Privacy Policy
How we collect, use, and protect your information.
We believe transparency builds trust. This policy explains your rights and our responsibilities.
In Summary
- We only collect information necessary to provide our services.
- Your personal information is protected using industry-standard security measures.
- We never sell your personal information to third parties.
- You control your privacy preferences and can exercise your rights at any time.
- We comply with applicable data protection regulations.
- You can request access, correction, or deletion of your data.
This summary is for convenience. Please read the full policy below.
1. Introduction
This Privacy Policy explains how Xtremify Innovations Limited, trading as xtrempay("we", "us", "our"), collects, uses, discloses, and protects personal data when you use the xtrempay mobile application, our website at www.xtrempay.com,and related services (collectively, the "Services"). This Privacy Policy should be read together with our Terms of Service and Cookie Policy.
We process personal data in accordance with the Nigeria Data Protection Act 2023 ("NDPA"), the regulations and guidance issued by the Nigeria Data Protection Commission ("NDPC"), and other applicable data protection and financial services laws in Nigeria, including regulations issued by the Central Bank of Nigeria ("CBN") relevant to know-your-customer ("KYC") and anti-money laundering ("AML") obligations.
2. Who We Are
The data controller responsible for your personal data is Xtremify Innovations Limited, a company incorporated under the laws of the Federal Republic of Nigeria. You can contact our Data Protection Officer using the details in Section 15.
Xtremify Innovations Limited
Trading As: xtrempay
Incorporated: Federal Republic of Nigeria
Data Protection Officer: See Section 15
Email: support@xtrempay.com
For the purposes of the NDPA, Xtremify Innovations Limited is the data controller responsible for your personal data.
3. Information We Collect
We collect different types of information depending on how you interact with our Services:
3.1 Information You Provide to Us
a) Identity information: full name, date of birth, gender, phone number, email address, username, and password;
b) Verification (KYC) information: Bank Verification Number ("BVN"), government-issued identification (e.g., National ID, driver's licence, international passport, voter's card), facial biometric data captured during identity verification, and, where applicable, business name and business registration information;
c) Financial information: linked bank account details, wallet balance, savings goals, and transaction instructions you provide when making transfers, bill payments, airtime or data purchases, or electricity payments;
d) Communications: messages, feedback, and information you provide when contacting our customer support team; and
e) Marketing preferences: information you provide when subscribing to updates about live draws, trivia events, or other promotions.
3.2 Information Collected Automatically
a) Transaction data: records of deposits, withdrawals, transfers, bill payments, and Reward Feature participation (raffle tickets, trivia results, spins, and prizes won);
b) Device and technical data: device identifiers, IP address, operating system, browser type, mobile network information, and app version;
c) Usage data: log-in times, features used, pages visited, and interactions with the app or Site; and
d) Cookies and similar technologies, as described in our Cookie Policy.
3.3 Information from Third Parties
We may receive information about you from our Partner Institutions, payment processors, identity verification providers, credit reference agencies, and fraud-prevention service providers, to the extent necessary to provide the Services and meet our regulatory obligations.
4. How We Collect Your Information
We collect information directly from you when you register for an account, complete KYC verification, use the Services, or contact us; automatically through your use of the app and Site; and from the third parties described in Section 3.3.
5. Legal Basis and Purpose of Processing
We process your personal data on one or more of the following legal bases under the NDPA:
| Legal Ground | Description of processing |
|---|---|
| Performance of a Contract | To create and administer your account and to provide the Services you request, including wallet, savings, and payment functions. |
| Legal Obligation | To comply with KYC, AML, CTF, tax, and other regulatory obligations under CBN regulations and other applicable Nigerian law. |
| Legitimate Interests | To detect and prevent fraud, secure our systems, improve and personalise the Services, and operate the Reward Features responsibly, provided that these interests are not overridden by your data protection rights. |
| Consent | For direct marketing communications and certain non-essential cookies, which you may withdraw at any time as described in Section 11 and our Cookie Policy. |
You may withdraw consent at any time as described in Section 11 and our Cookie Policy, without affecting the lawfulness of processing based on consent before withdrawal.
6. How We Use Your Information
We use your information to:
- Create, verify, and administer your account, including completing KYC and BVN verification
- Process transactions you initiate, including transfers, bill payments, airtime and data purchases, and Reward Feature participation
- Communicate with you about your account, transactions, security alerts, and customer support enquiries
- Send you information about live draws, trivia events, promotions, and other updates, where you have consented to receive such communications
- Monitor, investigate, and prevent fraud, money laundering, and other unlawful activity
- Comply with our legal and regulatory obligations, including responding to lawful requests from regulators or law enforcement
- Analyse and improve the performance, security, and user experience of the Services
7. Sharing and Disclosure of Information
We do not sell your personal data. We may share your information with:
7.1 Partner Institutions — Licensed banks, microfinance banks, or payment service providers that facilitate wallet custody, transfers, and payment processing on our behalf.
7.2 Service Providers — Identity verification providers, cloud hosting providers, analytics providers, customer support tools, and other vendors who process data on our behalf and under our instructions.
7.3 Regulators and Law Enforcement — The CBN, the NDPC, courts, and other governmental or regulatory authorities, where required by law or to protect our legal rights.
7.4 Professional Advisers and Business Transfers — Our lawyers, auditors, and other professional advisers, where necessary; and
7.5 Business Transfers — a successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality and data protection safeguards.
8. International Data Transfers
Where we or our service providers process or store personal data outside Nigeria (for example, using cloud infrastructure located abroad), we will ensure that such transfers comply with the NDPA, including through the use of appropriate contractual safeguards, adequacy determinations, or other lawful transfer mechanisms recognised by the NDPC.
9. Data Security
Data Security Commitment
We implement technical and organisational measures designed to protect your personal data against unauthorised access, loss, misuse, or alteration, including encryption, access controls, two-factor authentication ("2FA"), and regular security reviews.
However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Data Retention
We retain your personal data for as long as necessary to provide the Services, to comply with our legal and regulatory obligations (including CBN record-keeping requirements, which may require retention of transaction and KYC records for a minimum period following account closure), to resolve disputes, and to enforce our agreements.
When personal data is no longer required, we will securely delete or anonymise it.
11. Your Rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate or incomplete data
- Request erasure of your data, subject to our legal and regulatory retention obligations
- Restrict or object to certain processing of your data, including direct marketing
- Request a copy of your data in a portable format, where technically feasible
- Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal
To exercise any of these rights, please contact us using the details in Section 15. We may need to verify your identity before responding to your request.
12. Children's Privacy
The Services are not directed at, and are not intended for use by, individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a person under 18, we will take steps to delete that information.
13. Cookies and Tracking Technologies
We use cookies and similar tracking technologies on our Site and app to operate, secure, and improve the Services, and, where you consent, for analytics and marketing purposes. Full details are set out in our Cookie Policy.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify you of material changes through the app, by email, or by posting an updated version on the Site, together with the date it was last updated.
15. How to Contact Us
If you have questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us at:
Xtremify Innovations Limited
Trading as Xtrempay
16. Complaints
If you are not satisfied with how we have handled your personal data or responded to a request, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or another competent supervisory authority. We encourage you to contact us first so that we can try to resolve your concern directly.
