Privacy Policy

At NOVASPHERE TECHNOLOGY SOLUTIONS LIMITED (“we” or “us” or “our”), we believe in transparency about how we handle your information because we respect the privacy of our users (“user” or “you”).

This Privacy Policy explains how we collect, use, process, disclose, and safeguard your information when you use our SMS-based financial service and mobile application, PayyMe, in Nigeria (“PayyMe”).

Please read this Privacy Policy carefully. We reserve the right to make changes to this Privacy Policy at any time and for any reason. We will alert you about any changes via in-app notifications, SMS, or other appropriate communication channels. You are encouraged to periodically review this Privacy Policy to stay informed of updates.

Our commitment to your privacy is unwavering, and we have designed our practices to comply with the Nigeria Data Protection Act (NDPA) and other applicable Nigerian laws.

This Policy takes effect from 6th October, 2025, and may be updated periodically as our services evolve across both the SMS platform and mobile application.

1. The information we collect and why

We may collect information about you in a variety of ways. The information we may collect via our financial services depends on the service you use and includes:

Personal Identification Information

When you engage with our SMS-based financial services or mobile application, we may need certain personally identifiable information to serve you effectively. This includes:

Full name, username and PayyMe tag
Date of birth, gender, marital status and nationality
National Identification Number (NIN)
Bank Verification Number (BVN)
Phone number and email address
Address, state and local government area
Profile photo
Identity verification images and documents, including your selfie, identification documents and proof of address

If you use PayyMe for a business, we also collect business details, business bank account details, branch details and details of the staff you add.

We also gather transaction-related information including your:

Transaction history
Account balances
Transfer details and saved beneficiaries
Payment requests, split bills, escrow activity and disputes
Payment data

Additionally, we collect certain technical information such as mobile network details, device type, operating system, app version, IP address, and unique device identifiers that help us deliver both our SMS and mobile app services securely and efficiently.

We obtain this information through several channels: when you register for our service, execute transactions via our SMS shortcodes or mobile application, interact with our customer service team, or through information provided by authorized third parties such as banks and mobile network operators. All information collection is designed to be minimally intrusive while ensuring we can provide secure and efficient financial services.

That information, along with other personally identifying information about you, will be shared internally and may also be shared externally with our compliance, banking, aggregation, and product-offering partners that undertake automated reviews of your information:

Against relevant government-maintained sanctions lists and lists of politically exposed persons,
For purposes of facial recognition against government provided identification documents,
For accuracy against national databases,
For confirming your identity against other relevant databases such as those maintained by companies providing credit reports, and
For the purpose of monitoring transactions for fraudulent and other illegal activities.

Derivative Data

This refers to information our servers automatically collect when you access or use PayyMe, whether through our SMS platform or mobile application. Such information includes your native actions that are integral to your use of PayyMe, as well as other interactions with PayyMe and other users, which may be captured through server log files, analytics tools, or system monitoring.

Financial Data

Financial information, such as data related to your mobile money account, linked bank account, digital wallet, or payment method, may be collected when you purchase, order, return, exchange, or request information about our services through PayyMe.

If you link a bank card, the card details you enter are encrypted before they are stored, strictly in line with regulatory requirements for safeguarding such information. Other financial information is securely stored and processed by our authorized payment processor(s).

Mobile Device Access

When you use the PayyMe mobile application, we may request access or permission to the following features on your mobile device:

Camera, for the “selfies” used for identity verification and for photographing documents and profile pictures. The app does not record audio.
Photos and files, when you choose an image or document to upload, such as a profile photo or proof of address.
Contacts, to show you which of the people in your phone contacts use PayyMe so that you can send money to them or request money from them. When you allow this, the phone numbers in your contacts are sent securely to our servers, compared with registered PayyMe accounts, and the matching accounts are returned to your app. We do not store the contact list on our servers, and we do not use it for marketing. Contact names and photos are not sent.
Biometrics, to let you sign in and approve actions with your fingerprint or face, if you enable it.
Notifications, to send you push notifications.

The PayyMe mobile application does not read your SMS or MMS messages and does not collect your precise GPS location.

If you wish to change our access or permissions, you may do so in your device’s settings at any time. Please note that we may collect your device fingerprint or unique device identifier to recognize the specific device used for both our mobile application and SMS-based transactions, enhancing the overall security of your account.

Mobile Device Data

Information such as your mobile device ID number, model, and manufacturer, version of your operating system, phone number, country, and any other data you choose to provide. This information helps us optimize service delivery, ensure compatibility across different devices, and enhance the security and performance of PayyMe.

Communication Data

We may collect and store records of your communications with us across all our service channels, including SMS, MMS, emails, in-app chat messages, and customer support interactions. This may include your email address, chat transcripts, support tickets, or feedback messages shared through PayyMe.

We use this information solely to help resolve issues, improve customer support quality, and enhance your overall experience on both our SMS-based platform and mobile application.

Push Notifications

When using the PayyMe mobile application, we may request permission to send you push notifications regarding your account, transactions, security alerts, or important updates related to PayyMe. If you wish to opt out of receiving these types of notifications, you may turn them off at any time within the application settings.

For users of our SMS-based service, similar updates and alerts may continue to be sent via SMS, in accordance with your existing preferences and applicable communication settings.

Authentication and Security Data

To safeguard your account and prevent unauthorized access, we may collect certain authentication and security information when you use PayyMe. This includes encrypted passwords, PINs, login credentials, the selfie used for face verification, and authentication tokens or device security keys.

If you enable fingerprint or face sign-in, the check is carried out by your device. Your fingerprint and face unlock data stay on your device and we do not receive them; we only record that biometric sign-in is enabled and which type you chose.

This information is used exclusively for identity verification, fraud prevention, and secure access to your PayyMe account across both our mobile application and SMS service.

Cookies and Tracking Technologies

Our mobile application may use cookies, software development kits (SDKs), and similar tracking technologies to enhance user experience, maintain sessions, remember preferences, and analyze app usage patterns. These include Google Firebase SDKs, which provide push notifications, app analytics and crash diagnostics, and which may process app usage events, device information, app instance identifiers and your device’s advertising ID.

These technologies help us understand how users interact with PayyMe, diagnose technical issues, and improve app performance. You can manage or disable cookies and related tracking technologies through your device or browser settings, including resetting or deleting your advertising ID, though some features of PayyMe may not function optimally if you do so.

Third Party Data

Information from third parties, such as personal information or network friends, if you connect your account to the third party and grant the Application permission to access this information.

Data from Contests, Giveaways, and Surveys

Personal and other information you may provide when entering contests or giveaways and/or responding to surveys.

2. How we collect your information

We collect your information through:

Registration processes on our SMS service or mobile application
Transactions executed via our SMS shortcodes or through the PayyMe app
Customer service interactions, including calls, messages, or in-app support
Information provided by authorized third parties such as banks, financial institutions, and mobile network operators
Verification with external databases (e.g., BVN, NIN, and other government-approved data sources)

3. How we use your information

Your information enables us to provide the financial services you expect. We use it primarily to process your money transfers and maintain your account. Your personal details allow us to verify your identity in accordance with Know Your Customer (KYC) requirements set by Nigerian financial authorities. We also analyze transaction patterns to protect you from fraud and manage risk.

Communication is essential to our service, so we use your contact information to send important updates about your account and transactions. When problems arise, your information helps us resolve disputes and troubleshoot technical issues. Additionally, we must maintain certain records to comply with Anti-Money Laundering (AML) regulations and other financial laws in Nigeria. Finally, we analyze usage patterns to improve our existing services and develop new features that better meet your needs.

Having your accurate information permits us to provide you with a smooth, efficient, and customized experience. Specifically, we may use information collected about you via PayyMe for the following purposes:

To provide, operate, and maintain our SMS-based and mobile financial services
To process transactions, payments, and money transfers
To verify your identity in compliance with Know Your Customer (KYC) requirements
To authenticate information and perform anti-fraud, anti-terrorism, and other safety and security reviews
To comply with regulatory obligations, including Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) regulations
To prevent fraudulent transactions, monitor against theft, and protect against criminal activity
To communicate with you regarding your account, transactions, and updates to PayyMe
To respond to product or customer service requests and provide technical support
To resolve disputes and troubleshoot issues
To process payments, refunds, or reversals where necessary
To create and manage your PayyMe account
To generate and maintain a personal profile to make future visits and transactions more personalized
To compile anonymous statistical data and analysis for internal use or with authorized third parties
To monitor and analyze usage and trends to improve user experience
To increase the efficiency and overall operation of PayyMe
To improve existing services and develop new features, products, or tools
To notify you of updates, security alerts, and service changes
To deliver targeted advertising, coupons, newsletters, and other information regarding promotions and PayyMe to you
To send you account-related emails, SMS, or in-app notifications
To enable user-to-user communications within the app (where applicable)
To request feedback and contact you about your use of PayyMe
To offer new products, services, mobile applications, and/or personalized recommendations
To perform other lawful business activities as required to support our operations
To send you a newsletter
To solicit support for PayyMe

4. Automated decision making

We use an automated decision-making system to determine whether a user has provided appropriate authentication to engage with PayyMe, including verification of personally identifiable information (“PII”). This includes:

Matching PII against national databases, publicly available information, sanctions lists, lists of politically exposed persons and other databases that provide information on potentially illegal activity;
Comparison by facial recognition of your selfie image against the image provided with your identification document or other database containing your image;
Reading the proof of address document you upload with an artificial intelligence document-reading service, to check that it is an address document and that the address on it matches the address on your profile; and
Tracking your PII in the context of automated monitoring of transactions undertaken by you to look for potentially fraudulent or illegal activity.

In the event that we receive an automated report that there is a discrepancy, insufficiency or inaccuracy in the information provided by you, we receive a response from a service provider that your information appears on a list that prohibits our engaging with you, suggests the potential for fraudulent or illegal activity, or if our automated transaction monitoring uncovers the potential for your transactions to be fraudulent or illegal, our compliance and customer service teams will engage to review the background information that generated the automated response and determine if the information provided about you is incorrect and we can proceed to either onboard you as a user or continue to allow your use of PayyMe and if there is still a need for additional information, we may also contact you (most likely via SMS message, in-app notification, or email) to seek additional information or clarification where necessary to verify your identity, process a transaction, or ensure compliance with applicable regulatory requirements. If we are unable to continue with you as a user on our platform, we may provide you with the basis for the decision.

You have the right not to be subject to a decision based solely on automated processing, including profiling, which has legal consequences for you or similarly significant effects. While we’re confident that the technology works, we understand that not everyone is comfortable with decisions being left entirely up to machines.

You have the right to object to an automated decision and ask that a person reviews it and/or to ask that we do not make our decision based on the automated score alone. If you want to know more about these rights or have any questions about our automated decision-making processes, please contact us using the details at the end of this Privacy Policy.

5. Legal basis for using your personal information

Under the Nigeria Data Protection Act, we can only use your personal information if we have a proper reason for doing so. In order to use your personal information, we rely on the following legal bases:

Performance of the service contract between you and us. Processing is necessary for us to be able to provide our products and services to you in accordance with our Terms of Use;
processing is necessary to comply with our legal obligations;
processing is necessary for the purposes of legitimate business interests pursued by us, where these do not override your rights and freedoms; and
you have provided consent to the processing of your personal data for a specific purpose.

Providing comprehensive financial services requires collaboration with trusted partners. We may share your information with service providers who help us deliver specific aspects of our service, as listed below. All these partners are bound by strict confidentiality agreements.

As a financial service provider in Nigeria, we’re obligated to share certain information with regulatory authorities including the Central Bank of Nigeria (CBN) and the Nigerian Financial Intelligence Unit (NFIU). We may also share data with other financial institutions to complete your transactions, and with law enforcement agencies when legally required.

In all cases, we limit sharing to what is necessary and ensure appropriate safeguards are in place. At no time will our database of users ever be sold to any entity for the purpose of marketing or mailing lists.

Specifically, we may share your personal information with:

Service Providers

Payment processors, banks and payment aggregators
Mobile network operators
Messaging providers that deliver our SMS, WhatsApp and email messages
Identity verification services
Artificial intelligence document-reading services, which receive the proof of address documents you upload and the address on your profile
Cloud hosting and file storage providers
Push notification, analytics and crash diagnostics providers

By Law or To Protect Rights

If we believe the release of information about you is necessary to respond to legal process, comply with regulatory authorities, to investigate or remedy potential violations of our policies, or to protect the rights, property, and safety of others, we may share your information as permitted or required by any applicable law, rule, or regulation.

This includes exchanging information with other entities for financial regulation, fraud protection, prevention of terrorism, anti-corruption, money laundering, and credit risk reduction including but not limited to:

Government authorities like the Central Bank of Nigeria, Nigerian Financial Intelligence Unit (NFIU), and other regulatory bodies required by law;
to companies for the purpose of reviewing your information against relevant government-maintained sanctions lists, lists of politically exposed persons, and persons of special interest (adverse media);
to third-party companies for purposes of facial recognition against government-provided identification documents and/or for confirming accuracy against national databases;
to third-party companies for confirming your identity against other relevant databases such as those maintained by companies providing credit reports;
to third parties for the purpose of monitoring transactions for potentially fraudulent and illegal activities;
The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance or employment; and,
to banking partners, aggregators, product and service-providing partners, and others for the purpose of their independent performance of the activities set forth in the subsections immediately above.

Third-Party Service Providers

We may share your information with third parties that perform services for us or on our behalf, including financial institutions to complete transactions, law enforcement agencies when legally required, payment processing, data analysis, email delivery, hosting services, customer service, and marketing assistance.

All third parties that process data on our behalf are required to maintain the confidentiality and security of your data.

Marketing Communications

Where it is necessary for our legitimate business interests, we may use your personal data to promote our products or services to you. Where you have provided your consent, we may also share your information with third parties for marketing purposes, as permitted by law.

You may withdraw your consent to receive marketing messages at any time by setting your preferences in PayyMe settings, or by following the opt-out link contained in our marketing emails.

Interactions with Other Users

If you interact with other users of PayyMe, those users may see your name, profile photo, and descriptions of your activity, including sending invitations to other users, chatting with other users, and/or engaging with social media posts. People you pay or request money from may also see your name, PayyMe tag and the details of that payment or request.

Third-Party Advertisers

We may use third-party advertising companies to serve ads when you visit PayyMe. These companies may use information about your visits to PayyMe and other websites that are contained in web cookies in order to provide advertisements about goods and services of interest to you.

Affiliates

We may share your information with our affiliates. Affiliates include our parent company (Novasphere Technology Solutions Ltd.) and any subsidiaries, joint venture partners or other companies that we control or that are under common control with us.

Business Partners

With your consent, we may share your information with our business partners to offer you certain products, services or promotions.

Other Third Parties

We may share your information with advertisers and investors for the purpose of conducting general business analysis.

Sale or Bankruptcy

If we reorganize or sell all or a portion of our assets, undergo a merger, or are acquired by another entity, we may transfer your information to the successor entity. If we go out of business or enter bankruptcy, your information would be an asset transferred or acquired by a third party. You acknowledge that such transfers may occur and that the transferee may decline to honor commitments we made in this Privacy Policy.

We are not responsible for the actions of third parties with whom you share personal or sensitive data, and we have no authority to manage or control third-party solicitations. If you no longer wish to receive correspondence, emails or other communications from third parties, you are responsible for contacting the third party directly.

7. Data retention and security

We understand the sensitive nature of financial data and implement robust measures to protect it. Your personal information is retained only as long as needed to provide our services or as required by Nigerian law—typically five years for transaction records (per CBN regulations) and seven years for tax-related information.

To safeguard your data, we employ appropriate organizational and industry-standard security measures including encryption of sensitive information, strict access controls and authentication measures, regular security assessments, comprehensive staff training on cybersecurity and data protection, and secure SMS protocols. These measures are regularly reviewed and updated to address emerging threats.

While we have taken reasonable steps to secure the personal information you provide to us, please be aware that despite our efforts, no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against any interception or other type of misuse. Any information disclosed online is vulnerable to interception and misuse by unauthorized parties. Therefore, we cannot guarantee complete security if you provide personal information.

8. Closing your account and deleting your data

You can close your PayyMe account from inside the app:

Open the PayyMe app and sign in.
Go to Settings and select Close Account.
Follow the steps shown on the screen to confirm.

Your account can be closed once every wallet is empty, including any held funds, and you have had no transaction in the last 14 days. A recent transaction can still be reversed, charged back or disputed, and those need a live account. The app tells you if anything is preventing closure.

Once your account is closed you can no longer sign in, send or receive money, and any branch staff on your business lose access. Your transaction history is kept.

If you cannot use the app, or you want us to delete personal data that we are not required to keep, email legal@novasphereltd.com from the email address on your account, or tell us the phone number on it. We keep the records we must keep by law, such as transaction and KYC records, for the periods described in section 7.

9. Your rights and choices as a data subject

The Nigeria Data Protection Act (NDPA) grants you significant control over your personal information. You have the right to:

Be informed and provided with clear, transparent and easily understandable information about how we use your information and your rights. This is why we’re providing you with the information in this Privacy Policy
Access your personal information
Request correction of inaccurate data
Request deletion of your data (subject to legal requirements)
Object to certain processing of your data
Request restriction of processing (how we use your information)
Data portability (transfer your data to other service provider)
Withdraw consent at any time, though this may affect our ability to provide certain services

To exercise any of these rights, simply contact our Data Protection Officer using the details provided at the end of this Policy. We’re committed to addressing your concerns promptly and transparently.

10. People who do not have a PayyMe account

A PayyMe user may send a payment request to someone who does not have an account. In that case we use the phone number the user entered to deliver the request, including by WhatsApp or SMS.

If you pay a request through its payment link, we receive the name on the account you paid from, the amount and, where we ask you to confirm your payment, the last four digits of that account. We use this information to match your payment to the request, and we keep it as part of the transaction record described in section 7. You can use the details in section 16 to exercise your rights.

11. International aspects of data protection

In today’s interconnected world, data sometimes needs to flow across borders. Some of our service providers, including providers of cloud storage, messaging, push notifications, analytics and artificial intelligence document reading, operate outside Nigeria. When we transfer your information outside Nigeria, we implement appropriate safeguards in compliance with the NDPA. These include:

Data transfer agreements with standard contractual clauses
Ensuring recipient countries have adequate data protection regulations
Obtaining your explicit consent where required

12. Policy for children

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

13. Opting out of communications

If you no longer wish to receive correspondence, emails, or other communications from us, you may opt out by:

Noting your preferences at the time you register your account with PayyMe
Logging into your account settings and updating your preferences
Contacting us using the contact information provided below

If you no longer wish to receive correspondence, emails, or other communications from third parties, you are responsible for contacting the third party directly.

14. SMS-specific privacy considerations

Our SMS-based service has unique privacy considerations. We collect session data limited to specific SMS interactions and never store SMS PIN codes or OTPs in plaintext. We’ve designed our service to collect only information that’s necessary for functionality, implemented automatic timeouts for inactive sessions, and provide clear instructions on how to end SMS sessions securely to protect your privacy.

15. Evolving with changing needs

As technology advances and regulations evolve, we may update this Privacy Policy to reflect changes in our practices or legal requirements. We’ll notify you of any significant changes through in-app notifications, SMS alerts, updates on our website, or other appropriate communication channels, giving you the opportunity to review the revised policy before continuing to use our services.

16. Contact information

Our users’ privacy is very important to us. We are committed to safeguarding the information entrusted to us and will continually update this policy to ensure that users’ rights with regards to personal information are respected. If you have questions or comments about this Privacy Policy, please contact us at legal@novasphereltd.com.

17. Your agreement with this policy

By using our services, including PayyMe, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal information as described here. Your trust is important to us, and we’re committed to managing your information responsibly.