is used. You can manage cookies through your browser settings and device permissions through your device settings; disabling some may affect how parts of the Service work.
Children
The Service is intended for users who are 18 years of age or older. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us with personal data, contact us at [Data Protection Officer email] and we will take appropriate steps to delete it.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you through the Service. Continued use after an update means you accept the revised Policy.
Contact Us
[Easy Recharge Legal Entity Name], [Registered address]. Data Protection Officer: [Data Protection Officer email]. Support: [support email] / [support phone].