Privacy policy

We decide how and why your data is processed (we are the data controller) for:

• people who use the dashboard, and people who contact us;
• directors, owners and signatories of the businesses we verify;
• the bank details of people who pay businesses through Pletopay or receive transfers from them, which we must keep and check by law; and
• security and fraud-prevention records.

When a business sends us details about its own customers, such as names, email addresses and invoices, we process them on that business’s instructions (we are its data processor). The business’s own privacy notice applies, and we pass any request about that data to the business. The Data processing agreement sets out our obligations.

Our Data Protection Officer can be reached at hello@pletopay.com. Please write “Privacy” in the subject line.

We do not ask for sensitive personal data such as health, religious or biometric data. BVNs and ID numbers are protected as described below.

Pletopay is for businesses and is not intended for anyone under 18.

From you; from colleagues who invite you or add you as a director, owner or signatory of their business; from businesses about their customers; from banks, through our partner bank, when a transfer is made; and from our own systems as you use Pletopay.

We do not send marketing emails at present. If we start, we will do so only with your consent or where the law allows, and every message will let you opt out.

Some decisions are made automatically to protect funds and accounts:

• a transfer or refund over a limit is refused;
• money from a sender account on a blocklist is held for review, and transfers to a blocked account are refused;
• payment pages refuse access from a blocked IP address;
• sign-in is locked for 15 minutes after 5 failed attempts; and
• a new settlement account cannot be used for 24 hours.

Risk scores help our staff decide which activity to review; a score never moves money or blocks anything by itself. You have the right to ask for a person to review an automatic decision, to give your point of view and to challenge it. Write to hello@pletopay.com.

• Our licensed partner bank: the business’s name, which is the account name your customers see; and, for transfers, refunds and settlements, the recipient’s account details and the narration. We do not send it customer email addresses, BVNs or ID details.
• The business you pay: the payment details, including the sender name reported by your bank.
• Service providers who process data for us under contract: cloud hosting and databases, encrypted file storage, email delivery, and monitoring, error reporting and alerting. We will give you a current list on request.
• Authorities, including the Nigerian Financial Intelligence Unit, the Central Bank of Nigeria, law-enforcement agencies, the Nigeria Data Protection Commission and courts, when the law requires.
• Professional advisers and auditors, and a buyer or successor if our business is sold or merged, under confidentiality.

We do not sell personal data or use it for advertising.

Some of our service providers store or process data outside Nigeria. We transfer personal data out of Nigeria only on a basis permitted by sections 41 to 43 of the Act: where the recipient is bound by a law, binding corporate rules, contractual clauses, a code of conduct or a certification that gives adequate protection, or where another condition in section 43 applies. We record the basis for each transfer. Data is encrypted in transit and at rest.

These periods meet the Money Laundering (Prevention and Prohibition) Act 2022, which requires records to be kept for at least 5 years, and Nigerian tax and company law. We keep data longer only when a regulator, a court order or an investigation requires it. Encrypted backups are deleted as they rotate out.

• Data is encrypted in transit and at rest. BVNs, ID numbers, two-factor secrets and verification documents are also encrypted individually.
• Passwords are stored only in a form that cannot be reversed.
• Access is limited by role. Our staff use two-factor authentication, see account numbers and BVNs masked unless their role requires otherwise, and every reveal is recorded.
• Audit records cannot be altered.

If a breach is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it. If the risk is high, we will tell you straight away and explain what you can do to protect yourself.

Under the Nigeria Data Protection Act 2023 you have the right to:

• be told how your data is used, which is what this policy does;
• get a copy of your data in a common electronic format;
• have inaccurate or incomplete data corrected;
• have your data deleted;
• restrict or object to how we use it;
• withdraw consent where we rely on it;
• not be subject to a decision based only on automated processing that significantly affects you; and
• receive your data in a machine-readable format.

To use these rights, write to hello@pletopay.com. We may need to confirm your identity. We will respond without undue delay and within 30 days. We cannot delete records the law requires us to keep, but we will tell you which records those are and stop using them for anything else. If a business sent us your data, we will pass your request to that business.

You can also complain to the Nigeria Data Protection Commission.

The Cookie policy lists the cookies and browser storage we use. We use no analytics or advertising cookies.

When we change this policy, we update the date at the top. We will tell account owners about material changes by email and in the dashboard before they apply.