Privacy Policy

Effective date: [INSERT THE DATE YOU PUBLISH THIS]

1. Introduction

This Privacy Policy explains how FloZap (“FloZap”, “we”, “us”, “our”) — operated by FloZap Digital Solutions Limited, a company registered in Nigeria — collects, uses, shares and protects your personal information when you use the FloZap mobile app, the website at www.flozap.com.ng, and the services offered through them (the “Platform”).

We are the data controller for the personal information described here. That means we decide why and how it is used, and we are responsible for looking after it.

By using FloZap you acknowledge this Policy. Where the law requires your consent for a specific use (for example processing your selfie for identity verification), we ask for it separately.

2. The information we collect

2.1 Information you give us when you sign up

• First name and last name
• Email address
• Phone number
• Password (stored only in scrambled/“hashed” form — we never see or store the actual password)
• Transaction PIN (also stored only in hashed form)

2.2 Identity verification information (KYC)

To meet legal “Know Your Customer” and anti‑money‑laundering requirements, and depending on the account tier you request, we collect and process:

• Bank Verification Number (BVN) and the identity details returned against it by our verification provider: your name, date of birth, gender, phone numbers, residential address, state and local government of origin and of residence, marital status, nationality, title, enrolment details, and your regulatory watchlist status.
• National Identification Number (NIN) and the identity details returned against it, including the name and photo held on your NIN record.
• A live selfie photo, together with the automated results of a liveness check (is a real person present) and a face‑match check(does the selfie match your NIN photo). These selfie‑based checks are a form of biometric processing.
• For higher‑tier verification: your residential address and a government‑issued ID document — the ID type (NIN slip, driver’s licence, international passport or voter’s card), the ID number, and its expiry date.

We store your BVN and NIN both directly and as a one‑way “hash” (a scrambled fingerprint) so we can detect if the same BVN or NIN is used to open more than one account, without exposing the number.

2.3 Financial and transaction information

• Your FloZap Wallet balance
• Transaction records: the amount, any fee, your balance before and after, the recipient/beneficiary, the type of service, a reference number, remarks, status, and the date and time
• Bank account details you add for withdrawals or that are issued to you as a Dedicated Account: account number, account name, bank name, bank code, and the reserved‑account identifier from our partner
• Crypto information: a USDT/TRON (TRC‑20) wallet address generated for your account, and records of crypto deposits and withdrawals (amounts, network fees, transaction hashes, status)

2.4 Information from your use of the services

Depending on which services you use, we hold:

• Phone numbers you buy airtime or data for, and numbers saved as beneficiaries
• Cable smartcard/IUC numbers and electricity meter numbers, plus the customer name and address returned by the provider when you validate them, and any prepaid token issued
• For Airtime‑to‑Cash: the sending phone number, network, airtime amount and payout amount
• Referral information: your referral code, and the names and spending activity of users who signed up through your code (used to calculate your bonus)
• Support messages and anything you send us when you contact us

2.5 Information we collect automatically

• Device and technical data: your device platform (Android, iOS or web) and the push‑notification token used to send you notifications
• IP address, recorded in our security and sign‑in logs
• Activity logs of key events (sign‑ins, payments, bill purchases, data purchases, and errors). These operational logs are kept for 7 days and then automatically deleted.
• Basic app‑usage and diagnostic information needed to run and troubleshoot the Platform

We do not currently use third‑party advertising trackers or analytics SDKs in the mobile app. If that changes, we will update this Policy and, where required, ask for your consent.

2.6 Information stored on your own device

The app stores some data locally on your phone so it works properly:

• your login token, kept in your device’s secure storage
• small preferences such as whether you have hidden your balance, your saved “my number”, and recently used numbers

This data stays on your device. You can clear it by logging out or uninstalling the app.

3. How we use your information

4. Our legal grounds for using your information

Under the Nigeria Data Protection Act 2023, we rely on:

• Performance of a contract – to give you the account and services you asked for.
• Legal obligation – for KYC, anti‑money‑laundering checks, watchlist screening, record‑keeping, tax, and responding to regulators and law enforcement.
• Consent – for processing your selfie/biometric checks for identity verification, and for any optional marketing. You can withdraw consent at any time (though without identity verification we cannot offer most services).
• Legitimate interests – to prevent fraud and abuse, keep the Platform secure, and run our business, where this is not overridden by your rights.

5. Who we share your information with

We share personal information only as needed, and only with parties who are required to protect it. We do not sell your personal data.

5.1 Identity verification

• A licensed identity‑verification provider – we send your BVN, NIN, name and selfie to a specialist identity‑verification service to confirm your identity and run the liveness and face‑match checks. That service in turn draws on official identity databases (such as those operated by NIBSS for BVN and NIMC for NIN).

5.2 Payment processing

To move money into and out of your Wallet, we share the relevant transaction and account details with licensed payment processors and a dedicated‑account provider – for card payments, bank transfers, withdrawals to your bank, dedicated‑account funding, and crypto deposits.

5.3 Service fulfilment

To deliver what you buy, we share the minimum necessary details (such as the phone number, meter number or smartcard number) with the third parties that actually deliver each service – for example the mobile networks, the electricity distribution companies, the cable‑TV companies, and the wholesale airtime and data providers we buy from.

5.4 Communications and infrastructure

• Our email delivery provider – to send you transactional and verification emails
• Our push‑notification services – to deliver notifications to your device
• Our cloud hosting and database providers – to run the Platform and store data securely

5.5 Legal, regulatory and protective disclosures

We may disclose information where we reasonably believe it is necessary to:

• comply with a law, regulation, court order or lawful request from a regulator or law enforcement;
• establish, exercise or defend legal claims;
• prevent fraud, financial crime, or a threat to someone’s safety or to the security of the Platform.

5.6 Business transfers

If FloZap is involved in a merger, acquisition, financing or sale of assets, your information may be transferred as part of that deal. We will require the new owner to honour this Policy or notify you of any material change.

6. Storing and transferring information internationally

Your information is stored on cloud infrastructure that may be located outside Nigeria, and some of the providers listed in section 5 operate outside Nigeria. Where we transfer personal data abroad, we do so in line with the NDPA — either to a country with adequate protection, under contractual safeguards with the recipient, or on another lawful basis such as necessity for your contract.

7. How long we keep your information

When a retention period ends, we delete the data or irreversibly anonymise it. We may keep specific records longer where we are legally required to, or where they are needed for an ongoing dispute or investigation.

8. How we protect your information

• Data sent between the app and our servers is encrypted in transit (HTTPS/TLS).
• Passwords and Transaction PINs are stored only as salted hashes — they cannot be read, even by us.
• BVNs and NINs are additionally stored as one‑way hashes for duplicate detection.
• Your login token is kept in your device’s secure storage.
• Access to personal data by our staff is limited to those who need it to do their job.
• We monitor for suspicious activity and apply rate limits and other protections against abuse.

No system is completely secure. If we become aware of a data breach that is likely to put your rights at risk, we will notify the NDPC and affected users as required by law.

9. Automated decisions

Some identity checks are automated: our provider returns liveness and face‑match scores, and your Tier 1 / Tier 2 verification can be approved or declined automatically based on those scores and on watchlist results. Tier 3 is reviewed by a person.

If an automated check declines your verification, you have the right to ask for a human review. Contact admin@flozap.com.ng and a member of staff will look at your case.

10. Your rights

Under the Nigeria Data Protection Act 2023, you have the right to:

• access the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information (“right to be forgotten”), subject to the records we must keep by law;
• object to or ask us to restrict certain processing;
• ask for a copy of certain information in a portable format;
• withdraw consent where we relied on it (for example for biometric verification or marketing); and
• complain to the Nigeria Data Protection Commission (NDPC) if you believe we have mishandled your data — though we ask that you contact us first so we can try to put things right.

To exercise any of these rights, email admin@flozap.com.ng. We may need to verify your identity before we act. We will respond within the time required by law (generally within one month).

Note: because of our legal KYC and anti‑money‑laundering duties, we may not be able to fully delete your identity and transaction records while those obligations still apply, and we may have to keep your account restricted rather than fully erased until the retention period ends.

11. Children

FloZap is not for anyone under 18. We do not knowingly collect information from children. If we learn that we hold information about someone under 18, we will close the account and delete the data, except anything we must keep by law.

12. Marketing

We will only send you promotional messages if you have not opted out. You can opt out at any time using the unsubscribe link in an email or by contacting admin@flozap.com.ng. You cannot opt out of essential service messages (transaction alerts, security notices, and the like) while you have an account.

13. Cookies and local storage

• The mobile app does not use advertising cookies. It stores a small amount of data on your device as described in section 2.6.
• The website (www.flozap.com.ng) may use cookies that are necessary for it to function and, if we add them, optional analytics cookies for which we will ask your consent. Any dedicated cookie notice on the website forms part of this Policy.

14. Third‑party services and links

The Platform connects to services run by the companies listed in section 5, and may link to other websites. This Policy does not cover those third parties. We encourage you to read their own privacy policies. Your use of a service may also be governed by that provider’s terms.

15. Changes to this Policy

We may update this Policy from time to time. If we make a significant change, we will tell you by email or an in‑app notice before it takes effect. The “Last updated” date at the top shows when the current version was issued.

16. Contact us

If you have any question about this Policy or about how we handle your information, contact:

The Data Protection Officer, FloZap Digital Solutions Limited — Ibadan, Nigeria
Email: admin@flozap.com.ng
Phone: +234 810 387 5405
Website: www.flozap.com.ng

You also have the right to contact the Nigeria Data Protection Commission (NDPC) at www.ndpc.gov.ng.