This Privacy Policy explains how VouchrPay (“VouchrPay,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you interact with our WhatsApp-native voucher platform, our website and landing pages, our merchant and partner integrations (including POS and payment rail partners), and any related services (collectively, the “Services”).

We built VouchrPay to move digital vouchers over WhatsApp with minimal friction. That convenience depends on trust, so this Policy is written to be read — not just filed. If any section is unclear, contact us using the details in Section 14

1. Scope of This Policy

This Policy applies to personal data processed by VouchrPay in connection with:

• Consumers (“Users”) who receive, hold, redeem, or gift vouchers through WhatsApp or our web channels;

• Businesses and their gift beneficiaries who accept, issue, or reconcile vouchers through VouchrPay's merchant tools and / or POS integrations;

• Partners, merchants and service providers, including Business Solution Providers (BSPs), payment processors, and POS network operators, to the extent their data flows through VouchrPay; and

• Visitors to our website, landing pages, and any pre-onboarding forms.

This Policy does not cover the practices of third parties we do not control, including WhatsApp/Meta Platforms, Inc., banks, or merchant partners acting as independent data controllers of their own data. Where relevant, we identify those parties and link to their own privacy notices.

2. Who We Are

VouchrPay is a Nigerian voucher infrastructure business that enables businesses to issue, distribute, and redeem digital vouchers through WhatsApp, backed by a merchant network, POS terminals, and payment-rail integrations. For the purposes of the Nigeria Data Protection Act 2023 (“NDPA”), VouchrPay acts as a Data Controller for the business and personal data it collects directly from Users and Merchants, and as a Data Processor when it processes data strictly on behalf of a Merchant (for example, redemption logs tied to a merchant's own loyalty programme).

3. Information We Collect

3.1 Information you provide directly

• Identity information: full name, company account details, and government-issued ID details (e.g., NIN or CAC where required) collected during KYC at onboarding;

• Contact information: WhatsApp-registered phone number, email address, and delivery/redemption preferences;

• Business information (Business and Merchants): business name, CAC registration details, authorized representative details, bank/settlement account information, and KYB documentation;

• Transaction information: voucher purchase, gifting, and redemption details, amounts, and counterparties;

• Support communications: anything you send us via WhatsApp chat, email, or support forms.

3.2 Information collected automatically

• WhatsApp interaction data: opt-in status, message delivery/read receipts, template interactions, and session metadata provided to us via our BSP;

• Device and usage data: IP address, device type, browser type, and general usage patterns on our landing pages;

• POS and settlement data: transaction references, terminal IDs, and settlement status from POS network partners (e.g., Firstmonie, Moniepoint) used to reconcile vouchers redeemed in-store.

3.3 Information from third parties

• Our BSP (e.g., Termii, GoWa), which relays WhatsApp messaging data necessary to deliver and track vouchers;

• Payment processors, banks, and POS partners, who confirm payment and settlement status;

• Businesses that may share limited customer contact details for the purpose of issuing a voucher on their behalf with the customer's consent.

We do not knowingly collect more identity data than is proportionate to the KYC/KYB tier applicable to a given transaction. Our internal KYC/KYB tiering and anti-cash-out controls determine the minimum data required at each threshold.

4. How We Use Your Information

• To create and manage your account, verify your identity, and administer KYC/KYB checks;

• To issue, deliver, track, and redeem vouchers, including sending WhatsApp messages required to complete a transaction;

• To process payments and reconcile settlements with POS and banking partners;

• To detect, investigate, and prevent fraud, money laundering, and abuse of the voucher and cash-out controls described in our compliance policy;

• To comply with legal and regulatory obligations, including reporting to the Nigerian Financial Intelligence Unit (NFIU) and other competent authorities where required;

• To provide customer support and respond to inquiries;

• To improve the Services, including WhatsApp opt-in flows, merchant tooling, and landing page performance;

• To send service messages (e.g., voucher confirmations, expiry reminders) and, only with your consent, marketing messages.

5. Legal Basis for Processing

Under the NDPA, we rely on one or more of the following lawful bases, depending on the activity:

• Consent — for WhatsApp opt-in messaging and any marketing communications, which you may withdraw at any time;

• Performance of a contract — to issue, deliver, and redeem a voucher you have requested;

• Legal obligation — for KYC/KYB checks, anti-money-laundering controls, and regulatory reporting;

• Legitimate interests — for fraud prevention, service improvement, and platform security, balanced against your rights and expectations.

6. WhatsApp-Specific Data Practices

Because VouchrPay operates natively on WhatsApp, it is important that you understand how that channel works:

• Opt-in required: We only send you WhatsApp messages after you complete our explicit opt-in flow. You can opt out at any time by replying “STOP” or through your WhatsApp settings.

• Business Solution Provider (BSP): We use a licensed WhatsApp BSP (currently 360dialog) to send and receive messages on our behalf. The BSP processes message metadata and content strictly to deliver the Service and does not use it for its own marketing purposes.

• Meta's role: WhatsApp is operated by Meta Platforms, Inc. Meta processes certain data (e.g., message routing metadata) under its own privacy policy and Business Messaging Terms, which operate independently of this Policy.

• Message content: Voucher codes and transaction confirmations sent via WhatsApp may be visible in your chat history on your device. You are responsible for the security of your own device and WhatsApp account.

7. How We Share Your Information

We share personal data only where necessary, and never sell personal data. We share information with:

• Merchants, limited to the data needed to issue or honour a voucher (e.g., name, phone number, voucher status);

• BSPs and payment/POS partners, to deliver messages and process transactions (e.g., 360dialog, Firstmonie, Moniepoint, and settlement banks);

• Regulators and law enforcement, where required by law, including NFIU reporting obligations for transactions that meet reporting thresholds;

• Professional advisers and auditors, under confidentiality obligations, in connection with legal, accounting, or compliance requirements;

• A successor entity, in the event of a merger, acquisition, or asset sale, subject to equivalent privacy protections.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, including:

• Account and KYC/KYB records: retained for the duration of the relationship and for a minimum period thereafter as required by applicable AML/CFT and NDPA record-keeping rules;

• Transaction records: retained to support reconciliation, dispute resolution, and regulatory reporting;

• Marketing consent records: retained until you withdraw consent, plus a reasonable period to evidence compliance;

• Support communications: retained for a limited period to resolve and audit support interactions.

Where data is no longer needed, we securely delete or anonymise it, subject to any legal hold or reporting obligation that requires longer retention.

9. Data Security

We apply technical and organisational measures appropriate to the sensitivity of the data we hold, including:

• Encryption of data in transit and, where applicable, at rest;

• Access controls limiting internal access to personal data on a need-to-know basis;

• Anti-cash-out and fraud monitoring controls integrated into our KYC/KYB tiering;

• Vendor due diligence for BSPs, payment processors, and POS integration partners before onboarding them.

No method of transmission or storage is completely secure. If we become aware of a data breach affecting your personal data, we will notify you and the National Data Protection Commission (NDPC) in accordance with NDPA requirements.

10. Cross-Border Data Transfers

Some of our service providers (for example, cloud infrastructure or messaging infrastructure providers) may process data outside Nigeria. Where this occurs, we take steps required under the NDPA to ensure an adequate level of protection, including contractual safeguards with those providers, before any such transfer takes place.

11. Your Rights Under the NDPA

Subject to applicable exceptions, you have the right to:

• Access the personal data we hold about you;

• Request correction of inaccurate or incomplete data;

• Request deletion of your data, where it is no longer needed for the purposes it was collected;

• Withdraw consent at any time, including opting out of WhatsApp messaging;

• Object to or request restriction of certain processing, including for direct marketing;

• Request data portability, where technically feasible;

• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been infringed.

To exercise any of these rights, contact us using the details in Section 14. We will respond within the timeframes required by the NDPA.

12. Children's Privacy

The Services are not directed at children under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child, we will take steps to delete it promptly.

13. Cookies and Similar Technologies

Our website and landing pages use cookies and similar technologies to remember preferences, measure performance, and support onboarding forms. You can control cookies through your browser settings; disabling them may limit some site functionality. We do not use cookies to track you across unrelated third-party sites for advertising purposes.

14. Contact Us

For questions about this Policy, or to exercise your data protection rights, contact:

• Entity: VouchrPay

• Data Protection Contact: privacy@vouchrpay.com

• Regulatorå: Nigeria Data Protection Commission (NDPC) — www.ndpc.gov.ng

15. Cookies and Similar Technologies

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or Service features. Where changes are material, we will notify you via WhatsApp or email prior to the change taking effect. The “Effective date” at the top of this Policy indicates when it was last revised.