HAKKIPAY PRIVACY POLICY

Effective Date: 7 August 2026
Last Updated: 7 August r 2026

1. About This Privacy Policy

Hakki Solutions Limited, trading as HakkiPay (“HakkiPay”, “we”, “us” or “our”), respects your privacy and is committed to protecting personal data entrusted to us.

This Privacy Policy explains how we collect, use, disclose, retain and protect personal data when you access or use:

• the HakkiPay website;
• the HakkiPay mobile application;
• HakkiPay digital products and services;
• business, merchant, cooperative, association or community services offered through HakkiPay;
• customer-support and communication channels; or
• any other service or platform through which this Privacy Policy is made available.

Hakki Solutions Limited is incorporated in Nigeria.

Company: Hakki Solutions Limited
Trading Name: HakkiPay
RC Number: 9477834
Address: No. 11 Cairo Street, Wuse 2, Abuja, Nigeria
Website: www.hakkipay.co
General Contact: info@hakkipay.co

For the processing activities described in this Privacy Policy, Hakki Solutions Limited generally acts as a data controller because it determines why and how relevant personal data is processed.

Some financial services accessible through HakkiPay may be provided or supported by licensed banks, microfinance banks, payment service providers or other regulated institutions. Those institutions may separately act as data controllers in relation to services they provide and may issue their own privacy notices.

This Privacy Policy is governed by the Nigeria Data Protection Act 2023 (“NDP Act”), applicable directives and guidance issued by the Nigeria Data Protection Commission (“NDPC”), including the NDP Act General Application and Implementation Directive 2025 (“GAID 2025”), and other applicable laws.

2. Our Data Protection Principles

When processing personal data, we seek to ensure that it is:

• processed lawfully, fairly and transparently;
• collected for specified, explicit and legitimate purposes;
• adequate, relevant and limited to what is necessary;
• accurate and kept reasonably up to date;
• retained only for as long as necessary or legally required;
• processed securely and protected against unauthorized or unlawful access, alteration, disclosure, loss or destruction; and
• processed in a manner that demonstrates accountability.

These principles reflect the statutory data-processing standards established under the NDP Act.

3. Personal Data We May Collect

The information we collect depends on your relationship with HakkiPay and the services you use.

3.1 Identity and KYC Information

We may collect:

• full name;
• date of birth;
• nationality;
• gender, where legitimately required;
• photograph;
• signature;
• residential address;
• National Identification Number (NIN);
• Bank Verification Number (BVN), where applicable;
• government-issued identification details;
• identity-verification information;
• selfie or facial-verification information where required for lawful identity verification; and other information reasonably required to verify your identity.

3.2 Contact Information

This may include:

• mobile telephone number;
• email address;
• residential or business address; and
• other contact information you provide.

3.3 Financial and Transaction Information

Depending on the service, we may process:

• account or wallet information;
• transaction history;
• payment instructions;
• beneficiary details;
• transaction amounts;
• transaction dates and references;
• bill-payment records;
• merchant-payment information;
• settlement and reconciliation records;
• refunds and reversals;
• applicable fees;
• source-of-funds information where required; and
• other information associated with transactions conducted through the platform.

HakkiPay does not collect more financial information than is reasonably required for the relevant service, compliance obligation or legitimate operational purpose.

3.4 Business and Organizational Information

For businesses, cooperatives, associations, merchants and other organizations, we may collect:

• organization name;
• incorporation or registration information;
• business address;
• nature of business;
• tax information where applicable;
• directors, trustees, partners or officers;
• beneficial-ownership information;
• authorized representatives and signatories;
• user roles and transaction authorities; and
• documents required for business verification and compliance.

3.5 Device and Technical Information

When you use our website, application or services, we may collect:

• IP address;
• device identifiers;
• device type;
• operating system;
• browser information;
• application version;
• login information;
• session records;
• device-security information;
• crash and performance information;
• security logs; and
• information about how you interact with our services.

Location information will only be processed where it is required for a legitimate service, security or fraud-prevention purpose and in accordance with applicable law and device permissions.

3.6 Communications and Customer-Service Information

We may keep records of communications made through:

• customer-support channels;
• email;
• telephone;
• in-app messaging;
• complaints;
• surveys;
• feedback; and
• other authorized communication channels.

Where calls are recorded for security, quality assurance, dispute resolution or compliance purposes, appropriate notice will be given where required.

3.7 Fraud, Risk and Compliance Information

We may process information relating to:

• KYC verification;
• sanctions screening;
• politically exposed person (“PEP”) screening;
• fraud detection;
• transaction monitoring;
• suspicious activity;
• account-security investigations;
• regulatory enquiries; and
• financial-crime prevention.

4. Sensitive Personal Data

Certain information may constitute sensitive personal data under applicable law.

Where HakkiPay processes sensitive personal data, including biometric identifiers used for unique identification or other categories protected by law, we will do so only where an appropriate legal condition exists and appropriate safeguards are implemented.

We will not use sensitive personal data for purposes incompatible with the purpose for which it was lawfully obtained.

 

 

5. How We Collect Personal Data

We may obtain personal data:

Directly from you

For example, when you:

• register for HakkiPay;
• complete KYC;
• conduct a transaction;
• contact customer support;
• submit documents;
• use our website or application; or
• communicate with us.

From regulated financial-service partners

Where a service is provided or supported through a licensed financial institution, information required to provide or administer that service may be exchanged in accordance with applicable law and contractual arrangements.

From verification and service providers

This may include authorized providers used for:

• identity verification; BVN or NIN verification; business verification; fraud prevention; payment processing; or other legitimate service functions.

From organizations

If you use HakkiPay through an employer, cooperative, association, business or other organization, we may receive information necessary to establish or administer your relationship with that organization.

Automatically

Certain technical information may be generated when you use our website, application or services.

From public or legally authorized sources

Where necessary for compliance, fraud prevention, due diligence or legal obligations, we may obtain information from legitimate public records or authorized databases.

6. Why We Process Personal Data

We may process personal data to:

• register and authenticate users;
• provide and administer HakkiPay services;
• verify identity;
• process transactions;
• facilitate partner-enabled financial services;
• maintain transaction and account records;
• provide business and community-platform functionality;
• process payments and collections;
• carry out settlement and reconciliation;
• send transaction and security notifications;
• provide customer support;
• respond to enquiries and complaints;
• prevent and investigate fraud;
• protect users, our systems and our partners;
• comply with KYC, anti-money laundering and other legal obligations;
• carry out sanctions and PEP screening where required;
• monitor suspicious or unusual activity;
• manage operational and financial risk;
• improve product performance and customer experience;
• perform audits and internal controls;
• establish, exercise or defend legal claims;
• comply with lawful requests from regulators, courts and competent authorities; and
• send marketing communications where lawfully permitted.

We will not materially change the purpose for which personal data was collected without establishing an appropriate lawful basis and providing any notice required by law.

7. Lawful Bases for Processing

We will process personal data only where an appropriate lawful basis exists.

Depending on the circumstances, we may rely on:

Contract

Where processing is necessary to provide a service, you have requested or to perform our contractual obligations to you.

Legal Obligation

Where processing is necessary to comply with applicable laws, regulations, court orders or lawful regulatory requirements.

Consent

Where you have freely given specific, informed and unambiguous consent for a particular processing activity.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing lawfully carried out before the withdrawal.

Legitimate Interests

Where processing is necessary for a legitimate business or operational interest, such as security, fraud prevention, service improvement or protection of our systems, provided that such interests are not overridden by your fundamental rights and freedoms.

Vital Interests

Where processing is necessary to protect someone’s life or other vital interests.

Public Interest

Where processing is lawfully necessary for the performance of a task carried out in the public interest or in exercise of an official authority recognized by law.

The NDP Act recognizes multiple lawful bases for processing rather than making consent the sole basis for lawful data processing.

8. Identity Verification, KYC and Financial-Crime Prevention

Financial services are subject to identity-verification, fraud-prevention and financial-crime controls.

Accordingly, HakkiPay and relevant regulated partners may process personal data to:

• verify identity;
• authenticate users;
• validate identification information;
• establish beneficial ownership of businesses or organizations;
• detect impersonation or identity fraud;
• perform sanctions or PEP screening;
• monitor suspicious transactions;
• investigate suspected fraud;
• satisfy anti-money laundering and related requirements; and
• comply with lawful requests from competent authorities.

Failure to provide information that is legally or operationally required may prevent us or a relevant partner from providing a particular service.

9. How We Share Personal Data

HakkiPay does not sell personal data.

We may disclose personal data only where necessary for a legitimate purpose and permitted by law.

Recipients may include:

Licensed Financial Institutions

Banks, microfinance banks, payment service providers and other regulated institutions involved in providing, processing, settling or supporting financial services accessed through HakkiPay.

Payment and Service Providers

Providers supporting functions such as:

• transfers;
• payment processing;
• bill payment;
• telecommunications services;
• cards, where applicable;
• settlement;
• notifications; and
• transaction processing.

Identity, Compliance and Fraud-Prevention Providers

Providers that support:

• identity verification;
• business verification;
• KYC;
• fraud detection;
• sanctions screening; and
• security.

Technology Providers

This may include providers of:

• cloud infrastructure;
• hosting;
• cybersecurity;
• communications;
• analytics;
• customer-support systems;
• software infrastructure; and
• other technology necessary to operate HakkiPay.

Where a service provider processes personal data on our behalf, we require appropriate contractual, confidentiality and data-protection safeguards.

Professional Advisers

We may disclose information where reasonably necessary to:

• lawyers;
• auditors;
• accountants;
• compliance advisers;
• insurers; or
• other professional advisers.

Regulators and Public Authorities

We may disclose personal data where required or permitted by:

• applicable law;
• a court order;
• a regulator;
• law-enforcement authorities;
• tax authorities; or
• another competent authority.

Corporate Transactions

If HakkiPay undergoes a merger, acquisition, restructuring, financing, investment, sale or transfer of business assets, relevant personal data may be disclosed subject to appropriate confidentiality, legal and data-protection safeguards.

10. Partner-Provided Services

HakkiPay may provide access to financial services through licensed third-party institutions.

Where a partner independently determines the purposes and means of processing your personal data, that partner may be a separate data controller.

Its own privacy notice may therefore apply in addition to this Privacy Policy.

HakkiPay will seek to ensure that partner-enabled data exchanges are limited to information reasonably necessary for the relevant service and supported by an appropriate legal basis.

11. International Transfers of Personal Data

Some technology providers, infrastructure providers or other service providers may process personal data outside Nigeria.

Where personal data is transferred from Nigeria to another country, HakkiPay will ensure that the transfer is made through a mechanism permitted under applicable Nigerian data-protection law.

This may include:

• transfer to a jurisdiction or recipient providing an adequate level of protection;
• binding contractual safeguards; binding corporate rules;
• approved codes or certification mechanisms; or another lawful transfer condition recognized under the NDP Act.

We will document the lawful basis relied upon for applicable cross-border transfers.

The NDP Act specifically restricts cross-border transfers unless an adequate protection mechanism or another statutory condition applies.

12. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected or for a lawful related purpose.

Retention periods may be affected by:

• legal and regulatory requirements; KYC and financial-crime obligations; accounting and audit requirements; transaction-record requirements; contractual obligations; fraud prevention; dispute resolution; litigation or investigations; and legitimate business requirements.

When personal data is no longer required, we will securely delete, anonymize or otherwise dispose of it, unless continued retention is required or permitted by law.

13. Security of Personal Data

We maintain technical and organizational safeguards appropriate to the nature and risks of the personal data we process.

Depending on the relevant system or processing activity, these safeguards may include:

• encryption; secure transmission protocols; authentication controls; role-based access controls; privileged-access controls; audit logs; security monitoring; vulnerability management; secure software-development practices; network and infrastructure security; backups; business-continuity arrangements; incident-response procedures; employee confidentiality obligations; and security and privacy training.

Access to personal data is restricted to authorized persons who require it for legitimate duties.

You are responsible for protecting your HakkiPay credentials, including passwords, PINs, OTPs and devices. You should never disclose these credentials to another person.

No internet-based service can guarantee absolute security, but HakkiPay will maintain reasonable and appropriate safeguards required by applicable law.

14. Personal Data Breaches

HakkiPay maintains procedures for identifying, investigating, containing and responding to personal data breaches.

Where a personal data breach is likely to result in a risk to individuals’ rights and freedoms, HakkiPay will notify the Nigeria Data Protection Commission within the period required by law.

Where a breach is likely to create a high risk to an affected individual, HakkiPay will communicate the breach to the affected individual as required by law and provide appropriate information regarding mitigation measures.

Under section 40 of the NDP Act, a controller must notify the NDPC within 72 hours of becoming aware of a breach likely to create risk to individuals’ rights and freedoms, and must communicate a high-risk breach to affected data subjects as required by the Act

15. Your Data Protection Rights

Subject to applicable law and any lawful limitations, you may have the right to:

Be Informed

To receive clear information about how your personal data is processed.

Access Your Personal Data

To ask whether we process personal data relating to you and request access to relevant information.

Rectification

To request correction of inaccurate personal data and completion of incomplete information.

Erasure

To request deletion of personal data where the applicable legal conditions are satisfied.

This right does not require deletion where we are legally required or otherwise lawfully entitled to retain the information.

Restriction of Processing

To request restriction of processing in circumstances recognized by law.

Object to Processing

To object to particular processing activities where applicable.

Withdraw Consent

Where processing is based on consent, you may withdraw that consent.

Object to Direct Marketing

You may object to the use of your personal data for direct marketing.

Once a valid objection to direct marketing is received, the relevant data will no longer be used for that purpose.

 

Data Portability

Where applicable, you may request personal data in a structured, commonly used and machine-readable format, subject to applicable legal requirements.

Rights Relating to Automated Decision-Making

You have protections in relation to decisions based solely on automated processing that produce legal or similarly significant effects.

Where applicable, these protections include the ability to obtain human intervention, express your point of view and contest the decision.

Lodge a Complaint

You may lodge a complaint concerning the processing of your personal data with HakkiPay and, where appropriate, with the Nigeria Data Protection Commission.

The NDP Act establishes rights relating to access, correction, erasure, objection, automated decision-making and data portability.

16. Exercising Your Rights

Privacy requests may be submitted to HakkiPay through the contact details provided in this Policy.

We may request reasonable information to verify your identity before acting on a request.

We will respond without unreasonable delay and within applicable statutory or regulatory timelines.

A request may be limited or refused where permitted by law, including where compliance would:

• adversely affect the rights and freedoms of another person; conflict with a legal obligation; interfere with a lawful investigation; undermine fraud-prevention or financial-crime obligations; or fall within another statutory exemption.

Where appropriate, we will explain the reason for any lawful limitation.

17. Automated Processing and Profiling

HakkiPay may use automated technologies to assist with functions such as:

• fraud detection; transaction monitoring; account security; identity verification; risk assessment; and service protection.

We will implement safeguards required by law where automated processing produces legal or similarly significant effects.

Where applicable, you may request human intervention, express your position or contest a qualifying automated decision.

The NDP Act expressly protects individuals from certain solely automated decisions and provides safeguards including human intervention and the ability to contest qualifying decisions.

18. Marketing Communications

We may send you information about HakkiPay products, services, promotions or offers where we have an appropriate lawful basis.

Where consent is required, marketing communications will only be sent after valid consent has been obtained.

You may opt out of marketing communications at any time through:

• an unsubscribe option; applicable application settings; or our customer-support channels.

Opting out of marketing does not prevent us from sending essential communications concerning:

• transactions; security; regulatory requirements; service changes; account administration; or customer support.

19. Cookies and Similar Technologies

Our website and digital platforms may use cookies and similar technologies for:

• essential website functionality; authentication; security; user preferences; performance measurement; analytics; and other lawful purposes.

Non-essential cookies will be handled through appropriate consent or preference controls where required.

Users should be able to accept or reject non-essential cookies.

Further information will be provided in the HakkiPay Cookie Policy.

20. Children’s Privacy

HakkiPay’s general financial services are intended for persons who satisfy the applicable legal and product eligibility requirements.

Unless a product expressly states otherwise, HakkiPay services are intended for persons aged 18 years and above.

If HakkiPay introduces a product specifically designed for children or minors, we will implement age-verification, parental or legal-guardian consent and other safeguards required by applicable law.

The NDP Act requires parental or guardian consent where consent is relied upon for processing personal data of a child or person lacking legal capacity, subject to statutory exceptions.

21. Third-Party Websites and Applications

Our website or application may contain links to third-party websites or services.

HakkiPay does not control the privacy practices of independent third parties.

You should review the privacy notice of any external service before providing personal data to that service.

This does not affect HakkiPay’s responsibility for third parties processing personal data on our behalf.

22. Changes to This Privacy Policy

We may amend this Privacy Policy where necessary to reflect:

• changes in law or regulation;
• regulatory guidance;
• changes to our services;
• new technology;
• changes to our processing activities;
• new partner arrangements; or
• improvements to our privacy programme.

The current version will be made available through HakkiPay’s website or application.

Where a change materially affects how we process personal data or the rights of users, we will provide additional notice where required by law.

23. Contacting HakkiPay About Privacy

Questions, requests or complaints relating to personal data should be directed to:

Data Protection Officer
Hakki Solutions Limited / HakkiPay
No. 11 Cairo Street, Wuse 2, Abuja, Nigeria

Website: www.hakkipay.co
General Enquiries: info@hakkipay.co
Customer Support: support@hakkipay.co
Formal Complaints: complaints@hakkipay.co
Data Protection Officer: dpo@hakkipay.co

Only active and monitored channels should be published.

Please include sufficient information for us to understand and respond to your request.

For security reasons, we may require reasonable proof of identity before disclosing or changing personal information.

24. Complaints to the Nigeria Data Protection Commission

We encourage you to contact HakkiPay first if you have concerns about how your personal data has been handled so that we can investigate and seek to resolve the matter.

You also have the right to lodge a complaint with the:

Nigeria Data Protection Commission (NDPC)

The NDPC is the statutory data-protection regulator established under the Nigeria Data Protection Act 2023.

25. Our Commitment

HakkiPay considers privacy, security and responsible data use fundamental to the trust placed in our platform.

We are committed to maintaining appropriate governance, technology, controls and accountability measures for the protection of personal data as HakkiPay grows.

HakkiPay
Trusted Finance. Shared Growth.