Privacy Policy

Overview

Uverus Payments Ltd ("Uverus", "we", "our", or "us") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard information about you when you use our payment platform, website, and related services (collectively, the "Services").

By using our Services, you agree to the collection and use of information in accordance with this policy. If you do not agree with any part of this policy, please do not use our Services.

Information we collect

We collect information in the following ways:

Information you provide directly:

• Account registration details — name, email address, phone number, business name
• Business verification (KYC) documents — CAC certificate, Memorandum of Association, proof of address, and other required compliance documents
• Bank account details for payouts and transfers
• Payment card details (processed and stored by our PCI-compliant card processor — we do not store raw card numbers)
• Communications you send us, including support requests

Information collected automatically:

• Transaction data — amounts, timestamps, payment methods, references, and outcomes
• Device and browser information when you access our dashboard or checkout pages
• IP address and approximate location
• API usage logs — endpoints accessed, response times, error codes
• Webhook delivery logs

Information from third parties:

• Bank account verification responses from Nigerian banking infrastructure (NIP/NIP-in inquiries)
• Card scheme data returned during authorisation flows

How we use your information

We use the information we collect to:

• Provide, maintain, and improve our payment processing services
• Process and verify transactions on your behalf
• Conduct KYC and compliance checks as required by Nigerian financial regulations
• Settle funds to your Uverus wallet and process payouts to your bank account
• Send you service notifications, transaction alerts, and login notifications
• Respond to support enquiries and resolve disputes
• Detect and prevent fraud, abuse, and security incidents
• Comply with applicable laws, regulations, and regulatory requests
• Generate aggregated, anonymised analytics to improve our platform

How we share your information

We do not sell your personal information. We may share it with:

• Payment processors and banking partners — to execute card payments, bank transfers, and USSD transactions
• KYC and identity verification services — to fulfil our regulatory compliance obligations
• Cloud infrastructure providers — who host and operate our platform under data processing agreements
• Regulators and law enforcement — where required by applicable law or a valid legal process
• Your team members — information visible within your merchant account is accessible to team members you have added, subject to their assigned role and permissions

We require all third parties to respect the security of your data and to process it only in accordance with our instructions and applicable law.

Data security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or disclosure. These include:

• TLS encryption for all data in transit
• Encryption at rest for sensitive data fields
• bcrypt password hashing (12 rounds) — we never store plaintext passwords
• JWT access tokens with short expiry, paired with hashed refresh tokens
• Rate limiting on all sensitive endpoints
• HMAC-signed webhook payloads to prevent tampering
• Access control and audit logging for internal systems

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Data retention

We retain your personal information for as long as your account is active, or as necessary to provide our Services, comply with our legal obligations, resolve disputes, and enforce our agreements.

Transaction records may be retained for up to seven (7) years in accordance with Nigerian financial recordkeeping requirements. You may request deletion of non-transactional data subject to applicable legal constraints.

Your rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information, where not subject to legal retention requirements
• Object to or restrict certain processing of your data
• Withdraw consent where processing is based on consent

To exercise these rights, contact us at the address below.

Cookies

Our website and dashboard use cookies and similar technologies to maintain session state, measure performance, and improve your experience. We do not use third-party advertising cookies.

You can configure your browser to refuse cookies, but some parts of the Services may not function correctly without them.

Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a notice in your dashboard before the changes take effect. The date at the top of this page reflects the most recent update.

Contact us