1. Introduction
Davopay ( "we," "us," or "our") provides a digital finance platform that enables users to create USD virtual cards, trade gift cards, and send and receive money, bill payments and other financial services (the "Services"). This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and the rights you have over it.
Davopay is a financial technology company, not a bank. We are the technology layer, the underlying banking, card issuance, payment processing, infrastructure behind our Services is provided by our licensed and regulated partners. This matters for privacy because it means certain personal data you provide to use a specific feature (for example, card issuance) is also processed by that partner under their own regulatory obligations, in addition to Davopay's.
This Policy applies to all users of the Davopay mobile application and any related websites (collectively, the "Platform"). By creating an account or using the Platform, you agree to the collection and use of information as described here.
We process personal data in line with the Nigeria Data Protection Act, 2023 ("NDPA"), the Nigeria Data Protection Commission's General Application and Implementation Directive ("GAID") 2025, and applicable anti-money laundering ("AML") and know-your-customer ("KYC") rules set by the Central Bank of Nigeria ("CBN") and enforced in cooperation with the Nigerian Financial Intelligence Unit ("NFIU").
Davo Solutions LTD is registered with the Nigeria Data Protection Commission (NDPC) as a Data Controller of Major Importance and holds a valid NDPC registration certificate.
2. Who We Are
Davopay is operated by Davo Solutions LTD, a company registered in Nigeria, with its registered office at Enugu, Nigeria. For questions about this Policy or how your data is handled, contact us at:
- Email: support@davopay.com
3. Information We Collect
a) Identity and Verification Information Full name, date of birth, Bank Verification Number (BVN), National Identification Number (NIN), government-issued ID (passport, driver's license, voter's card), a photograph/selfie for identity verification, address, and nationality collected to satisfy KYC and AML obligations before you can use financial features of the Platform. Identity verification is carried out on our behalf by Dojah, our identity verification and AML compliance partner. Dojah receives and processes your identity documents and biometric data directly to perform this verification.
b) Contact Information Email address, phone number, and physical address.
c) Financial and Transaction Information Virtual card creation and usage data, transaction amounts, timestamps and counterparties, gift card trading activity, and money transfer records. We do not store full payment card numbers (PANs) on our own servers card issuance and processing are handled through our regulated card issuance partner.
d) Device and Technical Information IP address, device identifiers, operating system, browser type, mobile network information, app usage logs, and crash/diagnostic data.
e) Communications Records of your correspondence with our support team, and any information you provide when contacting us.
We collect this information directly from you (sign-up, KYC, use of the Platform), automatically through your use of the app, and from third parties including identity verification vendors and our card issuance, payment, and crypto liquidity partners.
4. How We Use Your Information
We use the information we collect to:
- Create and manage your account, verify your identity, and provide the Services;
- Comply with KYC/AML obligations, including BVN/NIN verification and sanctions screening;
- Process transactions, including authorization, settlement, chargebacks, and dispute resolution;
- Detect, investigate, and prevent fraud, unauthorized access, and other illegal activity, including blockchain-based screening of cryptocurrency transactions for AML/sanctions compliance;
- Provide customer support and respond to inquiries;
- Send you service-related communications (transaction alerts, security notices) and, only where you've consented, marketing communications;
- File regulatory reports required under applicable anti-money laundering law;
- Improve and develop the Platform; and
- Comply with applicable laws, regulations, and lawful requests from regulators or law enforcement.
We do not sell your personal data, and we do not share it with third parties for their own marketing purposes. Data is shared only as described in this Policy for service delivery, regulatory compliance, and fraud prevention.
5. Legal Basis for Processing
Subject to applicable data protection law, we process your personal data on one or more of the following bases: your consent; the necessity of processing to perform our contract with you; compliance with a legal obligation (including KYC/AML and other regulatory reporting requirements); and our legitimate interests in securing the Platform and preventing fraud, balanced against your rights.
6. How We Share Your Information
We may disclose your personal information to our affiliates, employees, officers, service providers, agents, and subcontractors, as reasonably necessary to provide the Services and for the purposes described in this Policy. Davopay does not sell your personal information.
Beyond that, we share personal information with third parties only in the following circumstances:
- With your consent or at your direction. For example, if you choose to connect a third-party service to your Davopay account, we share the information necessary to enable that connection. Any third party you authorize is governed by its own privacy policy, and Davopay is not responsible for how it subsequently handles your information.
- With service providers who process data on our instructions. This covers the partners who deliver the regulated parts of our Services including identity verification, card issuance and processing, payment processing, and cryptocurrency liquidity as well as infrastructure providers such as cloud hosting and customer support tooling. These parties may only process your information for the purpose we've engaged them for, under written confidentiality and data protection terms. Our currently active partners for each regulated function are named on our About Us page, which we keep up to date as those relationships change.
- For legal, safety, and compliance reasons. We may disclose information where we have a good-faith belief this is reasonably necessary to comply with applicable law, regulation, or legal process; to respond to a lawful request from a competent regulatory or law enforcement authority; to enforce our Terms of Service; or to detect, investigate, and prevent fraud, security incidents, or other harm to Davopay, our users, or the public.
- In connection with a business transfer. If Davopay is involved in a merger, acquisition, financing, or sale of some or all of its assets, we will give notice before your personal information is transferred and becomes subject to a different privacy policy.
We do not share your personal information with third parties for their own independent marketing purposes.
7. International Data Transfers
Your information may be processed by our employees, contractors, or service partners located outside Nigeria including in jurisdictions where our card issuance, payment processing infrastructure partners are licensed and regulated in the course of fulfilling transactions or providing support. Where this occurs, we apply the safeguards required under applicable data protection law for cross-border transfers, and we only work with partners contractually bound to protect your data to a standard consistent with Nigerian requirements.
8. Data Security
We apply industry-standard safeguards to protect your information, including encryption of data in transit and at rest, secure authentication, and continuous fraud monitoring. Access to your personal data is limited to employees, agents, and contractors who have a genuine business need to know it everyone with that access is required to handle it in line with this Policy and is trained on the importance of keeping it confidential. Our third-party service providers are contractually required to maintain equivalent safeguards and to process your data only on our instructions.
We maintain procedures to respond to a suspected data breach, and we will notify you and the relevant regulator where we are legally required to do so.
No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security. You also play a role here: keep your password and login credentials confidential, and notify us immediately at support@davopay.com if you suspect unauthorized access to your account. Subject to the retention obligations described below, we keep personal data only for as long as it's needed for the purposes we collected it for.
9. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. As a regulated fintech, Davopay is required by law to retain some KYC, transaction, and related records for a period beyond account closure the applicable period is set by financial services regulation rather than by this Policy, so it may be updated from time to time as that regulation changes. We access retained data internally only on a need-to-know basis.
We delete or securely dispose of data once it is no longer required by law through methods such as secure overwriting or deletion of digital records and destruction of any physical documents without requiring you to request it.
We may retain limited information for longer where necessary to protect the security of the Platform or prevent fraud for example, where an account is closed or suspended for suspected unsafe or fraudulent activity, we may keep relevant details to prevent unauthorized re-registration or further abuse. We may also retain and use anonymized or aggregated data, which can no longer identify you, for analytics and business purposes beyond the retention periods above.
10. Your Rights
Subject to applicable data protection law, you have the right to:
- Access the personal data we hold about you;
- Request correction of inaccurate or incomplete data;
- Request deletion of your data, subject to our legal and regulatory retention obligations;
- Object to or request restriction of certain processing;
- Object to decisions made solely by automated means that produce legal effects concerning you or similarly significantly affect you;
- Withdraw consent where processing is based on consent (this does not affect processing carried out before withdrawal);
- Request a copy of your data in a portable format; and
- Lodge a complaint with the relevant data protection authority.
To exercise any of these rights, contact us at support@davopay.com. We may need to verify your identity before actioning your request.
11. Children's Privacy
Davopay is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have collected data from someone under 18, we will take steps to delete it.
12. Cookies and Similar Technologies
Our app and website may use cookies, device identifiers, and similar technologies to keep you signed in, remember preferences, and understand how the Platform is used. You can control cookies through your device or browser settings, though disabling them may affect functionality.
13. Third-Party Links
The Platform may link to third-party websites or services, including our licensed partners' own platforms. We are not responsible for their privacy practices, and we encourage you to review their privacy policies separately.
14. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices, our partners, or legal requirements. We will post the updated version with a new "Last Updated" date, and, where changes are material, provide additional notice (e.g., in-app notification or email).