Join Waitlist
Back to PlutoPay
NDPR & Data Privacy

Privacy Policy

Last revised: October 2026 • Compliant with NDPA 2023 & NDPR standards

1. Our Commitment to Your Privacy

At PlutoPay Technologies Limited ("PlutoPay"), we consider the privacy and security of your personal data paramount. This Privacy Policy details the types of personal data we collect, why we collect it, how it is processed and secured, and your statutory rights under the Nigeria Data Protection Act 2023 (NDPA) and Nigeria Data Protection Regulation (NDPR).

2. Information We Collect

We collect and process the following categories of personal information:

  • Identity & Profile Data: Full legal name, date of birth, phone number, email address, physical address, and photograph.
  • Statutory Verification Data: Bank Verification Number (BVN) and National Identity Number (NIN) used strictly to confirm identity through authorized regulatory databases.
  • Financial & Transaction Data: Account numbers, bank transfer histories, payment invoices, virtual card usage, and wallet balances.
  • Technical & Telemetry Data: IP address, device model, operating system version, mobile network operator, and push notification tokens.

3. Lawful Basis & Purposes of Processing

We process your data only where we have a lawful legal basis under the NDPA, including:

  • Fulfilling our contract to deliver money transfer, bill payment, and card services to you.
  • Complying with statutory Central Bank of Nigeria (CBN), NFIU, and anti-money laundering regulations.
  • Protecting users against financial cyber-crime, fraud, and unauthorized account access.

4. Data Protection & Cryptographic Safeguards

PlutoPay enforces strict organizational and technical security controls. All user data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption. We never store raw card CVVs or unencrypted PIN numbers. Access to customer records by internal staff is tightly restricted via role-based access control (RBAC) and monitored via tamper-evident audit trails.

5. Third-Party Disclosures & Partners

We do not sell, rent, or trade your personal data to marketing third parties. We share data solely with licensed partner commercial banks, regulated payment switches (such as NIBSS), and identity verification providers strictly necessary to execute banking and card transactions.

6. Your Statutory Rights

Under the NDPA, you have the right to:

  • Request access to copies of your personal data stored on our systems.
  • Request rectification of inaccurate or outdated information.
  • Request erasure of your data, subject to statutory banking record retention laws.
  • Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

7. Contact Our Data Protection Officer

If you have any questions or wish to exercise any of your data rights, please contact our Data Protection Office at:

Email: dpo@plutopay.ng
Address: PlutoPay Technologies Limited, Victoria Island, Lagos, Nigeria.