JolaxPay Privacy Policy

1. Who we are and the scope of this policy

JolaxPay (referred to as “JolaxPay”, “we”, “us” or “our”) provides a mobile wallet and payment platform for utility purchases, transfers, withdrawals, receipts, scheduled purchases, support and related services. This policy applies to the JolaxPay mobile application, customer website, support channels and services that link to this policy.

For personal information processed to provide JolaxPay services, JolaxPay acts as the data controller. Certain payment institutions, banks, utility vendors and other service providers may separately act as controllers for information they receive under their own privacy notices.

2. Information we collect

We generally receive this information directly from you, your device, other JolaxPay users who transact with you, and the payment, banking or utility providers involved in your request.

3. How we use information

• Create, verify, secure and administer your account.
• Provide wallet funding, wallet-to-wallet transfers, bank withdrawals and utility purchases.
• Verify meters, customer identifiers and bank accounts with the relevant provider.
• Generate receipts, transaction history, summaries, repeat suggestions and scheduled-payment reminders.
• Send verification codes, transaction updates, security alerts, announcements and messages you have allowed.
• Detect unusual activity, enforce transaction limits, prevent fraud and protect users and the platform.
• Reconcile provider responses, investigate failed or disputed transactions and provide support.
• Understand service performance, fix faults and improve product usability.
• Comply with applicable legal, regulatory, accounting and law-enforcement obligations.

We do not sell or rent your personal information, and we do not use it for unrelated advertising by third parties.

4. Our lawful bases

Depending on the activity, we process personal information because it is necessary to perform our contract with you, comply with a legal obligation, pursue a legitimate interest such as security and service improvement, protect vital interests, or because you have given consent. Where processing relies on consent, you may withdraw it at any time, although this does not affect processing already carried out lawfully.

5. When we share information

We disclose only the information reasonably needed for the relevant service. Recipients may include:

• Payment and banking providers used for collections, virtual accounts, account verification, transfers, refunds and withdrawals, including the provider currently selected by JolaxPay.
• Utility and value-added-service providers used to verify and fulfil electricity, airtime, data, television and education purchases.
• Communications providers that deliver email, SMS verification, push notifications and service messages.
• Hosting, storage, monitoring and realtime-service providers that help operate and secure the platform.
• Professional advisers, auditors, regulators, courts or law-enforcement bodies where disclosure is required or permitted by law.
• A successor organisation in connection with a genuine merger, financing, restructuring or transfer of the business, subject to appropriate safeguards.

We require service providers acting on our instructions to use information only for the contracted purpose and to protect it appropriately.

6. International data transfers

Some technology or communications providers may process information outside Nigeria. Where personal information is transferred internationally, we use measures required by applicable law, such as adequacy decisions, approved contractual safeguards, consent where appropriate, or another lawful transfer mechanism.

7. How long we keep information

We retain personal information only for as long as reasonably necessary for the purposes described in this policy. Account information is normally kept while your account remains active. Transaction, ledger, reconciliation, fraud, tax and regulatory records may be retained longer where required for financial recordkeeping, dispute handling, fraud prevention or legal compliance. Support and technical records are retained according to their operational need.

When information is no longer required, we delete it, anonymise it or securely isolate it, subject to lawful backup-retention cycles.

8. How we protect information

We apply administrative, technical and organisational safeguards designed for the nature of the information we process. These include access controls, password hashing, one-time verification codes, session controls, encrypted network transport, transaction idempotency, audit records, fraud rules, provider reconciliation and restricted staff permissions.

No internet or storage system can be guaranteed completely secure. You should keep your password and verification codes confidential, use a secure device, and tell us promptly if you suspect unauthorised access.

9. Your privacy rights

Subject to the Nigeria Data Protection Act 2023 and other applicable law, you may have the right to:

• be informed about how your information is processed;
• request access to, or a copy of, your personal information;
• correct inaccurate or incomplete information;
• request erasure, restriction or objection in qualifying circumstances;
• withdraw consent where consent is the lawful basis;
• request portability of eligible information;
• request human review where a decision based solely on automated processing has a legal or similarly significant effect; and
• complain to the Nigeria Data Protection Commission.

To exercise a right, contact us using the details below. We may need to verify your identity before acting. Some requests may be limited where retaining or processing information is required by law, necessary to complete a transaction, or needed to protect another person’s rights.

10. Children’s privacy

JolaxPay is not directed to children and should not be used by anyone who cannot lawfully enter the agreement required to hold an account. We do not knowingly create accounts for children without the consent or other lawful authority required by applicable law. If you believe a child has provided personal information improperly, contact us so we can investigate.

11. Website and device data

Our public website may receive ordinary server information such as IP address, browser type, requested page and request time for security and reliable delivery. The mobile application stores authentication and preference information on your device and may use camera access when you choose to scan a QR code, photo-library or camera access when you choose a profile image, biometric capability when enabled, and notification permissions when granted. You can manage device permissions in your phone settings, although disabling a permission may prevent the related feature from working.

12. Changes to this policy

We may update this policy as JolaxPay’s services, providers or legal obligations change. We will publish the revised version here and update the effective date. Where a change is material, we may also notify you in the app, by email or through another appropriate channel.

13. Contact us

For privacy questions, account-data requests or concerns about how your information is handled, contact JolaxPay using the details below.