Privacy Policy

1. Who we are

Surepay (the “App”) is a bill payment application published by Surepay Technologies (“Surepay”, “we”, “us” or “our”). We are the data controller for the personal data described in this policy. This policy covers the Surepay Android and iOS apps and the website at surepayapp.com (together, the “Service”).

If you do not agree with this policy, please do not use the Service. Our privacy contact details are in section 13.

2. Data we collect

Information you give us

• Account details: first name, last name, username, email address, phone number and password. Your password and transaction PIN are stored in protected form and are never visible to our staff.
• Identity verification (KYC) data: your Bank Verification Number (BVN) or National Identity Number (NIN), and a photo of your face taken with your camera for facial verification.
• Profile data: profile photo and any details you add when editing your profile.
• Payment and service details: the phone numbers, meter numbers, smartcard numbers, betting account IDs, passenger details and gift card recipient emails you enter to complete a purchase, and beneficiaries you choose to save.
• Support messages: anything you send us by email, phone or through our forms.

Information created when you use the Service

• Financial and transaction data: wallet balance, your dedicated virtual account number, wallet funding records, purchases, amounts, dates, references, receipts and refund records.
• Device and usage data: IP address, device type, operating system, app version, push notification token, log data and crash diagnostics.

What we do not collect

• We do not collect or store your debit or credit card numbers. Wallet funding happens by bank transfer or through licensed payment processors.
• We do not receive your fingerprint or Face ID data. Biometric sign in is handled entirely by your device, which only tells the App whether the check passed.
• We do not record audio, and we do not collect your contacts, SMS or precise location.

3. App permissions

• Camera: used only when you take a photo for facial verification or a profile picture.
• Biometrics (fingerprint or Face ID): used only to let you sign in quickly and securely on your own device.
• Notifications: used to send you transaction alerts and service updates. You can turn these off in your device settings.

You can withdraw any permission at any time in your device settings.

4. How we use your data

• To create and manage your account and wallet.
• To process wallet funding, bill payments, bookings and other transactions securely.
• To verify your identity and meet know-your-customer and anti-fraud obligations.
• To send receipts, transaction alerts, one-time codes and service messages.
• To provide customer support and resolve disputes and refunds.
• To detect, prevent and investigate fraud, abuse and security incidents.
• To monitor performance, fix errors and improve the Service.
• To comply with legal, regulatory and tax requirements.

We do not sell your personal data, and we do not use it for third-party advertising.

5. Legal bases for processing

Under the Nigeria Data Protection Act 2023 we process your data on these bases: performance of our contract with you, compliance with legal obligations, our legitimate interests in keeping the Service secure and reliable, and your consent where we ask for it (for example camera access and notifications). You may withdraw consent at any time.

6. How we share your data

We share only what is needed, with the following categories of recipients:

• Payment and virtual account partners (such as Monnify and Paystack), to issue your dedicated account number and process wallet funding.
• Bill, airtime, flight and gift card providers (such as VTpass, Reloadly and airline booking partners), to deliver the service you paid for.
• Identity verification partners, to confirm your BVN or NIN.
• Infrastructure and communication providers for cloud hosting, media storage, email, SMS, push notifications and error monitoring.
• Regulators, law enforcement and courts, when required by law or to protect the rights, property and safety of our users or others.
• A successor entity, if Surepay is involved in a merger, acquisition or sale of assets. You will be notified of any such change.

Some providers may process data outside Nigeria. Where that happens we rely on appropriate safeguards as required by applicable law.

7. How we protect your data

Data sent between the App and our servers is encrypted in transit. Payments require your transaction PIN, access to our systems is restricted to authorised staff, and we monitor for suspicious activity. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work continuously to protect your information.

8. How long we keep your data

• We keep your account and profile data for as long as your account is open.
• When you delete your account, your profile and personal data are removed within 30 days of the request being confirmed.
• Transaction and identity verification records are kept for at least five years after the transaction or account closure where Nigerian anti-money-laundering, financial and tax laws require it. During that time they are restricted to compliance use only.
• In-app support chats are deleted after 30 days.

9. Deleting your account and data

You can ask us to delete your Surepay account and associated data, or to delete specific data without closing your account, at any time on our Delete Account page, or by emailing support@surepayapp.com from your registered email address.

10. Your rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you and receive a copy of it;
• correct inaccurate or incomplete data;
• request deletion of your data;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent;
• lodge a complaint with the Nigeria Data Protection Commission.

To exercise any of these rights, contact us using the details in section 13.

11. Children

The Service is intended for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date at the top of this page and, for significant changes, notify you in the App or by email.

13. Contact us

For questions, requests or complaints about this policy or your personal data, contact: