DelwaPay · DelwaPay

DelwaPay Privacy Notice

Version 2026-09-28 · last updated 28 September 2026

1. Who we are

DelwaPay is a payment platform owned and operated by DelwaPay. This notice explains how we collect and use personal data through DelwaPay, in line with the Nigeria Data Protection Act 2023 ("NDPA"). It applies to the DelwaPay dashboard, API, hosted checkout and payment links.

2. Our role for different people

Merchants and their team members (the businesses that use DelwaPay, and the people who sign in for them): we decide how their data is used, as a data controller.
Customers who pay a merchant through DelwaPay: we process their payment details to make the payment work for the merchant, and we also use some of them for our own legal obligations (such as fraud prevention and anti-money laundering checks). The merchant is responsible for its own use of its customers' data; ask the merchant about that.

3. What we collect

Account details: names, email addresses, phone numbers and roles of the people who use a merchant's account, and their sign-in activity.
Business verification: the business's legal name, registration and tax numbers, address, directors and owners (including names, roles and Bank Verification Numbers), and the documents the business uploads.
Settlement details: the bank account payouts are sent to.
Payment details: for each payment, the payer's name, email address and phone number (where given), the amount, the reference, how they paid, the date and time, and the result. For cards we keep only the card type and last four digits: full card numbers and security codes are never stored by DelwaPay.
Technical data: IP addresses, browser and device information, and records of actions taken in DelwaPay (an audit log), used for security.
Communications: messages you send us and emails we send you (for example, receipts, alerts and invitations).

4. Why we use it

To provide DelwaPay (performing our contract with the merchant): processing payments, refunds, settlements and payouts, running the dashboard and API, and sending service emails.
To meet legal obligations: verifying businesses (know-your-customer), anti-money laundering and counter-terrorist financing checks, keeping required records, and responding to lawful requests from regulators and authorities.
For legitimate interests that do not override your rights: preventing fraud and abuse, keeping DelwaPay secure, fixing problems, and improving the service.

We do not use your data for advertising, and we do not sell it. We do not make decisions with legal effects about you solely by automated means; where automated checks flag a risk, a person reviews it.

Licensed banks and payment service providers that move the money, as needed to process payments and payouts.
Identity and business verification services, to check the information provided at verification.
The merchant you paid, who receives the details of your payment.
Service providers that host DelwaPay or send its emails, under contracts that require them to protect the data and use it only for us.
Regulators, law enforcement and courts, including the Central Bank of Nigeria and the Nigerian Financial Intelligence Unit, when the law requires or permits it.
A company that takes over DelwaPay, if that happens, under this notice.

6. How long we keep it

Payment, settlement and verification records: for at least five years after the payment or after the business relationship ends, as anti-money laundering laws require, and longer where a dispute or investigation needs it.
Account details: while the account is open, then for five years.
Technical and security logs: for as long as needed for security, usually no more than two years, except audit records kept with the account.

When we no longer need data, we delete or anonymise it.

7. How we protect it

We use encrypted connections (HTTPS) everywhere; encryption for sensitive fields such as Bank Verification Numbers and API keys; one-way hashing for passwords; private storage for verification documents; two-factor authentication and role-based access for DelwaPay staff; and an append-only audit log of sensitive actions. No system is perfectly secure, but we work to protect your data and will tell you, and the Nigeria Data Protection Commission, about a breach where the law requires.

8. Where it is stored

DelwaPay's servers and some service providers may be located outside Nigeria. Where personal data is transferred abroad, we do so only as the NDPA permits, with appropriate safeguards such as contractual protections.

9. Your rights

Under the NDPA you can ask us to: tell you what personal data we hold about you and give you a copy; correct it; delete it; restrict or object to how we use it; and give it to you or another organisation in a portable format. You can also withdraw consent where we rely on it. Some requests are limited by legal obligations: for example, we cannot delete payment records we must keep for five years. We will reply within 30 days. If you paid a merchant, you can also contact the merchant directly.

10. Cookies

DelwaPay uses only the cookies it needs to work: to keep you signed in, protect forms against forgery, and remember choices such as light or dark mode. It does not use advertising or third-party tracking cookies.

11. Changes to this notice

We may update this notice. The version and date at the top show when it last changed, and we will tell merchants about significant changes.

12. Contact and complaints

For questions or to exercise your rights, email support@delwapay.com or write to DelwaPay, . If you are not satisfied with our answer, you can complain to the Nigeria Data Protection Commission.

DelwaPay. support@delwapay.com.