Privacy policy

We collect information that is necessary for service delivery, security, customer support, fraud prevention and compliance. The categories may include the following, depending on your use of FalconPay:

1.1Identity and contact information

• Full name, date of birth where required, telephone number, email address and other contact details.
• BVN, NIN, government-issued identification documents and information returned by identity-verification checks.
• Photographs, selfies, liveness-check results or other verification information where an identity-verification process requires them.

1.2Wallet, account and transaction information

• Wallet identifiers, linked or beneficiary account details, payment references and transaction histories.
• Transaction amounts, dates and times, payment status, sender and recipient details, settlement and reconciliation records, and information needed to investigate failed, disputed or suspicious transactions.
• Information required to meet applicable customer due diligence, anti-money laundering, fraud-prevention and financial record-keeping obligations.

1.3Device, technical and usage information

• Device identifiers and characteristics, operating system, app version, IP address, diagnostic information, access logs and security events.
• Information about app interactions, feature usage, errors and performance, where collected for service improvement, analytics, troubleshooting or security.
• Authentication status and related security signals. If your device uses Face ID or fingerprint authentication, the biometric matching is generally handled by the device’s operating system; FalconPay does not claim to receive your underlying fingerprint or face template unless a particular supported process expressly requires and discloses such collection.

1.4Location and address information

• Location or address-verification information where required for a service, transaction, security review or regulatory purpose, including live device location where the relevant feature is enabled and the applicable conditions for collection are met.
• Information received from address-verification providers or other verification services, where used.

1.5Customer support and communications

• Messages, support chats, emails, complaint details, feedback and information you provide when contacting FalconPay.
• Records of service notices, security alerts and relevant communications with you.

1.6Information from other sources

• Verification results and relevant account or payment information received from banks, payment partners, identity-verification providers, fraud-prevention services and other authorised sources.
• Information supplied by regulators, law enforcement or other competent authorities where lawfully provided and relevant to FalconPay’s services or obligations.

FalconPay processes personal data only where a lawful basis applies. The basis depends on the purpose and circumstances of the processing and may include:

2.1Performance of a contract or steps before a contract

To open and administer your account, provide wallet and payment services, process transactions, support customers and deliver features you request.

2.2Compliance with legal obligations

To meet applicable KYC, AML/CFT, record-keeping, tax, reporting, regulatory and lawful authority requirements.

2.3Consent

Where consent is the appropriate lawful basis, we will seek it in a manner required by law. You may withdraw consent at any time; withdrawal does not affect processing lawfully carried out before withdrawal. Withdrawal may affect the feature or service that depends on that consent.

2.4Legitimate interests

Where permitted by law, to protect our customers and systems, prevent and investigate fraud, maintain platform integrity, improve service reliability, and establish, exercise or defend legal claims. We consider the impact on your rights and freedoms when relying on this basis.

2.5Vital interests or public interest

Where applicable and permitted by law, to protect vital interests or perform a task carried out in the public interest or under official authority.

We use personal data for clear and legitimate purposes, including:

• Account registration, customer identification, verification and account administration.
• Processing, authorising, routing, settling and reconciling payments and other requested transactions.
• Providing customer support, investigating complaints, resolving disputes and communicating transaction or account status.
• Detecting, preventing and investigating fraud, scams, identity misuse, unauthorised access, suspicious activity and other threats.
• Meeting applicable legal, regulatory, tax, reporting, audit and record-keeping obligations, including responding to lawful requests from competent authorities.
• Protecting FalconPay’s customers, services, staff and legal rights, and enforcing applicable terms and conditions.
• Maintaining, troubleshooting, testing and improving service reliability, usability, security and performance.
• Sending operational notices, transaction confirmations, security alerts, service updates and, where permitted, promotional communications subject to applicable preferences and opt-out rights.
• Conducting risk assessment, transaction monitoring and compliance reviews, including reviewing relevant patterns or deviations where necessary for fraud prevention, security or legal compliance.

FalconPay does not disclose personal data indiscriminately. We share it where necessary for the purposes described in this Policy, where you request or authorise a transaction, or where disclosure is otherwise lawful.

4.1Banks, payment partners and service providers

Depending on the service, we may share relevant information with banks, payment processors, wallet or payment infrastructure providers, bill-payment partners, cloud-hosting providers, identity and address verification agencies, fraud-prevention providers, customer-support providers and technical service providers. The information shared is limited to what is reasonably necessary for the relevant service or purpose.

4.2Regulators, law enforcement and legal processes

We may disclose information to competent regulators, supervisory authorities, law enforcement agencies, courts or other authorised bodies where required or permitted by applicable law, a valid legal process or a lawful regulatory request. We assess requests and disclose information in accordance with applicable law.

4.3Professional advisers and business changes

Where necessary and subject to appropriate confidentiality protections, information may be shared with professional advisers, auditors or parties involved in a corporate restructuring, merger, acquisition or transfer of business assets, subject to applicable legal and regulatory requirements.

4.4Service provider responsibilities

Where a provider processes personal data on our behalf, we seek appropriate contractual and security protections. Some recipients may act as independent controllers for their own legally defined purposes; their handling of personal data may also be governed by their own privacy notices and applicable law.

5.1Security measures

FalconPay uses technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. Measures may include access restrictions, authentication controls, monitoring, secure handling procedures and vendor safeguards appropriate to the nature of the data and the risks involved. No electronic transmission or storage system can be guaranteed to be completely secure.

5.2Cross-border transfers

Where personal data is transferred outside Nigeria, FalconPay will handle the transfer in accordance with applicable data protection law and the relevant requirements for international transfers, including applicable safeguards where required.

Subject to the conditions, exceptions and limitations set out in applicable law, you may have the right to:

• Request access to personal data we hold about you and information about how it is processed.
• Request correction or completion of inaccurate or incomplete personal data.
• Request erasure of personal data where the legal conditions are met.
• Request restriction of certain processing or object to processing where permitted by law.
• Request data portability where the legal and technical conditions apply.
• Withdraw consent where processing relies on consent.
• Object to direct marketing and use the available opt-out mechanism.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data protection rights have been infringed.

6.1How to make a request

You may submit a privacy request through FalconPay’s official customer-support channels published on its website or within the app, where available. Please identify the request you wish to make and provide information reasonably necessary for us to verify your identity and locate the relevant records. We will respond within the timeframe required by applicable law. If we cannot fully comply, we will explain the reason where legally required and inform you of any applicable review or complaint route.

6.2Limits on certain rights

Privacy rights are not absolute. A request may be limited or declined where permitted by law, including where data must be retained for legal or regulatory obligations, is required for a lawful investigation, or is needed to establish, exercise or defend legal claims. Deleting data from a user-facing account does not necessarily mean that all underlying records can be immediately erased.

FalconPay retains personal data only for as long as reasonably necessary for the purpose for which it was collected, taking account of applicable legal, regulatory, tax, accounting, security and dispute-resolution requirements. Retention periods depend on the type of information, the purpose of processing and the applicable circumstances.

Retention considerations may include:

• Identity, KYC and verification records retained to meet applicable customer due diligence and regulatory obligations.
• Transaction, settlement, reconciliation and account records retained to meet financial, accounting, audit and regulatory requirements.
• Fraud, dispute, complaint, legal-process and investigation records retained for the duration reasonably necessary to investigate, resolve or document the matter and meet applicable legal obligations.
• Technical logs and support records retained for security, troubleshooting, service improvement and other legitimate purposes for an appropriate period.

When personal data is no longer required, FalconPay will take appropriate steps to securely delete, destroy or anonymise it, unless further retention is required or permitted by law. Specific retention periods may vary where a legal hold, investigation or other lawful requirement applies.

FalconPay may use automated tools, rules or analytical methods to support transaction processing, security monitoring, fraud detection, risk assessment and regulatory compliance. These tools may flag activity for additional verification or review. Where a decision with legal or similarly significant effects is based solely on automated processing, FalconPay will apply the safeguards required by applicable law, which may include providing relevant information, enabling a request for human review or allowing the individual to express their point of view, where applicable.

Risk indicators are used for legitimate security and compliance purposes and are not, by themselves, a determination that a customer has committed fraud or other wrongdoing.

FalconPay or its service providers may use cookies, software development kits, diagnostic tools or similar technologies in its website or app to support functionality, security, troubleshooting, analytics and service performance, where these technologies are used. The information collected depends on the technology and your settings. Where consent is required, it will be requested. You may be able to manage certain permissions through your device or browser settings; disabling some technologies may affect service functionality.

We may send messages necessary to operate your account, process transactions, protect security or inform you about material service changes. These operational communications are distinct from promotional messages. Where FalconPay sends direct marketing, it will do so in accordance with applicable law and provide a suitable way to opt out. Opting out of marketing will not prevent essential service or security communications.

FalconPay’s services are intended for individuals who meet the eligibility requirements applicable to the relevant service. Where a service is not available to a person because of their age or legal capacity, they should not register for or use that service. If FalconPay becomes aware that personal data has been collected in circumstances contrary to applicable age or consent requirements, it will assess and address the matter in accordance with applicable law.

FalconPay may update this Policy to reflect changes in its services, technology, data-processing practices or legal and regulatory requirements. The latest version and its effective date will be published through FalconPay’s official channels. Where changes are material, FalconPay will provide notice through appropriate channels as required by applicable law. We encourage you to review this Policy periodically.