Skip to content

Privacy Policy

Last updated 5 October 2026

This Privacy Policy explains how Kwugwo Limited (“Kwugwo”, “we”, “us”) collects, uses, shares and protects personal data when you (“Merchant”, “user”) use our payment orchestration platform, embedded checkout, Application Programming Interfaces (APIs) and websites (collectively, the “Service”).

At Kwugwo Limited, the privacy of every person who uses our services and their personal data is of utmost importance to us. We process personal data in compliance with applicable data protection laws, including the Nigeria Data Protection Act 2023 (“NDPA”), the General Application and Implementation Directive 2025 (“GAID”) and, where applicable, the EU General Data Protection Regulation (GDPR) and the UK General Data Protection Regulation (UK GDPR).

1. Who is responsible for your personal data?

The determination of who takes responsibility for personal data depends on the purpose for which the personal data is processed.

  • For data we collect to operate our business (e.g. Merchant account data, marketing data, analytics), Kwugwo is the data controller.
  • For data we process on behalf of a Merchant to route a transaction (e.g. a customer’s name, email, payment instrument identifier), Kwugwo is a data processor acting on the Merchant’s instructions. In that case the Merchant is the controller.

2. Data we collect

We collect personal data when you use the services on our website and digital platform.

(a) From Merchants, we collect:

  1. Account and business data, which includes legal name, contact person, address, RC number and beneficial-owner KYC.
  2. Usage data, consisting of API requests, dashboard interactions, IP, device and browser metadata.
  3. Communications and communication records, including emails, in-product messages and call recordings (with notice).

(b) From Customers paying via Kwugwo Checkout:

  1. Identifiers provided to the checkout, which may include name, email and phone (when collected by the Merchant).
  2. Payment instrument information, comprising card scheme, last 4 digits, BIN, transfer reference and USSD provider.

Kwugwo does not currently collect or request customers’ full primary account numbers (PAN) or CVV2 information. These details are transmitted directly to the applicable underlying PSP and are not received or stored by Kwugwo. However, Kwugwo reserves the right to modify its processing arrangements in the future, subject to applicable law and regulatory requirements.

  1. Transaction information, which includes amount, currency, merchant reference, status, PSP attempts and IP address.
  2. Device and risk signals, which include user agent, screen size, time zone and basic fraud detection measures.

3. How we use personal data

We may process your personal data for the following reasons:

  1. To provide the Service: Kwugwo may require your personal data to authenticate API requests, route transactions to Payment Service Providers (PSPs) or third parties, deliver webhooks (automated notifications between systems), render the checkout, and provide analytics and insights.
  2. To provide customer support, which includes answering enquiries and investigating disputes.
  3. To improve and enhance our services, such as system checks, fixing software errors and analysis of combined data.
  4. Legal and regulatory requirements, including responding to lawful requests from the CBN, NFIU, NDPC or courts of competent jurisdiction.

Important: we do not train any AI models on Merchant or customer data without obtaining express consent.

4. Lawful basis for processing your data

  • Consent: where consent is required, we will expressly seek and obtain your consent for the specific purpose for which your personal data will be processed.
  • Performance of a contract: we process personal data to provide services to Merchants and facilitate payments made by their customers.
  • Legal obligation: we will process your personal data where necessary to comply with our legal obligations.
  • Legitimate interest: we will process your personal data where necessary for our legitimate interests or those of a third party.

5. Sharing of personal data

We share your personal data only with:

  1. Payment Service Providers currently in use, as well as any future PSPs that you enable to process, charge or settle a transaction.
  2. Financial institutions, which include banks and card schemes, to the extent required to process or complete a transaction.
  3. Sub-processors engaged by us to provide infrastructure and other technical services, such as cloud hosting, monitoring and email delivery. A current list of our sub-processors is available upon request.
  4. Regulators and law enforcement, where compelled by law or where strictly necessary to prevent fraud.
  5. Professional advisers, such as lawyers, accountants and auditors, who are subject to appropriate duties of confidentiality and are permitted to process such data only as necessary to provide their professional services.
  6. Others with your express consent, where such consent is required.

Important: we do not sell personal data, and we do not share data with third parties for their own marketing purposes.

6. International transfers

Where we transfer personal data outside Nigeria, for instance to a cloud region in the EU or US, we rely on appropriate safeguards such as adequacy decisions, standard contractual clauses, or your express consent.

7. Data retention

We retain personal data in an identifiable format only for as long as necessary to deliver the service for which it was collected, comply with our legal or regulatory obligations, resolve disputes, enforce our agreements, and protect our legitimate interests. Where there is no legal or regulatory requirement for a longer retention period, we will retain personal data only for as long as reasonably necessary to deliver our services.

8. How we protect your data

(a) Security

  1. All traffic to Kwugwo’s APIs and checkout is encrypted with TLS 1.2 or higher.
  2. Production secrets are stored using appropriate security controls to prevent unauthorised access, disclosure or compromise.
  3. We maintain audit logs, intrusion monitoring and a documented incident-response process.
  4. Material breaches will be notified to the NDPC and affected parties within 72 hours after Kwugwo becomes aware of such breaches.

(b) Confidentiality

Your personal data is regarded as confidential and will not be divulged to any party except as provided in section 5.

9. Your rights

Subject to applicable law, you have the right to:

  1. Access the personal data we hold about you.
  2. Correct inaccurate or incomplete data.
  3. Request deletion (subject to our legal retention obligations).
  4. Port your data to another service in a structured, commonly used format.
  5. Withdraw consent where processing is based on consent.

In the unlikely event of a violation of any of your rights, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) or your local regulator.

If you are a customer of a Merchant and want to exercise these rights, please contact the Merchant first, as they are the controller of your data. We will assist them as required under the NDPA.

10. Cookies and similar technologies

Our marketing website, like most interactive websites, uses a small set of cookies for essential functionality and, with your consent, analytics cookies from Amplitude, including recordings of page visits. Until you make a choice in the cookie banner, we count page visits and use of the live demo anonymously, without cookies, stored identifiers or your IP address. If you decline, we collect neither. You can change your choice at any time on the cookie settings page. Our Checkout uses only the storage strictly necessary to render the payment session and remember your theme preference.

11. Age restriction

The Service is not directed at individuals under 18. We do not knowingly collect data from children. If we learn we have done so, we will delete it promptly.

12. Changes to this policy

This Privacy Policy is reviewed periodically. Where there are material changes or new regulatory requirements, such changes will be communicated by email or in-product notice before they take effect.

13. Contact

Our Data Protection Officer can be reached at hello@kwugwo.africa. Postal address: Kwugwo Ltd, Lagos, Nigeria.