1.Who we are
AfroPin is owned and operated by AfroPin Software Limited, a company incorporated in Nigeria ("we", "us"). For the personal data described in this policy we are the data controller under the Nigeria Data Protection Act 2023 (the "NDPA"), except where section 6 says otherwise.
2.Who this policy covers
- Partner contacts: people who apply for, own, direct or use a brand or reseller account, including their staff and developers.
- Terminal users: staff who sign in to a web till or the AfroPin terminal app.
- Customers: people who buy or hold a PIN, whose details reach us through a reseller.
- Website visitors: people who browse our website or contact us through it.
3.What we collect
| Category | Examples | Source |
|---|---|---|
| Application and contact | Name, company, email, phone, country, website, expected volumes, messages | You, through our forms |
| Verification (KYC) | Company registration details and documents; directors' and owners' names, dates of birth, addresses, positions and shareholdings; business address | You |
| Account and security | Login details, two-factor settings, staff roles, audit logs of changes, IP addresses and device information | You and your use of AfroPin |
| Terminal sign-ins | Terminal name, sign-in and sign-out times, IP address, device and app version | The till or app |
| Financial | Payout bank details, wallet funding, fees, commissions and transaction records | You, our payment provider and the Services |
| Customer details | Name, email address and phone number attached to a PIN, and the PIN's transaction history | The reseller that sold the PIN |
| Website | Pages viewed, browser and device data, cookie choices, chat messages | Your browser, with consent where required |
4.How we use it
| Purpose | Lawful basis under the NDPA |
|---|---|
| Reviewing applications, verifying businesses and opening accounts | Contract; legal obligation (anti-money-laundering and know-your-customer checks) |
| Providing the Services: issuing, delivering and redeeming PINs, Wallets, payouts and reporting | Contract |
| Sending PINs, new codes and service messages to Customers | Contract (with the reseller); legitimate interests in delivering what the Customer bought |
| Securing accounts, detecting fraud and abuse, and keeping audit trails | Legitimate interests; legal obligation |
| Keeping financial and tax records, and responding to regulators and law enforcement | Legal obligation |
| Supporting you and improving the Services | Legitimate interests |
| Sending partner news and product updates to business contacts | Legitimate interests, or consent where required; you can opt out at any time |
| Sending offers to Customers who ask for them | Consent, which you can withdraw at any time |
| Non-essential website cookies and analytics | Consent |
We do not use personal data for automated decisions that produce legal or similarly significant effects on you without human review.
5.How we protect PIN codes
- We never store PIN codes in a readable form. We keep a one-way fingerprint to check a code when it is presented, and a masked version (for example 4821-****-****-0917) for receipts and reports.
- Tills, dashboards and receipts show codes masked. A full code is sent only to the Customer, or to the reseller's systems so they can pass it to the Customer.
- If a webhook carrying a code cannot be delivered, we keep that code encrypted so it can be resent, for no more than 72 hours, then delete it.
- A Customer can add a PIN to Google Wallet or Apple Wallet from a link their reseller sends. The pass shows the code, so we pass the code and balance to Google, or to the Customer's iPhone, to keep the pass up to date. An iPhone fetches its pass from us again whenever the PIN changes, so for a PIN in Apple Wallet we keep the code sealed with a key that only that pass holds: we cannot read it, and it is opened only when the Customer's iPhone asks for the pass. We delete it when the PIN is blocked, expires or is spent, or the pass is removed from the Customer's devices.
- Customer email addresses and phone numbers attached to PINs are stored encrypted.
6.Customers of our partners
When a reseller sells a PIN, it may give us the Customer's name, email address or phone number. We use these only to deliver the PIN and related notices (such as a new code after a part payment, or a reissued code), to prevent fraud, and to keep the records the law requires. We do not send Customers our own marketing unless they ask for it: a new gift card's email includes a link to hear about offers from brands on AfroPin, and only Customers who follow it and confirm are added to our mailing list, with a record of when they agreed. Every marketing email has a link to unsubscribe.
The reseller is responsible for collecting these details lawfully and telling the Customer how they will be used. Brands see redemptions of their own Products with masked codes; they do not receive Customers' contact details from us.
8.International transfers
Some of our service providers process data outside Nigeria. Where they do, we transfer data only as the NDPA permits, for example where the recipient country provides adequate protection or where we have appropriate contractual safeguards in place.
9.How long we keep it
| Data | Kept for |
|---|---|
| Account, verification and transaction records | For as long as the account is open, then at least six years, as required for financial, tax and anti-money-laundering records |
| Customer details attached to PINs | For as long as the PIN can be used, then for the same record-keeping period as its transactions |
| Undelivered webhook codes | No more than 72 hours |
| Sealed codes of PINs in Apple Wallet | Until the PIN is blocked, expires or is spent, or the pass is removed |
| Applications that do not proceed | Up to two years, unless you ask us to delete them sooner |
| Website analytics | As set out in the cookie settings |
When data is no longer needed, we delete it or make it anonymous.
10.Security
We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and of sensitive fields at rest, two-factor authentication for partner accounts and sensitive changes, signed API requests, role-based access for our staff, and audit logs. No system is completely secure; if a breach is likely to put your rights at risk, we will notify you and the Nigeria Data Protection Commission as the NDPA requires.
11.Your rights
Under the NDPA you have the right to:
- be told how your data is used, and get a copy of it;
- have inaccurate data corrected, and incomplete data completed;
- have data deleted, or its use restricted, where there is no longer a good reason to keep it;
- receive your data in a portable format;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent, where we rely on it, without affecting earlier processing; and
- complain to the Nigeria Data Protection Commission.
To use these rights, email us at the address below. We will confirm your identity and respond within the time the law allows. Some data must be kept by law even if you ask us to delete it; we will tell you if that applies. How to have your data deleted
13.Children
AfroPin is a service for businesses. Partner accounts are not for anyone under 18, and we do not knowingly collect data from children for them.
14.Changes to this policy
We may update this policy. We will post the new version here with its date and, for significant changes, tell partner account holders by email or in the dashboard.
15.Contact us
For privacy questions or to use your rights, contact our data protection lead:
AfroPin Software Limited
Email: [email protected]