Privacy Policy

Last updated: September 6, 2026

1. Introduction

PayNex.Org ("PayNex", "we", "us", or "our") operates the Paynex NG platform ("Platform"). This Privacy Policy explains how we collect, use, store, protect, and share your personal information when you use our Platform and Services.

We are committed to protecting your privacy in accordance with the Nigeria Data Protection Regulation (NDPR) 2019, the Nigeria Data Protection Act (NDPA) 2023, and other applicable data protection laws.

By using the Platform, you consent to the collection and use of your information as described in this Privacy Policy.

2. Information We Collect

2.1 Information You Provide Directly

  • Account Information: Full name, email address, phone number, username, date of birth, and password when you register;
  • Identity Verification (KYC): Bank Verification Number (BVN), National Identification Number (NIN), and associated verification data when you complete identity verification;
  • Transaction PIN: A security PIN you set for authorising transactions;
  • SMS Content: The content of messages you compose and send through the Platform;
  • Contact Data: Phone numbers and contact information you upload to contact groups and address books;
  • Payment Information: Payment references, transaction amounts, and gateway responses when you fund your wallet. We do not store your card details directly — these are processed by PCI-DSS compliant payment processors.

2.2 Information Collected Automatically

  • Usage Data: SMS sending history, delivery reports, API usage logs, and feature interaction data;
  • Technical Data: IP address, browser type and version, device information, and operating system;
  • Session Data: Login timestamps, session duration, and authentication events;
  • Security Data: Failed login attempts, account lockout events, and suspicious activity indicators.

2.3 Information from Third Parties

  • Social Login: If you sign in via a social authentication provider (e.g., Google), we receive your name, email address, and profile picture as authorised by you;
  • Payment Processors: Transaction status, payment references, and confirmation data from payment gateways;
  • SMS Providers: Delivery status reports (DLR) from mobile carriers and SMS aggregators;
  • Identity Verification Services: Verification results from BVN and NIN validation services.
3. How We Use Your Information

We use your personal information for the following purposes:

  • Service Delivery: To provide, operate, and maintain the Platform and its features, including SMS sending, wallet management, and contact management;
  • Account Management: To create, verify, and manage your account, including email verification and password resets;
  • Payment Processing: To process wallet funding transactions and maintain accurate financial records;
  • Identity Verification: To comply with KYC/AML requirements under Nigerian regulations;
  • Security: To detect, prevent, and respond to fraud, abuse, security threats, and technical issues;
  • Communication: To send you service-related notifications, security alerts, account updates, and promotional communications (with your consent);
  • Analytics: To understand usage patterns, improve our Services, and develop new features;
  • Legal Compliance: To comply with applicable laws, regulations, and legal processes;
  • Dispute Resolution: To investigate and resolve complaints and disputes.
4. Legal Basis for Processing

We process your personal data on the following legal bases:

  • Consent: You have given explicit consent for the processing (e.g., during registration and KYC submission);
  • Contractual Necessity: Processing is necessary to fulfil our contractual obligations to you (e.g., delivering SMS services you have paid for);
  • Legal Obligation: Processing is required to comply with Nigerian laws and regulations (e.g., NDPR, NCC regulations, AML requirements);
  • Legitimate Interest: Processing is necessary for our legitimate business interests (e.g., fraud prevention, platform security, service improvement), provided these interests do not override your fundamental rights.
5. Data Sharing and Disclosure

We do not sell your personal information. We may share your data with the following categories of recipients:

  • SMS Service Providers: We share recipient phone numbers and message content with our SMS aggregator partners to deliver your messages. These providers are contractually obligated to use this data solely for message delivery;
  • Payment Processors: Payment transaction data is shared with our payment gateway partners (e.g., Paystack) to process wallet funding;
  • Identity Verification Services: BVN and NIN data is shared with authorised verification providers to validate your identity;
  • Sub-Account Holders: If you are a managed sub-account, certain account and activity data may be visible to the business account holder who manages your account, according to their assigned permissions;
  • Law Enforcement: We may disclose your information to law enforcement agencies, regulatory bodies, or courts when required by law or in response to valid legal process;
  • Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity.
6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required by law. Specifically:

  • Account Data: Retained for the duration of your account and for a reasonable period after account closure for legal and audit purposes;
  • SMS Records: Message logs and delivery reports are retained for a period necessary for billing, dispute resolution, and regulatory compliance;
  • Financial Records: Payment and transaction records are retained for a minimum of 6 years in accordance with Nigerian tax and financial regulations;
  • KYC Data: Identity verification records are retained as required by anti-money laundering regulations;
  • Security Logs: Login attempts, IP addresses, and security events are retained for a reasonable period for security monitoring.

When personal data is no longer required, it will be securely deleted or anonymised.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

  • Encryption: Passwords are hashed using industry-standard bcrypt hashing. Data in transit is protected via HTTPS/TLS encryption;
  • Access Controls: Access to personal data is restricted to authorised personnel on a need-to-know basis;
  • Authentication Security: Multi-layered security including transaction PINs, email verification, and account lockout after repeated failed login attempts;
  • API Security: API access is secured via bearer token authentication with per-user rate limiting;
  • Session Management: Sessions are configured with appropriate timeouts and CSRF protection;
  • Payment Security: Card payment details are processed by PCI-DSS compliant third-party processors and are never stored on our servers.

While we take reasonable precautions to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

8. Cookies and Session Technology

The Platform uses cookies and similar technologies to:

  • Maintain your login session and remember your preferences;
  • Protect against cross-site request forgery (CSRF) attacks;
  • Analyse Platform usage and improve performance.

You can control cookie settings through your browser. However, disabling cookies may affect Platform functionality, including the ability to log in.

9. Your Rights

Under the NDPR and NDPA, you have the following rights regarding your personal data:

  • Right of Access: You may request a copy of the personal data we hold about you;
  • Right to Rectification: You may request correction of inaccurate or incomplete personal data;
  • Right to Deletion: You may request deletion of your personal data, subject to legal and regulatory retention requirements;
  • Right to Restrict Processing: You may request that we limit the processing of your personal data in certain circumstances;
  • Right to Data Portability: You may request a copy of your data in a structured, commonly used, and machine-readable format;
  • Right to Object: You may object to the processing of your personal data for direct marketing purposes;
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us using the details provided in Section 14 below. We will respond to your request within 30 days.

10. Children's Privacy

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child, we will take steps to delete it promptly.

11. International Data Transfers

Your data is primarily stored and processed in Nigeria. In cases where data is transferred to service providers located outside Nigeria (e.g., cloud infrastructure providers, SMS aggregators), we ensure that appropriate safeguards are in place to protect your data in compliance with the NDPR and NDPA.

12. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through the Platform.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Changes will be effective upon publication on the Platform. We will make reasonable efforts to notify you of material changes via email or Platform notification. Your continued use of the Platform after changes are published constitutes acceptance of the revised Privacy Policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data protection rights have been violated.

See also our Terms of Service.