Privacy Policy
This Privacy Policy outlines how MaduPay Technologies Ltd ("MaduPay", "we", "us", or "our") collects, processes, stores, and protects your personal and financial information when you access our web application, APIs, and digital wallet services.
1. Regulatory Scope & Principles
MaduPay Technologies Ltd is committed to maintaining the confidentiality, integrity, and availability of personal data in strict compliance with the Nigeria Data Protection Act (NDPA 2023), the Nigeria Data Protection Regulation (NDPR), Central Bank of Nigeria (CBN) regulatory guidelines, and international data security best practices.
By creating an account, funding your wallet, or using any MaduPay utility service, you acknowledge that your personal information will be processed as described in this policy.
2. Information We Collect
We collect personal information to deliver high-availability bill payment, budgeting envelope isolation, and KYC compliance. This includes:
A. Personal Identity & KYC Information
Full legal name, email address, mobile telephone number, password hashes (Bcrypt encrypted), and Bank Verification Number (BVN) provided solely for Tier KYC verification and automated Monnify virtual account generation.
B. Financial & Transactional Data
Wallet balances (Total, Locked, Safe-to-Spend), Dedicated Virtual Account numbers, Paystack transaction references, budgeting envelope allocations, and scheduled recurring transaction parameters.
C. Utility & Destination Identifiers
Recipient phone numbers for airtime/data top-ups, DISCO prepaid and postpaid meter numbers (e.g. IKEDC, EKEDC, AEDC), Cable TV smartcard/IUC numbers (DSTV, GOTV, StarTimes), and candidate registration profile codes for Exam E-Pins.
D. Technical & Security Telemetry
IP addresses, login timestamps, device operating system and browser headers, failed attempt logs for brute-force rate limiting, and webhook verification signatures.
3. Purpose & Legal Basis for Processing
We process your personal data under the following lawful bases established by the NDPA 2023:
- Contractual Necessity: To fulfill utility orders, credit virtual account transfers, dispatch electricity tokens, and execute scheduled QStash bill automations.
- Legal & Regulatory Compliance: To satisfy anti-money laundering (AML/CFT) laws, CBN KYC compliance rules, and fraud monitoring mandates.
- Legitimate Business Interests: To optimize provider routing, prevent unauthorized access via security logs, and maintain system uptime.
- User Consent: For real-time push and email notifications regarding transaction receipts and security alerts.
4. Payment & Financial Security
Zero Card Data Retention Guarantee
MaduPay does NOT store, process, or transmit raw debit card numbers, expiration dates, or CVV/CVC security codes on our servers. All card transactions are tokenized and processed directly by Paystack, a PCI DSS Level 1 certified payment gateway.
Your 4-digit Transaction PIN is hashed with irreversible cryptographic algorithms (Bcrypt with salt rounds). MaduPay employees, administrators, and automated tools have no access to your raw Transaction PIN or login password.
5. Third-Party Sub-Processors
To deliver utility fulfillments with automated provider failovers, we securely transmit the minimal necessary data (such as meter number, phone number, or network package) to verified third-party aggregators:
- Banking & Gateway Partners: Monnify (TeamApt/Moniepoint MFB / Wema Bank), Paystack Payments Ltd.
- Infrastructure & Queue Processors: Upstash QStash (encrypted cron scheduling), Neon PostgreSQL (database clustering), Pusher Channels (real-time encrypted event dispatch).
We enforce strict Data Processing Agreements (DPAs) requiring all sub-processors to maintain confidentiality and technical safeguards consistent with NDPR and international standards. We never sell your personal data to advertisers.
6. Data Retention & Erasure
Financial and transaction records are retained for a statutory minimum of five (5) years following account closure to comply with Nigerian Anti-Money Laundering (AML) regulations and CBN audit guidelines.
Upon verified request for account deletion, all non-statutory personal identifiers (including phone numbers, email addresses, and temporary tokens) are permanently anonymized or deleted from our active databases.
7. Your Data Subject Rights
Under the Nigeria Data Protection Act 2023, you hold enforceable rights regarding your personal data:
Right to Access
Request a copy of your stored personal and transaction data.
Right to Rectification
Correct inaccurate or incomplete profile information.
Right to Erasure
Request deletion of data subject to statutory AML retention rules.
Right to Object
Opt out of non-essential marketing emails or data processing.
9. Contact Data Protection Officer
To exercise any of your data rights, report a privacy concern, or submit a compliance inquiry, please contact our Data Protection Team:
MaduPay Technologies Ltd — Data Privacy Office
Email: privacy@madupay.ng
General Support: support@madupay.ng
Website: https://madupay.ng