Privacy Policy

1. Introduction

This Privacy Policy explains how BakarePay ("we", "us", "our") collects, uses, shares and protects your personal information when you use our website, web app and related services (the "Service"). It should be read together with our Terms of Service.

We process personal data in line with the Nigeria Data Protection Act 2023 and other applicable Nigerian law.

2. Information we collect

Information you give us

• Account details: your name, email address, phone number and password (which we store only in hashed form).
• Identity details: your BVN, and the details returned when we check it — name, date of birth, phone number and gender — plus the state and local government area you tell us.
• Optional verification documents: for Tier 2, a government-issued ID (NIN slip, voter's card, driver's licence or international passport) and a selfie; and, if you choose, proof of address.
• Bank details: the bank account you cash out to, including the account name returned by our banking partner's lookup.
• Communications: messages you send to our support team by email or WhatsApp.

Information created when you use the Service

• Wallet and transactions: your personal deposit account number, wallet balance, deposits, Deriv transfers, cash-outs, fees, rates, references, statuses and receipts.
• Deriv connection: when you connect Deriv, your Deriv account ID, account name and currency, and an access token that lets us carry out the transfers you ask for. We never see or store your Deriv password.
• Security data: your transaction PIN (stored only in hashed form), sign-in history and failed-attempt counts.
• Device and usage data: IP address, browser and device type, pages visited, error logs, and preferences such as light or dark mode.

3. How we use your information

• To open and run your account, verify your identity and set your tier and daily limit.
• To have our banking partner issue your personal deposit account, and to credit your wallet when money arrives.
• To carry out the Deriv funding, Deriv withdrawals and cash-outs you ask for, and to send you receipts and status updates.
• To detect and prevent fraud, money laundering and other misuse, and to keep the Service secure.
• To meet our legal and regulatory obligations, including record-keeping and responding to lawful requests.
• To answer your questions and resolve problems.
• To improve the Service. We only send you marketing messages if you have agreed to receive them, and you can opt out at any time.

4. How we share your information

We do not sell your personal information. We share it only where we need to in order to run the Service, or where the law requires it.

• Identity verification providers, to check your BVN and any documents you submit.
• Our banking partner, which issues your deposit account number, receives your deposits and processes your cash-outs.
• Deriv, to process the funding and withdrawals you ask for on your own Deriv account.
• Service providers who host our systems or send emails, SMS and messages for us, under contracts that require them to protect your data.
• Regulators, law enforcement and courts, where the law requires us to or to protect our customers from fraud.
• A buyer or successor, if our business is reorganised or sold. We'll tell you before your information becomes subject to a different privacy policy.

5. Transfers outside Nigeria

Some of our partners, including Deriv and some service providers, may process data outside Nigeria. Where that happens, we take steps required by Nigerian data protection law to make sure your information stays protected.

6. Data security

• Information travels between your device and our servers over encrypted connections.
• Passwords and PINs are stored as one-way hashes, so nobody at BakarePay can read them.
• Verification documents are kept in private storage, and only authorised staff who need them can access them.
• Staff access to customer data is limited and logged.

No system is completely secure, so please keep your password, PIN and verification codes to yourself. We will never ask you for them.

7. Data retention

We keep your information for as long as your account is open. After you close it, we keep what the law requires — for example, identity and transaction records — for the period the law sets, and then delete or anonymise it.

8. Your rights

Subject to the law, you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information, where we don't need to keep it by law;
• object to or ask us to restrict some uses of your information;
• withdraw your consent where we rely on it, such as for marketing; and
• receive your information in a portable format.

To use any of these rights, contact us using the details below. If you're not happy with how we handle your request, you can also complain to the Nigeria Data Protection Commission.

9. Cookies and local storage

We use essential cookies to keep you signed in and to protect your session. We also save small preferences, such as light or dark mode, in your browser's local storage. We don't use advertising cookies. You can clear cookies and local storage in your browser settings, but you may then need to sign in again.

10. Children

The Service is only for people aged 18 and over. We don't knowingly collect information from anyone under 18, and if we learn that we have, we'll delete it.

11. Changes to this policy

We may update this policy from time to time. We'll post the new version on this page with a new "Last updated" date and, for significant changes, let you know by email or in the app.

12. Contact us

For privacy questions or requests, email support@bakarepay.com.