CzettaPay Privacy Policy

2.1 Registration and account information

When you create a CzettaPay account, we collect:

• Your name.
• Your phone number.
• Your email address.

We may also process information associated with your account registration and administration, including:

• Account creation date.
• Account status.
• Login and authentication records.
• Verification codes and related authentication events.
• Your acceptance of this Privacy Policy and other applicable terms.
• Customer support interactions connected to your account.

2.2 Identity verification information

Basic account registration does not presently require you to provide a Bank Verification Number, National Identification Number, government-issued identification document, or similar advanced identity verification information.

However, some services introduced in the future may require an additional level of identity verification. Where a specific service requires enhanced verification, we may request a valid identification document and other information reasonably necessary to verify your identity or comply with applicable requirements.

Before collecting additional identity verification information, we will explain:

• Why the information is required.
• Which service or feature requires it.
• How the information will be processed.
• Whether it will be shared with a verification provider or other authorised third party.
• Any additional consent or authorisation required.

You will not be required to provide enhanced identity verification information for a service that does not require it.

2.3 Wallet funding and payment information

When you fund your CzettaPay wallet or pay for services through the application, we may collect or receive:

• The amount funded or paid.
• The date and time of the transaction.
• Transaction references and identifiers.
• Payment status.
• Payment channel information.
• Wallet balance and wallet activity.
• Refund, reversal, dispute, or chargeback information.
• Information necessary to reconcile transactions.
• Records of the service or product purchased.
• Payment confirmations and receipts.

CzettaPay currently uses Paystack as its payment gateway.

Where payment card or other payment instrument details are required to complete a transaction, those details may be processed through Paystack's payment infrastructure in accordance with the applicable payment flow and Paystack's own privacy practices.

CzettaPay is not a mobile banking application and does not provide person-to-person cash transfers between users. References to transfers in this Privacy Policy relate only to the transfer of Czetta Points, unless a future feature is separately introduced and disclosed.

2.4 Service and transaction information

When you use services available through CzettaPay, we may process information necessary to facilitate your request, including:

• Airtime purchase details.
• Mobile data purchase details.
• Beneficiary phone numbers for airtime or data purchases.
• Electricity payment details and meter-related information.
• Cable television subscription details.
• Internet or broadband subscription details.
• Water and other utility payment information.
• Subscription management information.
• Cinema or event booking information.
• Food or grocery order information.
• Delivery-related information.
• Healthcare or pharmacy booking information.
• Music, sports, entertainment, or other lifestyle service information.
• Order references.
• Booking references.
• Service provider details.
• Purchase amounts.
• Fulfilment and delivery status.
• Transaction history.
• Refund and complaint records.

The specific information collected will depend on the service you request. We will only request information that is reasonably necessary to complete the requested transaction, facilitate the relevant third-party service, provide support, or meet applicable legal obligations.

2.5 Czetta Points, rewards, and referral information

Where you participate in CzettaPay's rewards or referral features, we may process:

• Your Czetta Points balance.
• Points earned from eligible activities or transactions.
• Points redeemed for services or rewards.
• Points transferred to another CzettaPay user.
• Details identifying the sender and recipient of a points transfer.
• Referral codes.
• Referral invitations and successful referrals.
• Promotional eligibility.
• Reward activity and transaction history.
• Records relating to suspected reward or referral misuse.

Czetta Points transfers are separate from cash transfers. The availability of a Czetta Points transfer feature does not mean that CzettaPay offers peer-to-peer cash transfers or operates as a mobile banking application.

2.6 Location and delivery information

Where you enable location access or provide a delivery address, we may collect information necessary to:

• Identify service providers available in your area.
• Show relevant delivery options.
• Facilitate food, grocery, pharmacy, or other deliveries.
• Present nearby services or location-relevant offers.
• Determine whether a requested service is available in your location.
• Improve the accuracy of location-dependent services.

Location information may include device location, where you grant permission; a delivery address you provide; a selected service location; and information relating to a requested delivery destination.

You can manage or withdraw location permissions through your mobile device settings. However, services that depend on accurate location information may not function properly if location access is disabled or a suitable address is not provided.

2.7 Device and technical information

When you use the CzettaPay application, we may collect technical information such as:

• Device type and model.
• Operating system and application version.
• Device or application identifiers.
• Internet Protocol address.
• Login timestamps.
• Technical and diagnostic information.
• Application performance information.
• Error reports.
• Transaction and authentication event logs.
• Records necessary to identify or investigate suspected misuse.

This information helps us operate the application, troubleshoot issues, maintain account security, and improve service performance.

2.8 Application usage and preferences

We may collect information about how you interact with CzettaPay, including:

• Services viewed or selected.
• Features used.
• Transaction frequency.
• Frequently used service categories.
• Rewards activity.
• Preferences and interests inferred from your interactions.
• Responses to promotions or offers.
• Support interactions.
• Application navigation patterns.

This information may be used to improve the application, personalise your experience, and present services or offers that may be relevant to you.

2.9 Healthcare and pharmacy services

Where CzettaPay provides access to healthcare, telemedicine, pharmacy, or related services, those services are delivered by the relevant third-party healthcare professionals, pharmacies, or other licensed providers.

Metcore operates the platform through which you may discover, book, access, or pay for the relevant service. Metcore does not act as the medical professional, prescribe medication, or provide clinical treatment through CzettaPay.

Depending on the integration, Metcore may process limited information necessary to facilitate access to the service, including:

• Your identity and contact information.
• The identity of the relevant service provider.
• Booking or appointment details.
• Order or service references.
• Payment information.
• Delivery details, where applicable.
• Booking, order, or fulfilment status.
• Customer support information relating to the transaction.

Prescriptions, clinical assessments, treatment decisions, medical advice, and other professional healthcare activities are handled by the relevant licensed third-party provider.

Where a future service requires CzettaPay to process information that qualifies as sensitive personal data, we will provide appropriate notice, identify the relevant lawful basis, and obtain any additional consent required by applicable law before processing that information.

2.10 Information received from third parties

We may receive information from third parties involved in providing or facilitating CzettaPay services, including:

• Payment confirmations and transaction status from Paystack.
• Transaction responses from telecommunications providers.
• Service status from utility providers and billers.
• Booking confirmations from cinema, entertainment, or event partners.
• Order and delivery updates from food, grocery, or logistics partners.
• Booking, order, or fulfilment updates from healthcare or pharmacy providers.
• Verification results from identity verification providers, where a future service requires additional verification.
• Technical or performance information from infrastructure and analytics providers.

Information received from third parties will be used only for purposes connected to the relevant service, legal compliance, fraud prevention, support, or another lawful processing purpose.

2.11 Notifications and device permissions

With your permission, we may send application notifications relating to:

• Account activity.
• Wallet funding.
• Transaction confirmations.
• Service and booking updates.
• Delivery status.
• Security alerts.
• Reward activity.
• Promotions and offers.
• Important changes to the application or this Privacy Policy.

You can manage notification settings through the application, where available, or through your device settings. Where a future feature requires access to additional device capabilities, we will request the relevant permission when needed and explain the purpose of that access.

3.1 Account creation and management

We use your personal data to:

• Register and maintain your account.
• Identify you when you log in.
• Manage your account settings.
• Record your acceptance of applicable policies and terms.
• Support account recovery.
• Communicate with you about your account.
• Provide customer assistance.

3.2 Provision of everyday services

We use your personal data to:

• Enable airtime and data purchases.
• Facilitate utility and subscription payments.
• Support wallet funding and payment for services.
• Enable access to entertainment, cinema, and event services.
• Facilitate food, grocery, pharmacy, and other delivery-related services.
• Connect you with healthcare and other licensed service providers.
• Provide access to additional consumer and lifestyle services introduced through the application.
• Complete, confirm, and manage requested transactions.
• Generate transaction records and receipts.
• Provide updates on orders, bookings, and service fulfilment.

3.3 Wallet and payment administration

We use relevant information to:

• Process wallet funding.
• Record wallet activity and balances.
• Confirm payments through Paystack.
• Reconcile transactions.
• Manage reversals and refunds.
• Address failed or disputed transactions.
• Maintain accurate financial and operational records.

3.4 Czetta Points, rewards, and referrals

We use relevant personal data to:

• Allocate Czetta Points.
• Track points balances and activity.
• Process the redemption of points.
• Facilitate points transfers between eligible users.
• Manage referral programmes.
• Assess eligibility for rewards and promotions.
• Investigate suspected misuse of reward or referral features.

3.5 Identity verification and legal compliance

Where required for a particular service, we may use your information to:

• Verify your identity.
• Apply service-specific eligibility requirements.
• Respond to lawful regulatory or law enforcement requests.
• Meet applicable legal, accounting, tax, or regulatory obligations.
• Maintain records required by law.
• Investigate suspected unlawful or unauthorised activity.

3.6 Fraud prevention and platform protection

We may process personal data to:

• Verify account activity.
• Authenticate transactions using transaction PINs or one-time passwords.
• Maintain audit logs of relevant application activity.
• Detect suspicious login attempts or unusual transaction patterns.
• Investigate suspected fraud, account misuse, reward abuse, or unauthorised access.
• Protect users, Metcore, service providers, and the wider platform.

3.7 Customer support and service communications

We may use your information to:

• Respond to questions, complaints, and support requests.
• Investigate transaction issues.
• Provide updates on reported incidents.
• Send account, payment, service, or security notifications.
• Notify you about material changes to CzettaPay or this Privacy Policy.

3.8 Personalisation and service improvement

We may use your account activity, transaction history, service preferences, location information where permitted, and application interactions to:

• Present services that may be relevant to you.
• Recommend nearby or frequently used services.
• Show applicable rewards, promotions, or offers.
• Improve the arrangement and visibility of available services.
• Understand how users interact with the application.
• Improve application performance and usability.
• Develop new products, features, and integrations.

3.9 Marketing and promotional communications

Where permitted by applicable law and, where necessary, with your consent, we may communicate with you about:

• CzettaPay services.
• New product features.
• Rewards and referral opportunities.
• Partner offers.
• Discounts and promotions.
• Relevant events or lifestyle services.

You may opt out of promotional communications by following the instructions included in the communication, adjusting available preferences, or contacting us. Opting out of marketing communications will not prevent us from sending essential account, transaction, support, or security messages.

4.1 Service providers acting on our behalf

We may share personal data with trusted service providers that help us operate CzettaPay or provide services through the application. These providers may process information on our behalf in connection with:

• Cloud hosting and infrastructure.
• Payment processing.
• Customer support.
• Service integration.
• Transaction monitoring and reconciliation.
• Analytics and application performance.
• Fraud prevention.
• Identity verification, where applicable to future services.

Where a third party processes personal data on our behalf, we require that processing to be conducted in accordance with applicable law, appropriate confidentiality obligations, and relevant instructions or contractual arrangements.

4.2 Telecommunications providers

We may share relevant information with telecommunications providers to facilitate airtime and mobile data purchases. These providers may include:

• MTN.
• Airtel.
• Glo.
• 9mobile.

Information shared may include beneficiary phone numbers, selected products, transaction references, and other information necessary to complete the requested purchase.

4.3 Utility providers and billers

We may share information with relevant service providers to facilitate payments for:

• Electricity.
• Cable television.
• Internet and broadband.
• Water.
• Subscriptions.
• Other utilities and everyday services introduced through the application.

Information shared will depend on the service requested and may include account identifiers, meter numbers, subscription information, transaction references, or payment confirmations.

4.4 Payment processing

CzettaPay currently uses Paystack to support wallet funding and payment processing. We may share or receive information necessary to:

• Initiate and confirm a payment.
• Verify payment status.
• Process a refund or reversal.
• Manage payment disputes.
• Reconcile transactions.
• Investigate suspected payment irregularities.

Paystack may also process information under its own applicable privacy policy and contractual arrangements.

4.5 Cinema, entertainment, and event providers

Where you book cinema tickets, entertainment services, or events through CzettaPay, relevant information may be shared with the applicable provider to:

• Complete your booking.
• Issue a ticket or reservation.
• Confirm your purchase.
• Provide booking updates.
• Address service-related complaints.

4.6 Food, grocery, delivery, and logistics providers

Where you request food, grocery, pharmacy, or other delivery services, relevant information may be shared with the applicable provider or logistics partner, including:

• Your name.
• Phone number.
• Delivery address or selected location.
• Relevant order information.
• Payment or order confirmation.
• Delivery instructions.
• Fulfilment or service status.

4.7 Healthcare and pharmacy providers

Where you access healthcare, telemedicine, pharmacy, or related services, relevant information may be shared with the licensed provider responsible for delivering the service. Depending on the service, this may include:

• Your name and contact information.
• Appointment or booking details.
• Payment confirmation.
• Delivery information.
• Information you choose to provide directly to the relevant provider.
• Other information necessary to facilitate the requested service.

Healthcare providers and pharmacies remain responsible for the professional, clinical, prescription, and treatment-related aspects of their services. Their processing of personal and health-related information may also be governed by their own privacy notices, professional obligations, and applicable laws.

4.8 Cloud infrastructure provider

We use Amazon Web Services (AWS) to host infrastructure used in connection with CzettaPay. The currently disclosed hosting location is Germany. Additional information about this hosting arrangement and the resulting cross-border processing is provided in Section 5.

4.9 Analytics and technology providers

We may share limited information with technology or analytics providers where necessary to:

• Understand application usage.
• Monitor application performance.
• Identify technical issues.
• Improve user experience.
• Evaluate service demand.
• Support personalisation.

Where possible and appropriate, we may use aggregated or de-identified information for these purposes.

4.10 Legal and regulatory disclosures

We may disclose your personal data:

• Where required by applicable law.
• In response to a lawful request from a regulatory authority.
• In response to a valid court order or legal process.
• To law enforcement officials or investigators where disclosure is legally required or justified.
• To protect the rights, safety, or lawful interests of users, Metcore, or another person.

4.11 Corporate transactions

We may disclose relevant personal data in connection with the evaluation or completion of a:

• Merger.
• Acquisition.
• Financing.
• Corporate restructuring.
• Sale or transfer of business assets.

Any such disclosure will be subject to applicable legal requirements and appropriate confidentiality or protective arrangements.

4.12 Disclosure with your consent or direction

We may share information when:

• You request that we do so.
• You choose to access a third-party service.
• You provide consent to a specific disclosure.
• We notify you that information will be shared in a particular manner and you choose to proceed.

4.13 No sale of personal data

We do not disclose personal data to third parties for purposes unrelated to the operation of CzettaPay, the delivery of requested services, legal compliance, or another legitimate and disclosed processing purpose.

5.1 Digital processing and storage

CzettaPay is a digital mobile application, and personal data collected through the application is processed and stored through digital systems.

5.2 Cloud provider and hosting location

CzettaPay uses the following cloud infrastructure arrangement:

Because the primary AWS hosting infrastructure is located in Germany, personal data processed through CzettaPay may be transferred from Nigeria to, stored in, or accessed through infrastructure located in Germany.

This constitutes a cross-border transfer of personal data under applicable Nigerian data protection requirements.

5.3 Backup arrangements

Metcore maintains backups as part of its operational and service continuity arrangements. At the date of this Privacy Policy, no additional backup country or separate secondary data-centre location has been identified for disclosure beyond the AWS hosting arrangement described above.

If backups, disaster recovery systems, replicated data, or other infrastructure are subsequently hosted in another country or region, Metcore will update the applicable disclosure and implement any safeguards required by law.

5.4 Basis for cross-border transfers

Personal data may be transferred outside Nigeria where necessary to:

• Host and operate the CzettaPay application.
• Store account and transaction information.
• Maintain backups.
• Facilitate cloud-based infrastructure services.
• Provide requested application features.
• Maintain service continuity and technical support.

Cross-border transfers will be carried out on a lawful basis under applicable Nigerian data protection law. Depending on the circumstances, this may include:

• Your informed consent, where consent is required.
• The necessity of the transfer to provide services you have requested.
• The existence of appropriate contractual or other recognised safeguards.
• Any adequacy determination, approval, instrument, or other transfer mechanism recognised by the Nigeria Data Protection Commission.
• Another lawful basis permitted under applicable law.

Where consent is used as the basis for a cross-border transfer, we will provide sufficient information about the transfer and associated risks to enable an informed decision.

5.5 Cross-border transfer risks

Where personal data is transferred to or processed in another country, potential risks may include:

• Increased exposure to unauthorised access or misuse where legal or enforcement protections differ.
• Differences in the availability or enforceability of data subject rights, including rights of access, correction, or deletion.
• More limited or complex options for pursuing legal remedies following a data breach.
• Potential access by foreign governmental or regulatory authorities under the laws of the destination country.
• Differences in technical, organisational, contractual, or operational safeguards applied by recipients.

Metcore will take appropriate steps to assess and address relevant cross-border transfer risks, including through applicable contractual arrangements, vendor oversight, access controls, and other measures appropriate to the processing activity.

5.6 Future infrastructure changes

If Metcore introduces a new cloud provider, hosts personal data in another country, or changes the location of a backup or secondary hosting environment, we will update this Privacy Policy or otherwise provide notice as required by applicable law. Where necessary, additional consent or an alternative lawful transfer mechanism will be obtained before the new arrangement is implemented.

6.1 Transaction PINs

Users may be required to create or use a transaction PIN to authorise relevant account or transaction activities. You are responsible for keeping your transaction PIN confidential and should not disclose it to another person.

6.2 One-time passwords

CzettaPay may use one-time passwords or verification codes to:

• Confirm account ownership.
• Verify a login or account activity.
• Support account recovery.
• Authenticate particular actions.
• Reduce the risk of unauthorised access.

One-time passwords should never be shared with another person, including anyone claiming to represent CzettaPay or Metcore.

6.3 Audit logs

We maintain audit logs of relevant account, application, transaction, and security activities. These logs may be used to:

• Investigate suspicious activity.
• Resolve disputes.
• Review account access.
• Support transaction reconciliation.
• Maintain operational accountability.
• Meet applicable legal or regulatory obligations.

6.4 Device-based biometric authentication

CzettaPay may support biometric authentication through features available on your device, such as:

• Face ID.
• Fingerprint authentication.

Biometric authentication is handled by your device and its operating system. CzettaPay does not collect, receive, or store your facial biometric template, fingerprint image, or underlying biometric data when you use supported device-based authentication.

The application receives only the authentication outcome needed to determine whether the device has successfully verified the user. You may disable biometric authentication through your device settings or any applicable settings within the CzettaPay application.

6.5 User responsibilities

You can help protect your account by:

• Keeping your transaction PIN private.
• Never sharing one-time passwords.
• Using the security features available on your device.
• Keeping your device and application updated.
• Reviewing account and transaction notifications.
• Contacting us promptly if you suspect unauthorised activity.

No digital system can be guaranteed to be completely secure. However, we will take reasonable and appropriate steps to identify, investigate, and respond to security concerns affecting personal data.

7.1 Account information

Account information is retained while your account remains active and for any additional period necessary to meet legal obligations, resolve disputes, prevent misuse, or maintain appropriate records.

7.2 Transaction and wallet records

Wallet funding records, payment information, transaction histories, and reconciliation records may be retained for as long as required under applicable financial, tax, accounting, anti-fraud, or other legal requirements.

7.3 Czetta Points and rewards information

Rewards, referral, redemption, and points transfer information may be retained for as long as necessary to administer the relevant programme, resolve disputes, investigate misuse, or satisfy legal obligations.

7.4 Customer support information

Customer support records may be retained for as long as necessary to address your request, review service quality, resolve related disputes, or satisfy applicable legal requirements.

7.5 Security and audit information

Authentication records, security events, and audit logs may be retained for as long as necessary to protect the platform, investigate incidents, support accountability, or comply with applicable obligations.

7.6 Deletion and disposal

Where personal data is no longer necessary for the purpose for which it was collected and no legal basis exists for further retention, we will delete, anonymise, or otherwise dispose of the information in an appropriate manner.

A request to delete your account or personal data does not automatically require the deletion of records that we are legally required to retain or that remain necessary for an ongoing dispute, investigation, or regulatory obligation.