1 Introduction
AfricSpend Ltd ("AfricSpend", "we", "us") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, share, and safeguard your information when you use our website, mobile application, and related services (collectively, the "Services").
This policy is subject to, and should be read alongside, our Terms of Service and AML & KYC Policy.
2 Data We Collect
We collect the following categories of personal data:
- Identity data: Full name, date of birth, gender, nationality, government-issued identification (National ID, BVN, international passport, driver's licence).
- Contact data: Email address, phone number, residential address.
- Financial data: Transaction history, settled balances, bank account details, designated wallet addresses, and transaction amounts.
- KYC & verification data: Selfie photographs, biometric data processed by our identity verification service for liveness checks.
- Technical data: IP address, device type, browser type, operating system, session identifiers, time zone.
- Usage data: Pages visited, features used, search queries, error logs, and clickstream data within the application.
- Communications data: Records of emails, support tickets, or other communications you send to us.
3 How We Collect Data
We collect your data through:
- Direct interactions — when you register, complete KYC, make transactions, or contact support;
- Automated technologies — cookies, log files, and analytics tools that track activity on our platform;
- Third-party sources — identity verification providers, payment processors, and fraud prevention services who may provide data about you.
4 How We Use Your Data
We use your personal data to:
- Create and manage your AfricSpend account;
- Execute transactions you initiate, including conversions, transfers, withdrawals, and bill payments;
- Conduct identity verification and comply with KYC/AML obligations;
- Detect, prevent, and investigate fraud, money laundering, and other unlawful activity;
- Comply with legal and regulatory obligations, including reporting to Nigerian financial regulators;
- Send transactional notifications (deposit alerts, withdrawal confirmations, security alerts);
- Improve our platform, fix bugs, and develop new features based on usage analytics;
- Respond to your enquiries and provide customer support;
- Send marketing communications where you have provided consent (you may opt out at any time).
We process your data under the legal bases of contractual necessity (to deliver the Services), legal obligation (KYC/AML compliance), and legitimate interest (fraud prevention and platform security).
5 KYC & Identity Verification
In accordance with Nigerian AML regulations and our own risk management framework, AfricSpend requires all users to complete identity verification before accessing full platform functionality. KYC checks are processed using approved third-party identity verification services in compliance with Nigerian regulatory requirements.
- Sharing your personal and identity data with our verification service provider for processing;
- Liveness checks and biometric facial comparison being performed as part of the verification process;
- The storage and processing of your identity data as required by law.
AfricSpend does not directly store your raw biometric data. Biometric processing is conducted by our verification service provider and governed by their applicable privacy policies. Your identity documents and KYC records are retained by AfricSpend for regulatory compliance purposes as described in Section 8.
6 Data Sharing
We may share your personal data with:
- Identity verification providers — to perform KYC, document verification, and liveness checks;
- Payment processors and banking partners — to execute local currency payouts and bank transfers to your registered account;
- Transaction processing infrastructure — to receive and confirm inbound digital asset transactions on your behalf;
- Nigerian regulatory authorities — including the Central Bank of Nigeria (CBN), Financial Intelligence Unit (NFIU), and law enforcement, where required by law;
- Fraud prevention services — to protect the platform and its users;
- Professional advisers — lawyers, auditors, and insurers under obligations of confidentiality.
7 Data Security
AfricSpend implements industry-standard technical and organisational security measures to protect your personal data, including:
- Encryption of data in transit (TLS/HTTPS) and at rest;
- Secure, hashed storage of passwords using bcrypt;
- JWT-based authentication with short-lived access tokens;
- Rate limiting and brute-force protection on all authentication endpoints;
- Database-level constraints and audit logging for financial transactions;
- Restricted access controls and principle of least privilege for internal systems.
8 Data Retention
We retain your personal data for as long as necessary to deliver our Services and comply with our legal obligations:
- Account data: Retained for the duration of your account and for a minimum of 5 years after account closure, as required by Nigerian AML regulations.
- Transaction records: Retained for a minimum of 5 years from the date of each transaction.
- KYC documents: Retained for a minimum of 5 years after the end of the business relationship.
- Communication records: Retained for up to 2 years from the date of communication.
9 Cookies & Tracking
Our website uses cookies and similar technologies to:
- Maintain your session and authentication state;
- Remember your preferences and settings;
- Analyse platform usage through analytics tools.
You can configure your browser to refuse cookies. However, some features of the platform may not function correctly without them.
10 Your Rights
Subject to applicable Nigerian law and our legal obligations, you have the right to:
- Access — request a copy of the personal data we hold about you;
- Correction — request that we correct inaccurate or incomplete data;
- Deletion — request erasure of your data where there is no legitimate reason for us to continue processing it (note: we may be legally required to retain certain data);
- Objection — object to the processing of your data for direct marketing purposes;
- Portability — receive your data in a structured, machine-readable format;
- Withdrawal of consent — withdraw consent for marketing communications at any time.
To exercise any of these rights, please contact us at africspend@gmail.com. We will respond within 30 days.
11 Children's Privacy
AfricSpend Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will take steps to delete it.
12 Cross-Border Data Transfers
Some of our third-party service providers operate outside of Nigeria. Where your data is transferred internationally as part of identity verification or transaction processing, we ensure that appropriate safeguards are in place in accordance with applicable data protection laws.
13 Policy Updates
We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. Material changes will be communicated to you via email or in-app notification. The updated policy will take effect on the date stated at the top of the document. Continued use of the Services after that date constitutes acceptance.
14 Contact Us
For privacy-related enquiries, data access requests, or to raise a concern about our data practices, please contact us: