1. Who we are
NectPay Ltd ("NectPay", "we", "us") is the data controller for personal data processed in connection with our cross-border payments infrastructure service.
Registered address: Registered in England & Wales — address on file at Companies House (No. 16134387)
Company number: 16134387
ICO registration number: Registration number: ZC195350
Data Protection Officer / contact: privacy@nectpay.com
This policy applies to personal data we process about: (a) individuals who use our website, (b) representatives of business clients who use the NectPay API or dashboard, and (c) recipients of payouts sent through NectPay by our clients.
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Client account data | Name, work email, company name, role | Provided directly by client representatives |
| Recipient transaction data | Name, identification number (e.g. BVN, national ID), account/wallet details, payout amount and currency | Submitted by our business clients via the API, on behalf of their own customers/payees |
| Compliance screening data | Sanctions/PEP screening results, jurisdiction-specific documentation | Generated internally and via screening sub-processors |
| Technical data | IP address, browser type, device identifiers, API request logs | Collected automatically |
| Communications | Support enquiries, demo requests, waitlist submissions | Provided directly via website forms |
Where NectPay processes recipient transaction data, our business client is typically the data controller for that data and NectPay acts as a data processor on their behalf, under a separate data processing agreement. This policy describes NectPay's general practices; the controlling terms for a specific client relationship are set out in that client's contract with NectPay.
3. Why we collect it
- To process payout transactions submitted via our API, including routing, FX conversion, and compliance screening.
- To meet our legal and regulatory obligations, including anti-money laundering (AML), know-your-customer (KYC), and sanctions screening requirements.
- To operate and improve our website and API, including diagnosing technical issues.
- To respond to enquiries, demo requests, and support requests.
- To detect, investigate, and prevent fraud and financial crime.
4. Our legal basis for processing
Under UK GDPR, we rely on the following legal bases depending on the type of processing:
- Contractual necessity — to provide the payment services our clients have engaged us to perform.
- Legal obligation — for AML/KYC checks, sanctions screening, and financial recordkeeping required by UK and applicable foreign law.
- Legitimate interests — for fraud prevention, service improvement, and security monitoring, balanced against individual rights.
- Consent — for non-essential cookies and optional marketing communications (see our Cookie Policy).
5. Who we share data with
We share personal data only where necessary to deliver our service or meet legal obligations, including with:
- Payment rail partners — banks, mobile money operators, agent networks, and digital asset settlement partners required to complete a payout in the destination market.
- Compliance and screening providers — third parties that perform sanctions and PEP screening on our behalf.
- Cloud infrastructure providers — for secure hosting and storage of data.
- Regulators and law enforcement — where required by law, court order, or regulatory request.
- Professional advisors — auditors, lawyers, and insurers, where necessary and under confidentiality obligations.
We do not sell personal data, and we do not share recipient transaction data for advertising purposes.
6. International transfers
Because NectPay's service involves sending payments into African markets, personal data (principally recipient name, identification, and account/wallet details) is necessarily transferred to payment rail partners located in the destination country.
Where personal data is transferred outside the UK/EEA, we rely on one or more of the following safeguards: the UK International Data Transfer Agreement (IDTA), UK-approved adequacy regulations, or Standard Contractual Clauses with the receiving party, supplemented by a transfer risk assessment specific to the destination market.
7. How long we keep data
- Transaction and compliance records: retained for a minimum of 5 years from the date of the transaction, in line with UK financial recordkeeping requirements (to be confirmed once FCA authorisation is obtained).
- Account data: retained for the duration of the client relationship plus a reasonable period afterward for legal and accounting purposes.
- Website enquiry/waitlist data: retained for up to 24 months, or until you ask us to delete it, whichever is sooner.
8. Your rights
Subject to certain exemptions (in particular around AML/KYC records, which we may be legally required to retain regardless of a deletion request), you have the right to:
- Request access to the personal data we hold about you.
- Request correction of inaccurate data.
- Request erasure of your data, where applicable.
- Object to or restrict certain processing.
- Request a portable copy of data you've provided to us.
- Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.
To exercise any of these rights, contact us at privacy@nectpay.com. We will respond within one month, as required by UK GDPR.
9. How we protect your data
We apply encryption in transit and at rest, role-based access control, and audit logging across our systems. Full detail is available on our Security & Compliance page.
10. Cookies
Our website uses cookies for essential site functionality and, where consented to, analytics. See our Cookie Policy for full detail and how to manage your preferences.
11. Children's data
NectPay's services are intended for use by businesses and their authorised representatives, not by children. We do not knowingly collect personal data from individuals under 18.
12. Changes to this policy
We may update this policy as our services, legal obligations, or processing activities change. Material changes will be notified to registered clients by email; the "last updated" date below will always reflect the current version.
13. How to contact us
For any privacy questions or to exercise your rights: privacy@nectpay.com.
For security concerns specifically: security@nectpay.com.