Privacy Policy for Peakpay

1. Lawful Basis for Processing

We process personal data on one or more of the following lawful bases:

• Your explicit consent
• The performance of a contract (loan and financial services)
• Compliance with legal and regulatory obligations
• Our legitimate interests, including fraud prevention, risk management, and service improvement, provided such interests do not override your rights

You may withdraw consent at any time, subject to legal and contractual restrictions.

2. Information We Collect

A. Information Collected with Permission

We only request permissions that are necessary for service delivery and regulatory compliance.

2.1 Approximate Location Data

We collect approximate location information to:

• Reduce fraud and account-related risks
• Support compliance and security monitoring

Location data is collected only with your consent and transmitted via encrypted channels.

2.2 Camera Access

Camera access is required for:

• Identity verification (KYC)
• Facial verification and document upload

Peakpay does not access photos or videos stored on your device outside the verification process. If camera permission is denied, certain services may be unavailable.

2.3 Emergency Contacts

We collect details of two emergency contacts, including name, relationship, and phone number, strictly for:

• Identity verification
• Credit risk assessment
• Fraud prevention

Contacts are collected only when explicitly selected by you. We do not access or store your full contact list.

2.4 Biometric (Face Recognition) Data

For liveness detection, Peakpay uses Apple’s TrueDepth API to process temporary facial mesh and landmark data locally on your device.

• Facial data is not stored, reused, or shared
• Data is deleted immediately after verification
• No biometric data is retained following app uninstallation

2.5 Device and Technical Information

We collect limited device information such as:

• Device model and OS version
• Network type
• Language and time zone
• Advertising identifiers (GAID / IDFA)

This information supports security monitoring, fraud prevention, analytics, and service optimization.

2.6 Advertising and Analytics

We use AppsFlyer for attribution, analytics, and fraud detection. You may manage or restrict ad tracking through your device settings.

3. Personal Information Provided by You

3.1 Categories of Data

We may collect and process:

• Full name
• Gender
• Date of birth
• BVN
• Phone number
• Residential address
• Emergency contact details
• Education and employment information
• Income details
• Bank account or wallet information

3.2 Purpose of Processing

Your data is used to:

• Verify identity and comply with KYC/AML regulations
• Assess creditworthiness and manage risk
• Prevent fraud and unauthorized access
• Deliver, maintain, and improve our services
• Communicate service updates, offers, and notices
• Resolve disputes and customer requests
• Comply with legal and regulatory obligations

4. Data Storage and Security

Peakpay, operated by Smart City Limited, implements industry-standard security measures, including:

• SSL/TLS encryption during data transmission
• Restricted internal access controls
• Secure server infrastructure
• Periodic security reviews and audits

We apply data minimization principles and retain personal data only to the extent necessary.

5. Data Sharing and Disclosure

We do not sell personal data.

We may disclose information only:

• To regulated service providers acting on our instructions
• Where required by law or regulatory authorities
• To prevent fraud or protect legal rights
• With your explicit consent

All third parties are contractually bound to confidentiality and data protection obligations.

6. Data Retention

We retain personal data only for as long as necessary to:

• Provide our services
• Fulfill contractual obligations
• Meet legal and regulatory requirements
• Resolve disputes and prevent fraud

Where retention is no longer required, data is securely deleted or anonymized.

7. Account Deletion and User Rights

You have the right to:

• Access your personal data
• Request correction or update
• Withdraw consent (where applicable)
• Request deletion of your account

Account deletion may be restricted if:

• There are active, pending, or unpaid obligations
• Retention is required by law

Re-registration using the same phone number is permitted after 15 days, subject to fraud-prevention controls.

8. Data Subject Rights (NDPR & GDPR)

Subject to applicable law, you may exercise the following rights:

• Right to access
• Right to rectification
• Right to erasure
• Right to restrict or object to processing
• Right to data portability
• Right to lodge a complaint with a data protection authority

Requests can be submitted using the contact details below.

9. Our Role as Data Controller

Smart City Limited acts as the Data Controller for personal data processed through Peakpay and is responsible for ensuring lawful, secure, and transparent handling of such data.

10. Changes to This Policy

We may update this Privacy Policy periodically. Updates will be published on the Platform. Continued use of Peakpay constitutes acceptance of the revised policy.