Privacy & Data Protection Policy

1. Our Privacy Commitment & NDPA Compliance

Fim Digital Ventures Limited is committed to protecting the privacy, confidentiality, and integrity of personal and business information entrusted to us. This Privacy Policy outlines our data processing activities in full compliance with the Nigeria Data Protection Act 2023 (NDPA), the CBN Consumer Protection Framework, and global data security best practices.

2. Information We Collect

To provision digital accounts, process financial transfers, and satisfy mandatory regulatory compliance guidelines, we collect the following categories of data:

• Merchant Profile Coordinates: Full legal name, verified corporate business name, registered email address, telephone numbers, and designated settlement commercial bank details.
• KYC & Identity Verification Dossiers: Bank Verification Number (BVN), National Identity Number (NIN), biometric face match photos, government-issued identity cards, and Corporate Affairs Commission (CAC) registration files.
• Transaction & Ledger Metadata: Payment references, inbound transfer amounts, timestamps, payment rails utilized, customer payment identifiers, and dispute resolution records.
• Technical & Telemetry Data: IP addresses, browser user-agents, Webhook dispatch delivery logs, hardware device fingerprints, and security session cookies.

3. Legal Basis & Purpose of Data Processing

Pursuant to Section 25 of the NDPA, we collect and process your information strictly under the following lawful bases:

• Contractual Performance: Enabling payment processing, dynamic checkout generation, dedicated virtual account allocation, and merchant payouts.
• Statutory & Legal Compliance: Satisfying mandatory anti-money laundering (AML), customer due diligence (CDD), and statutory regulatory reporting obligations.
• Legitimate Interests: Real-time anti-fraud surveillance, bot protection, cyber anomaly detection, and platform availability monitoring.

4. Encryption Architecture & Credential Protection

We enforce strict cryptographic controls across every layer of our platform infrastructure:

• Transport Encryption: All connections and developer API calls are protected using high-grade transport encryption and strict security policies.
• Data-at-Rest Protection: Sensitive records, API secret keys, and webhook signing secrets are encrypted using authenticated encryption at rest.
• One-Way Credential Hashing: Passwords and authentication secrets are stored exclusively using irreversible cryptographic one-way hashing. Cleartext credentials are never saved.
• Biometric Passkeys (WebAuthn): Modern biometric authentication generates secure key pairs directly inside your device; private keys are never transmitted to our servers.

5. Third-Party Disclosures & Licensed Banking Partners

We do not sell, rent, monetize, or trade your personal or business information to third-party advertisers.

We disclose necessary transactional and identity records exclusively to:

• Licensed Commercial Banks & Microfinance Banks: Regulated banking partners to provision dedicated virtual account numbers, receive interbank deposits, and disburse settlements.
• Licensed Payment Switching Networks: Official interbank switches and card schemes (Mastercard, Visa, Verve) strictly as necessary to route and settle transactions.
• Statutory Authorities: Regulatory bodies including the Nigerian Financial Intelligence Unit (NFIU), Central Bank of Nigeria (CBN), and Federal Inland Revenue Service (FIRS) when compelled by lawful statutory mandate.

6. Data Retention & Statutory Audit Periods

Pursuant to the Money Laundering (Prevention and Prohibition) Act 2022, financial transaction ledgers, KYC verification dossiers, and audit trails are retained for a mandatory statutory minimum period of five (5) years following account closure. Following the expiration of the statutory retention window, data is permanently expunged using cryptographic overwriting.

7. Your Statutory Rights Under the NDPA

As a data subject, you possess the following rights under Nigerian data protection law:

• Right to Access: Request a copy of your personal data held on file.
• Right to Rectification: Request correction of inaccurate or incomplete profile records.
• Right to Erasure: Request deletion of personal records, subject to mandatory financial and AML statutory retention obligations.
• Right to Data Portability: Export your transaction ledgers and account statements in structured CSV/PDF formats via your dashboard anytime.

8. Contact Our Data Protection Officer (DPO)

For inquiries, statutory rights requests, or feedback regarding our privacy practices:

Email: support [at] fimpaypoint.com
Operating Entity: Fim Digital Ventures Limited