Privacy Notice

This Notice explains what personal data we collect when you use UDS PAY, why, and your rights under the Nigeria Data Protection Act 2023 (NDPA). It sits alongside our Data Protection & Privacy Policy, which governs our internal data protection management.

1. What we collect

• Account data: full name, email address, username, phone number, password (stored hashed — we cannot see it), transaction PIN (stored hashed).
• Identity data (for KYC): Bank Verification Number (BVN) and/or National Identification Number (NIN), and the verification result. Document images and liveness data are collected only at higher KYC tiers when those flows are enabled.
• Transaction data: your wallet transactions, amounts, counterparties, virtual account number, timestamps, and the ledger records of every movement of funds.
• Technical and security data: IP address, device and app information, login and security audit events (for example, failed login or PIN attempts).
• Support data: messages and documents you send us when you contact support.

We do not collect or store card numbers or card PINs. If card funding is offered in future, card data will be handled by a licensed payment processor and this Notice updated first.

2. Why we use it, and our lawful bases

• To provide the service (performance of our contract with you): operating your account and wallet, processing transactions, showing your history.
• To meet legal obligations (compliance with law): identity verification under CBN KYC rules; anti-money-laundering controls under the Money Laundering (Prevention and Prohibition) Act 2022 and CBN AML/CFT regulations; record retention; responses to lawful regulatory requests.
• For security and fraud prevention (our legitimate interests, and legal obligations): PIN lockouts, rate limits, monitoring for abuse, keeping audit trails.
• Verification consent: BVN/NIN verification is performed with your explicit consent, captured when you submit your details for verification, through the identity services of 9 Payment Service Bank (9PSB).

3. Who we share it with

• 9 Payment Service Bank (9PSB): our licensed banking partner. 9PSB provides the wallet and virtual account services and performs identity verification; it receives the identity and transaction data needed for those functions and for its own regulatory duties.
• Identity databases: BVN/NIN checks are resolved against NIBSS and NIMC records through 9PSB's identity service.
• Service providers: infrastructure providers (hosting, email delivery, error monitoring) under contract, receiving only the data their function requires. Our operational monitoring is designed so that BVN and unmasked personal data are not included in routine telemetry.
• Authorities: where required by law, court order, or a lawful request from the CBN, NFIU, NDPC, EFCC or other competent authority.

We do not sell your personal data.

4. How long we keep it

• Transaction and KYC records: at least five (5) years after the transaction or the end of the business relationship, as required by AML law; some records may be kept longer where a legal hold or dispute requires it.
• Account data: for the life of the account plus the retention period above.
• Security and audit logs: retained for security investigation and regulatory purposes, then deleted or anonymised.

After retention expires, data is deleted or irreversibly anonymised.

5. Security

Passwords and PINs are stored only as cryptographic hashes. Administrative access to production systems requires multi-factor authentication. Data in transit is encrypted (TLS). Access to personal data is restricted to personnel who need it for their role, and administrative actions are logged. No system is perfectly secure; if a breach affecting your data occurs, we will notify the Nigeria Data Protection Commission within 72 hours where the NDPA requires it, and notify affected users without undue delay where there is a high risk to them.

6. Your rights

Under the NDPA you may: request access to your data; request correction of inaccurate data; request deletion (subject to our legal retention duties, which override deletion for KYC and transaction records); request a copy in portable form; object to or restrict certain processing; and withdraw consent where processing is based on consent (withdrawal does not affect processing already performed or required by law).

To exercise a right, contact [email protected]. We respond within the NDPA's timelines. You may also complain to the Nigeria Data Protection Commission (NDPC) if you believe we have mishandled your data.

7. Children

UDS PAY is for users aged 18 and above. We do not knowingly register minors; an account found to belong to a minor will be closed and its data handled per Section 4.

8. Changes to this Notice

We will publish updates in the app and at uncletimtech.com, and notify users of material changes before they take effect.

9. Contact

UNCLETIM DIGITAL SOLUTIONS LTD (RC 9959889) — [email protected] · [email protected] · uncletimtech.com