Paystack’s Privacy Policy

While our services are primarily designed for businesses and organisations (“Merchants”), we recognise that individual consumers may interact with us through Merchants or website visits. We are committed to responsibly processing personal data for everyone involved. We generally process personal data at the direction of and on behalf of Merchants. When we do, we do so as a service provider or a “Data Processor” to those Merchants, but we do not control and are not responsible for the privacy practices of those Merchants. If you are a Customer of a Paystack Merchant, you should read that Merchant’s Privacy Policy and direct any privacy inquiries to that Merchant. If you are a Merchant, please see the Merchant Privacy Policy.

This Privacy Policy does not apply to services not owned or controlled by Paystack, including third-party websites and the services of Paystack’s Merchants. This Privacy Policy applies to all forms of systems, operations and processes within the Paystack environment that involve the processing of personal data. Paystack is a Stripe company; for more information about Stripe’s privacy practices, see the Stripe Privacy Policy.

While offering the Services to you, Paystack may create different products as part of the Services.

When you opt in to use one of our products, we will use your data for specific purposes, such as providing and improving the service. We may also share your data with subprocessors and partners, but only as necessary to offer the service you have opted into. We will handle your personal data in line with the purposes and methods outlined in this Privacy Policy, in addition to the principles of personal data processing as described in the Nigeria Data Protection Act, 2023 and its General Application and Implementation Directive (GAID):

1. Personal data is processed in a fair, lawful and transparent manner;
2. Personal data is collected for specified, explicit, and legitimate purposes, and is not to be further processed in a way incompatible with these purposes;
3. Personal data is adequate, relevant, and limited to the minimum necessary for the purposes for which the personal data was collected or further processed;
4. Personal data is retained for no longer than is necessary to achieve the lawful basis for which the personal data was collected or further processed;
5. Personal data is accurate, complete, not misleading, and, where necessary, kept up to date having regard to the purposes for which the personal data is collected or is further processed; and
6. Personal data is processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing, access, loss, destruction, damage, or any form of data breach.
7. We demonstrate responsibility for our data processing activities. We maintain records, respond promptly to your requests and complaints, adhere to regulatory directives, and are committed to these data protection principles. We handle your data professionally and ethically to prevent harm.

2.1   The Information We Collect

We collect personal data you provide to us. For example:

• Contact information. As part of our operations, Paystack may collect information such as your name, telephone number, email address, address, etc., to provide you with certain services.
• Payment information. If you make a purchase or other financial transaction, such as when you check out with Paystack on a Merchant’s website, we collect credit card numbers, financial account information, and other payment details
• Communications. If you contact us directly, for example, with an inquiry or a support request, we may receive additional personal data about you, including your email address and the content of your communications.

2.2   Personal Data We Collect Automatically

• Device information. We receive information about the device and software you use to access our Services, including Internet Protocol (IP) address, web browser type, operating system version, and device identifiers.
• Usage Information. To help us understand how you use our Services, including the Demo portion of our website, and to improve them, we automatically collect information about your interactions with our Services. This information includes records of your transactions and information about your other activities related to our services, such as the date and time of your sessions, the pages you view, links to/from any page, and time spent in a session. Some of the data we gather through cookies and similar technologies is discussed below.

• Location Information. We may collect or infer your general location information when you use our Services. For example, your IP address may indicate your general geographic region, which will be matched against our IP whitelist.

2.2   Personal Data That We Receive from Others

• Partners: Where required to enhance your profile, we collect additional personal data about you from third parties and other identification and verification services, including your financial institution and payment processor. We combine that data with other information we have about you.
• Publicly available sources: These include open government databases and other public information sources.

• Inferences: We infer additional Personal Data from the Personal Data described above. For example, we infer our website visitors' interests from the web pages they view.

When you are asked to provide personal data, you may decline. You may also use web browser or operating system controls to prevent certain types of automatic data collection. However, if you choose not to provide or allow the necessary information for certain services or features, those services or features may not be available or fully functional.

We use the Personal Data we collect to:

1. Provide you with the required services in addition to related products and services of interest;
2. Respond to your questions or requests;
3. Improve our product or service features with enhanced technologies, such as our AI feature for the Merchant dashboard;
4. Analyse data to develop products and services;
5. Address inappropriate use of our website and improve the website content;
6. Prevent, detect and manage risk against fraud and illegal activities using internal and third-party screening tools;
7. Send you marketing content, newsletters and service updates curated by Paystack (only with your explicit consent);
8. To deliver targeted advertisements for Paystack services. This includes securely sharing your contact details with Google (in a hashed format) to identify you as part of custom audiences for Paystack ads on Google's platform;
9. Verify your identity and the information you provide in line with Paystack’s statutory obligations using internal and third-party tools;
10. Maintain up-to-date records;
11. Conduct surveys to understand your needs and preferences, and to gather feedback on our services;
12. Generate insights and analytics to understand trends, optimise our operations, and enhance service delivery, which also involves the use of AI-powered analytics;
13. Resolve disputes that may arise, including investigations by law enforcement or regulatory bodies; and
14. Any other purpose that we disclose to you in the course of providing Paystack services to you

Paystack does not sell, trade or rent personal data to anyone. Further, we will not share or disclose your data with or to a third party without your consent, except as necessary to provide the Services or as described in this Privacy Policy.

• Merchant. We may share your contact information with merchants as part of your purchase details for record purposes. We will not share this information with third parties except as necessary to provide our website and services. We do not share your card information with merchants. Please review your merchant’s privacy policy to understand the privacy policies guiding the merchant you transact with.
• Service providers.  We share personal data with vendors or agents working on our behalf for the purposes described in this statement. For example, companies we've hired to provide customer service support, to protect and secure our systems and services, or to perform sanctions screening and identity verification services may need access to personal data to provide those functions. The processing by such third parties shall be governed by a written contract with Paystack to ensure that adequate security measures are in place to protect personal data in accordance with this Privacy Policy.
• Financial services & payment processing. When you provide payment data, for example, to make a purchase, we will share payment and transactional data with banks and other entities as necessary for payment processing, fraud prevention, credit risk reduction, or other related financial services.
• Affiliates. We enable access to personal data across our subsidiaries, affiliates, and related companies, for example, where we share common data systems or where access is needed to provide services and operate our business.
• Partners. We may share your data with companies we partner with for industry networking events, mixers, and other learning and development opportunities, but only with your explicit consent and with the option to opt out.

• Corporate transactions. We may disclose Personal Data as part of a corporate transaction or proceeding, such as a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets.

• Legal and law enforcement. We may access, disclose, and preserve personal data in accordance with applicable law and when we believe doing so is necessary to comply with applicable law or to respond to valid legal processes, including those from law enforcement or other government agencies.

• Third-party tools and service providers. We use third-party tools, such as OpenAI and Langfuse, to enhance our platform's search and data analytics capabilities. The processing by such third parties shall be governed by a Data Processing Agreement with Paystack to ensure that adequate security measures are in place to protect personal data in accordance with this Privacy Policy. We also share certain personal data with third-party service providers who assist us with our advertising and marketing efforts. For example, we share your hashed contact details (e.g., email address, phone number) with Google to facilitate targeted advertising through Google Customer Match. Google processes this data on our behalf to display relevant Paystack ads to you based on your likely interests and search context.
• Security, safety, and the protection of rights. We will disclose personal data if we believe it is necessary to:
  
  • protect our Users and others, for example, to prevent fraud or to help prevent the loss of life or serious injury of anyone;
  • operate and maintain the security of our services, including to prevent or stop an attack on our computer systems or networks; or
  • protect the rights or property of ourselves or others, including enforcing our agreements, terms, and policies.

We leverage third-party analytics to analyse personal data collected through our website and apps, including account information, marketing and communications data, demographic data, content and files, geolocation data, usage data, and inferences associated with identifiers and device information (such as cookie IDs, device IDs, and IP addresses) as described in Section 4 of this policy. This data is aggregated, enabling us to perform analytics and track our website's performance. For example, we use tracking technologies such as Google Analytics to analyse website traffic and Meta Pixel to deliver targeted advertisements. These tools collect data about your activity on our website, including page visits, clicks, and interactions. This data, combined with identifiers such as cookie IDs, device IDs, and IP addresses, is aggregated and analysed to understand user behaviour, improve our website, and deliver targeted advertisements on Facebook and Google. This approach enables us to enhance our marketing efforts and reach the right audience with relevant ads. You can learn how Google and Meta collect and use information.

We also use AI-powered platforms, including OpenAI's GPT and Langfuse, to deliver search and data analysis features to our Merchants based on their activity on our payment platform. You can learn how OpenAI and Langfuse collect and use information at.

Finally, we may share de-identified information in accordance with applicable law.

Please note that merchants, sellers, and other Users you buy from or contract with have their respective privacy policies, and although Paystack’s Merchant Terms of Use does not allow the other transacting party to use your information for anything other than as authorised by you, Paystack is not responsible for their actions, including their data protection practices. If you provide personal data to any of those third parties or allow us to share personal data with them, that data is governed by their privacy policies.

Cookies are small text files stored on your device when you visit a website. They enable the site to remember your actions and preferences over time. When you visit our Website, we use cookies to remember Users and make your user experience easier. We collect information such as your IP address, device identifier, browser type, operating system, information about your website use, and data regarding network-connected hardware (e.g., a computer or mobile device) to provide customised services, content and advertising; ensure your account security is not compromised; mitigate risk; promote trust and safety on our website, amongst others.

Cookies typically do not contain information that personally identifies a user. However, the personal information we store about You may be linked to the information stored in and obtained from Cookies.

For more information on the specific types of cookies used on our Website, please see our Cookies Table.

Many internet browsers are initially set up to accept cookies automatically. Unless you have adjusted your browser settings to refuse cookies, our system will issue cookies when you visit our Website. You can refuse to accept cookies by activating the appropriate settings in your browser. However, please note that disabling strictly necessary cookies will likely affect our Website's functionality.

Depending on your browser, further information may be obtained via the following links:

• Firefox
• Internet Explorer
• Google Chrome
• Safari
• Opera

Additionally, we use Google and Meta Pixels to better understand how visitors engage with our website and to improve the relevance of our content and marketing efforts. For example, Meta Pixel helps us measure the effectiveness of our adverts, optimise user experiences, and refine our services based on aggregated insights.

Pixels are not the same as cookies, but often rely on cookies to function. The Meta Pixel is a piece of JavaScript code that tracks user interactions on a website and links them to Meta ad campaigns. Google’s tracking pixel is a small, transparent image embedded in a website to track user activity, such as pages visited, to create more relevant ads for users. Paystack only uses Pixels to reach a relevant audience through targeted advertising, while respecting user privacy and complying with applicable laws. The Meta pixel is integrated with our Cookie banner script to ensure the pixel respects user cookie preferences and tracks only when the necessary consent has been obtained.

You can also prevent Meta Pixel from collecting data by adjusting your preferences in our cookies banner. To opt out of Meta Pixel, log out of Facebook when not in use and adjust your “Off-Facebook Activity”. To prevent Google Pixel tracking, you can use browser and email settings to restrict external graphics and HTML emails. You can do this by blocking third-party cookies, which are often used for tracking, activating the “Do Not Track” setting to alert websites not to track your activity, or installing browser extensions specifically designed to block trackers.

We also use Google Customer Match. This primarily uses data you provide directly to us (e.g., contact details) and is integrated with Google's advertising ecosystem. This may involve using identifiers or other tracking technologies to deliver targeted ads once a match is made.

Paystack has established adequate technical and organisational controls to protect the integrity and confidentiality of personal data, in both digital and physical formats, and to prevent it from being accidentally or deliberately compromised.

Paystack is committed to managing your data in line with applicable data protection laws and best practices. We protect your data using physical, technical, and administrative security measures to reduce the risks of loss, misuse, unauthorised access, disclosure and alteration. We also use industry-recommended security protocols to safeguard your data. Other security safeguards include, but are not limited to, data encryption, firewalls, and physical access controls to our building and files. They only grant access to personal data to employees who require it to fulfil their job responsibilities. Employees may have access to personal data only as is appropriate for the type and scope of the task in question, and are contractually forbidden to use personal data for their own private or commercial purposes, to disclose it to unauthorised persons, or to make it available in any other way.

In compliance with the Payment Card Industry Data Security Standard (“PCI DSS Requirements”), we implement access controls, security protocols, and standards, including encryption and firewall technologies, to ensure your card information is safe and secure on our servers. Additionally, we implement periodic security updates to ensure that our security infrastructure complies with reasonable industry standards.

Two-factor authentication (“2FA”) is an additional layer of security we have added to your account. When 2FA is enabled, you will be required to enter a One Time Password (OTP) (which is a verification code we have sent to you for authentication purposes), each time you check out using Paystack on a Merchant’s website or platform. While we encourage you to enable this feature on every transaction, you may disable 2FA after your initial enrolment by clicking the toggle button. However, if you choose to disable this feature, you agree that Paystack shall not be liable for any loss or damages incurred due to your action.

Personal data breach

At Paystack, we take the security of personal data seriously and have implemented measures to prevent data breaches. However, in the event of a data breach, we have established procedures for reporting and managing incidents. Paystack also maintains a data breach procedure to address incidents involving personal data or practices that lead to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access to personal data transmitted, stored, or otherwise processed. You may contact our Data Protection Officer (DPO) upon becoming aware of any breach of personal data, or if your access credentials have been compromised, to enable us to take the necessary steps to ensure the security of your data or account.

When we become aware of a data breach that affects personal data, we will notify the affected individuals and relevant authorities in accordance with applicable data protection laws and regulations. The notification will include the following information: The notification will include the following information:

• A description of the nature of the data breach, including the categories of personal data involved
• The likely consequences of the data breach
• The measures taken or proposed to be taken by Paystack to address the data breach, including any measures to mitigate its possible adverse effects

We will notify affected individuals without undue delay, but no later than 72 hours after becoming aware of the data breach, unless exceptional circumstances prevent us from doing so. We will also record any data breaches and provide this information to the relevant authorities upon request.

We encourage all users and customers to take reasonable steps to protect their data, such as using strong passwords, regularly updating their account information, and immediately reporting any suspicious activity to us.

We will report any breaches that will compromise your rights and freedoms to the Nigeria Data Protection Commission within 72 hours of discovery.

• Paystack’s use of emerging technology, particularly Artificial Intelligence, adheres to ethical, legal, and security standards. This may include controls such as transparency notices and human-in-the-loop processes.
• Paystack integrates AI features to improve products and services to better suit your needs. For instance, the AI-powered Dashboard search requires minimal access to personal data and no more than what was previously accessed via the Dashboard.
• Paystack shall continue to implement relevant measures to ensure the privacy and security of Personal Data when leveraging emerging technology.
• Merchants and their customers will be informed whenever AI is used to automate insights or process data. No individual will be penalised should they choose to opt-out of processing activities that use AI or other emerging technology.

We will retain your information for the following periods:

• As long as reasonably necessary for providing our services to you
• For the duration your account is active (if applicable), and we have your consent
• For the period needed to comply with our legal and statutory obligations
• As needed to verify your information with a financial institution
• For six (6) months on the Merchant AI Dashboard

Paystack is statutorily obliged to retain the data you provide to process transactions, ensure settlements, make refunds, identify fraud and comply with applicable laws and regulatory guidelines.

Under Nigeria’s Money Laundering (Prevention and Prohibition) Act, we are mandated to retain transactional records (customer and beneficiary names, addresses, identification numbers, amount, currency, etc.) for at least five years following the completion of the transaction. Under the Central Bank of Nigeria’s Framework for Mobile Payment Services in Nigeria, Paystack must maintain records of identification data, account files and relevant business correspondence for seven years following the termination of an account and/or business relationship. We keep our data retention policy under regular review.

Upon expiration of the applicable storage limitation periods, we will delete, erase, anonymise or pseudonymise any information we hold about you.

This Privacy Policy also applies when we retain your Personal Information after our relationship ends. We may also retain your Personal Information for the duration of any period necessary to establish, exercise or defend any legal rights. We may keep Personal Information indefinitely in a de-identified format for statistical purposes, including, for example, statistics on how you use the Services.

We transfer personal data outside Nigeria to other Paystack entities or third-party service providers in the course of providing our services. These transfers are conducted in accordance with the mechanisms permitted by the Nigeria Data Protection Act (NDP Act) and its General Application and Implementation Directive (GAID), ensuring adequate protection for your data. An example is Paystack’s use of AWS as a cloud storage solution, with servers in Ireland. We take steps to ensure that the data we collect under this Privacy Policy is processed and protected in accordance with this Policy and applicable law, wherever the data is located.

At Paystack, we take personal data security seriously. When personal data needs to be transferred to a country outside Nigeria, we implement adequate measures to ensure its security. We rely on our Binding Corporate Rules as a mechanism for cross-border data transfer between Paystack entities, and comply with all relevant data protection regulations and guidelines to ensure that personal data is always protected. Specifically, we use contractual terms to ensure that the personal data is adequately protected or that the country to which the data is being transferred has adequate data protection laws. We take additional measures to ensure that the country to which the data is transferred meets our data protection standards.

Should you wish to transfer your personal data to a country deemed to have inadequate data protection laws, Paystack will take all necessary steps to ensure that it is transferred under relevant, appropriate safeguards, and where relevant, with your informed consent, and that you are made aware of the risks associated with such a transfer. In any instance, Paystack will ensure personal data is transmitted safely and securely. Details of the protection provided when your data is transferred abroad and of the basis for such transfers shall be provided to you upon request.

Processing of Personal Information by Paystack will be lawful if one of the following applies:

• the Data Subject has given consent to the processing of his/her Personal Information for one or more specific purposes. You can revoke your consent by closing your Paystack account (where applicable) and/or by emailing us;
• the processing is necessary for the performance of a contract to which the Data Subject is a party or to take steps at the request of the Data Subject prior to entering into a contract;
• processing is necessary for compliance with a legal obligation to which Paystack is subject;
• processing is necessary for legitimate interests pursued by Paystack or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data; and
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of an official public mandate vested in Paystack.

At Paystack, We respect the rights of our customers and users, and we allow you to exercise them under the applicable data protection laws and regulations. Individuals who have Personal Information held by Paystack are entitled to reach out to Paystack to exercise the following rights:

• Right to request and access any Personal Information collected and stored by Paystack. This right allows you to request a copy of the personal information Paystack holds about you. To exercise this right, you can submit a request to the Data Protection Officer (DPO) or to our Data Subject Rights Team at [email protected]
• Right to be informed regarding the use of your Personal Information;
• Right to be informed about appropriate safeguards in place whenever your personal information is transferred abroad;
• Right to object to automated decision-making and processing. You have the right to object to the processing of your personal information, and to exercise this right, you can submit a request to the DPO or our Data Subject Rights Team;
• Right to request rectification and modification of Personal Information whenever you want us to correct your inaccurate or incomplete personal information, which Paystack keeps;
• Right to request the deletion of their personal information;
• Right to request the movement of your personal information from Paystack to a third party - this is the right to the portability of data;
• Right to revoke consent;
• Right to object to direct marketing, and to request that Paystack restrict the processing of their information; and
• Right to submit a complaint to the Nigeria Data Protection Commission (NDPC).

Your request will be reviewed and answered by Paystack’s Data Protection Officer within a 30-day period.

Your request will be reviewed and answered by Paystack’s Data Protection Officer within a 30-day period.

Data Subject's Standard Notice to Address Grievance (SNAG)

We encourage you to use the Standard Notice to Address Grievance (SNAG) if you believe your data privacy rights have been violated. The SNAG is a standardised template that allows you to formally request internal resolution from us. You can submit a SNAG directly or through someone acting on your behalf, including civil society organisations. We will track these notices, and if unresolved, the Nigeria Data Protection Commission (NDPC) may initiate an investigation.

To submit a SNAG, please fill out the form available in Schedule 9 of GAID on the NDPC’s website  or send an email to [email protected] with 'SNAG' in the subject line, outlining the details of your grievance. You can also serve a SNAG via our physical address, as outlined in Section 13 of the Privacy Policy.

Our Services are intended for people aged 18 or older.

We do not knowingly collect any “personal data” (as defined by the Nigeria Data Protection Act) from anyone under 18 without valid parental or guardian consent. If we become aware that we have collected such personal data without parental consent, we will take reasonable steps to delete it as soon as possible.

We may need to update, modify or amend our Privacy Policy as our technology evolves and as required by law. If we materially change how we use or share personal data previously collected from you through our Services, we will provide notice or obtain consent regarding such changes as may be required by law. The Privacy Policy will apply as of the effective date listed on our website.

Any violation of this Privacy Policy should be brought to the attention of the Data Protection Officer (details below) for appropriate sanctioning and treatment.

If you have any questions relating to this Privacy Policy or would like to find out more about exercising your data protection rights, please reach out to our DPO via email at [email protected].

For any further queries, our Data Protection Officer may be reached at the following address:

126 Joel Ogunnaike Street,

Ikeja GRA, Ikeja,

Lagos, Nigeria.