Privacy Policy

KimbiPay ("KimbiPay", "Kimbi", "we", "our" or "us"), operated by Kimbi Ltd, respects your privacy and is committed to protecting the personal information entrusted to us. This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you use the KimbiPay mobile application, website and related Services.

This Privacy Policy is intended to operate in accordance with applicable Nigerian data-protection legislation, including the Nigeria Data Protection Act 2023 (NDP Act) and applicable guidance issued by the Nigeria Data Protection Commission (NDPC).

1. Who We Are

The data controller responsible for your personal data is Kimbi Ltd. General enquiries: hello@kimbipay.com.

2. Information We Collect

Depending on how you use KimbiPay, we may collect the following categories of information:

• Account Information: Full name, email address, phone number, account credentials and other information required to create and secure your account.
• Transaction Information: Cryptocurrency wallet addresses, blockchain transaction IDs/hashes, deposit and conversion records, Naira withdrawal records, and related transaction and account activity.
• Device and Technical Information: Device type, operating system, application version, device identifiers, IP address, push-notification tokens, and technical logs required to maintain and secure the application.
• Support Information: Any information you provide when you contact customer support.
• Verification Information: Where required by applicable law or our compliance procedures, additional information or documentation to verify your identity, source of funds, or the legitimacy of transactions.

KimbiPay does not currently collect your Bank Verification Number (BVN) as part of the standard account-registration process. If this changes, we will update this Privacy Policy and provide appropriate notice.

3. How We Use Your Information

We process personal information to create and manage your account, provide cryptocurrency-to-Naira conversion and Naira withdrawal services, verify transactions, detect and prevent fraud, conduct KYC and AML/CFT checks, monitor transactions for security and compliance, send transaction confirmations and account notifications, provide customer support, maintain and secure our systems, investigate suspected abuse or unauthorised activity, comply with applicable laws and lawful requests from competent authorities, and exercise or defend our legal rights.

4. Lawful Basis for Processing

Depending on the circumstances, KimbiPay may process your personal information on the basis of your consent, performance of a contract with you, compliance with a legal or regulatory obligation, protection of legitimate interests, or another lawful basis permitted under applicable Nigerian data-protection law.

5. Data Sharing

We do not sell your personal information. We may disclose or provide access to personal information where reasonably necessary to service providers acting on our behalf, banks and payment processors, blockchain infrastructure providers, fraud-prevention and compliance providers, professional advisers and auditors, regulators and government authorities, or law-enforcement agencies where legally required or permitted. We only disclose information where there is an appropriate lawful basis.

6. International Data Transfers

Some of our service providers may process or store information outside Nigeria. Where personal information is transferred across borders, KimbiPay will take reasonable steps to ensure that such transfers comply with applicable Nigerian data-protection requirements and that appropriate safeguards are in place.

7. Data Retention

KimbiPay retains personal information only for as long as reasonably necessary to provide and administer the Services, maintain transaction records, prevent fraud, resolve disputes, protect legal rights, and comply with legal, regulatory, accounting or reporting obligations. Some information may need to be retained after account closure where required by law, regulation, fraud-prevention requirements, dispute resolution or legitimate business purposes.

8. Your Data-Protection Rights

Subject to applicable law and any lawful limitations, you may have the right to:

• Be informed about how your data is processed;
• Request access to personal data held about you;
• Request correction of inaccurate or incomplete information;
• Object to certain processing, or request restriction in appropriate circumstances;
• Request deletion or erasure where applicable;
• Withdraw consent where processing is based on consent; and
• Request data portability where applicable.

9. How to Exercise Your Rights

To exercise a privacy right or submit a data-protection request, contact hello@kimbipay.com. Your request should, where possible, include your full name, the email address associated with your KimbiPay account, the nature of your request, and any information reasonably necessary to verify your identity.

10. Children's Privacy

KimbiPay is intended for persons aged 18 and above. We do not knowingly provide Services to persons under 18 or intentionally collect their personal information.

12. Account Security

You are responsible for protecting your KimbiPay credentials, PIN, device and authentication methods. Your PIN is stored on our systems only in hashed form — it is never stored or transmitted in plain text, and KimbiPay will never intentionally ask you to disclose your password, PIN or private authentication credentials through an unsolicited communication. Wallet private keys are encrypted using industry-standard encryption (AES-256-GCM). If you believe your account has been compromised, contact KimbiPay immediately at hello@kimbipay.com.

13. Data Breaches and Security Incidents

If KimbiPay becomes aware of a personal-data breach, we will assess and respond to the incident in accordance with applicable law and regulatory requirements, including notification to affected users or a competent authority where required.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our Services, applicable law, our technology or data practices, new regulatory requirements, or changes to third-party service providers. Where changes are material, we may notify you through the application, email or another appropriate channel. The "Last updated" date at the top of this page indicates when it was most recently revised.

15. Complaints

If you believe KimbiPay has improperly processed your personal information, please contact us first at hello@kimbipay.com. You may also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), the statutory data-protection authority established under the Nigeria Data Protection Act 2023.

16. Contact Us

Kimbi Ltd · General Support: hello@kimbipay.com