Privacy Policy

1. Who we are

SwiftlinkPay is operated by Swiftlink Global Services Limited (“SwiftlinkPay”, “we”, “us”), a company registered in Nigeria with the Corporate Affairs Commission under number [RC number], whose registered address is [Registered address]. Our office is at 4th Floor, Leadway House, Plot 1061 Herbert Macaulay Way, Central Business District, Abuja, FCT.

This Privacy Policy explains how we collect, use, share and protect personal data when you visit swiftlinkpay.com, use our merchant dashboard (app.swiftlinkpay.com), pay through our hosted checkout (checkout.swiftlinkpay.com), use our payment links, or integrate with our API. We process personal data in accordance with the Nigeria Data Protection Act 2023 (“NDPA”) and the regulations and guidance issued by the Nigeria Data Protection Commission (“NDPC”).

Our Data Protection Officer can be contacted at [DPO name and contact] or privacy@swiftlink.ng.

2. Our role: controller and processor

• Merchants and their team members. We are the data controller for personal data about the people who sign up for, own, represent or use a merchant account.
• Customers who pay merchants (“payers”). When you pay a business through SwiftlinkPay, we process your data on behalf of that business, which is generally the controller of your data. We may also act as an independent controller where we use payment data for our own legal obligations, fraud prevention and security. [Legal review: confirm the controller/processor allocation and align with the merchant agreement.]
• Website visitors and people who contact us. We are the data controller.

3. Personal data we collect

3.1 Merchant account and onboarding data

• Name, email address, phone number, job title and login credentials of account users.
• Business details provided during onboarding: business name, registration details, addresses, contact details, and settlement bank account details.
• Details of directors, owners and representatives, identity documents and verification data such as Bank Verification Number (BVN), collected to meet know-your-customer and anti-money-laundering obligations.
• Records of agreements you accept, team invitations, roles and account activity.

3.2 Payment and transaction data

• Payer name, email address, phone number and other details the merchant or payer provides with a payment.
• Card details (card number, expiry date and security data) entered on our checkout or sent to our API, which we process to obtain authorisation from the card issuer. [Legal/technical review: describe card data storage, tokenisation and retention accurately before publication.]
• Bank transfer and wallet payment details needed to complete a payment.
• Transaction amount, currency, reference, status, date and time, and the merchant paid.
• Technical data used for authentication and fraud prevention, such as IP address, device and browser information.

3.3 Website, email and support data

• Information you send us when you email us or ask for support.
• Basic technical information that our hosting infrastructure records when you visit the website, such as IP address, browser type and pages requested (server and security logs).
• Delivery information about emails we send, such as whether a message was delivered, bounced or marked as spam.

4. Why we use personal data and our lawful bases

[Legal review: confirm lawful bases and any legitimate-interest assessments.]

5. Emails we send

We send emails that are necessary to provide our services, such as account verification codes, password resets, team invitations, and transaction or report notifications. These service emails are sent from addresses on the swiftlinkpay.com domain. We do not sell email addresses and we do not send marketing emails without consent.

If you receive an email from us that you did not expect, or want to stop receiving a type of email, contact connect@swiftlink.ng. Any marketing email we send will include an unsubscribe option. We monitor bounces and complaints and stop sending to addresses that bounce or report our messages as spam.

6. Automated decisions

To protect payers and merchants, we use automated rules to assess payments for fraud and risk, which may result in a payment being declined or reviewed. If you believe a decision affecting you was wrong, contact us and we will review it with human involvement. [Legal review: confirm wording against NDPA requirements on automated decision-making.]

7. Who we share personal data with

• The merchant you pay, who receives the details of your transaction.
• Payment partners needed to complete a payment, such as acquiring banks and processors, card schemes, card issuers, banks and wallet providers. [List or categories to be confirmed.]
• Service providers who host and run our systems on our instructions, including cloud hosting and email delivery providers (for example, Amazon Web Services).
• Identity verification providers used during merchant onboarding. [To be confirmed.]
• Regulators, law enforcement and courts, where the law requires it or to protect our rights.
• Professional advisers such as auditors and lawyers, and a buyer or successor if our business is reorganised or sold.

We do not sell personal data.

8. International transfers

Some of our service providers store or process data outside Nigeria. Where personal data is transferred outside Nigeria, we do so only in line with the NDPA's rules on cross-border transfers, using appropriate safeguards. Our primary hosting region is [hosting region]. [Legal review: confirm data residency position and transfer mechanisms.]

9. How long we keep personal data

We keep personal data only as long as needed for the purposes above, including to meet legal, regulatory, accounting and dispute-resolution requirements. Transaction and know-your-customer records are kept for [retention period] after the end of the business relationship or transaction, as required by applicable law. Website and server logs are kept for [retention period]. [Legal review: set retention schedule.]

10. How we protect personal data

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls based on roles and permissions, and authentication of API requests with merchant keys. No system is completely secure; if a personal data breach occurs that is likely to put your rights at risk, we will notify the NDPC and affected people as the NDPA requires.

11. Your rights

Under the NDPA you have the right to:

• be informed about how your personal data is used;
• access the personal data we hold about you;
• have inaccurate data corrected and incomplete data completed;
• have your data deleted, where the law allows;
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable format, where applicable;
• withdraw consent at any time, where processing is based on consent;
• not be subject to decisions based solely on automated processing that significantly affect you, subject to exceptions in law; and
• lodge a complaint with the Nigeria Data Protection Commission.

To exercise your rights, email privacy@swiftlink.ng. If you paid a merchant through SwiftlinkPay, you may also contact that merchant directly, as it controls your payment data. We may need to verify your identity before acting on a request. We aim to respond within [response period].

12. Children

Our services are intended for businesses and adults. We do not knowingly collect personal data from children through this website.

13. Cookies

See our Cookie Notice for how this website and our services use cookies and similar technologies.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new “last updated” date and, where changes are significant, notify merchants by email or in the dashboard.

15. Contact us

Swiftlink Global Services Limited, 4th Floor, Leadway House, Plot 1061 Herbert Macaulay Way, Central Business District, Abuja, FCT. Data Protection Officer: [DPO name and contact]. Email: privacy@swiftlink.ng.