Privacy policy

Effective date: 1 January 2026

1. Who we are

Uverus Banking is a Banking-as-a-Service platform operated by Uverus Technologies Limited ("Uverus Banking", "we", "us", "our"), a technology company incorporated under the laws of the Federal Republic of Nigeria, with its registered office in Abuja, Nigeria.

Uverus Banking is a B2B platform. Our direct customers are operators — banks, fintechs, and enterprises — who use our infrastructure to deliver financial products to their own end customers. For the purposes of data protection law, we act as a data controller for information collected directly through our websites and operator-facing tools, and as a data processor for personal data processed on behalf of operators in the course of delivering platform services.

We are registered with the Nigeria Data Protection Commission (NDPC) as required by the Nigeria Data Protection Act 2023 (NDPA) and operate in compliance with the Nigeria Data Protection Regulation 2019 (NDPR) and applicable Central Bank of Nigeria (CBN) regulations.

2. What we collect

The personal information we collect depends on how you interact with us. We collect information in two contexts:

From operators and their representatives:

Business registration data — company name, registration number, registered address, and details of beneficial owners and directors, as required for Know Your Business (KYB) verification under CBN regulations.
Representative identity data — full name, email address, phone number, government-issued ID (including BVN and NIN where required), and a biometric photograph for individuals who register on behalf of operator businesses.
API and integration data — API keys, webhook configurations, integration logs, and technical identifiers associated with operator accounts.
Commercial and billing data — payment method details, invoicing information, and transaction records relating to operator fees and settlements.

From end-customers of operators (as data processor): Where operators use our platform to onboard and serve their own customers, we process personal data on their behalf. This includes KYC data (name, date of birth, BVN, NIN, identity documents), account data, and transaction records. In this context, the operator is the data controller; we process data only on the operator's documented instructions.

Automatically collected data:

IP addresses, device identifiers, browser type and version, operating system, and session activity when you use our dashboard or API.
Log data including API request and response metadata, error reports, and latency metrics.

We do not knowingly collect personal information from individuals under 18 years of age in our direct capacity as data controller. Operators are responsible for ensuring that their own KYC processes comply with applicable age verification requirements.

3. How we use it

We use personal information for the following purposes:

Operator onboarding and account management — conducting KYB checks on operator businesses and their beneficial owners, creating and managing operator accounts, and maintaining the contractual relationship.
Platform delivery — operating the accounts, KYC/KYB, cards, payments, treasury, and FX services that make up the Uverus Banking platform.
CBN and NDPR compliance — verifying operator and end-customer identities as required by CBN KYC/AML guidelines, screening against sanctions lists and PEP databases, and monitoring transactions for suspicious activity under the Money Laundering (Prevention and Prohibition) Act 2022.
Fraud and security — detecting and preventing unauthorised access, fraud, and other security threats to platform integrity.
Service improvement — analysing usage patterns to improve platform reliability, performance, and feature development.
Billing and settlement — calculating and collecting operator fees, processing settlements, and maintaining financial records.
Legal and regulatory obligations — responding to lawful requests from the CBN, NDPC, EFCC, and other authorities, and maintaining records as required by applicable law.
Communications — sending platform notifications, security alerts, API documentation updates, and, where consented, product communications.

4. Sharing

We do not sell personal information. We share it only in the following circumstances:

Operators — in our capacity as data processor, we share end-customer data with the operator on whose behalf we are processing it, as directed by the operator's documented instructions.
Service providers — cloud infrastructure providers, identity verification services, payment processors, fraud prevention vendors, and other third parties that assist us in operating the platform. These parties are bound by data processing agreements and may process data only on our instructions.
Regulatory and law enforcement bodies — we share information with the CBN, NDPC, EFCC, Nigerian Police Force, and other authorities as required by law or lawful order.
Group companies — we may share information with other entities in the Uverus Technologies group where necessary to deliver integrated services, subject to appropriate data sharing agreements.
Business transfers — in the event of a merger, acquisition, or asset sale, personal information may transfer to the acquiring entity. We will notify operators of any such transfer as required by law.

5. Retention

We retain personal information for as long as necessary to fulfil the purposes for which it was collected and to meet our legal obligations. Our standard retention periods are:

KYB and KYC records — minimum 5 years after the end of the operator relationship, and up to 7 years where required by the EFCC Act or CBN AML/CFT regulations.
Transaction records — minimum 5 years from the date of each transaction, in line with CBN record-keeping requirements.
Operator account data — for the duration of the operator's account and 5 years following account closure, unless a longer period is required by law.
API and technical logs — up to 2 years from the date of the log entry, unless retention is required for an active investigation or dispute.
Marketing and communications data — until consent is withdrawn or the operator relationship ends, whichever is earlier.

After the applicable retention period, personal information is securely deleted or anonymised so that it can no longer be associated with an individual or business.

6. Your rights (NDPR)

Under the Nigeria Data Protection Act 2023 and the NDPR, you have the following rights in respect of personal information for which Uverus Banking is the data controller:

Right of access — you may request a copy of the personal information we hold about you.
Right to correction — you may request correction of inaccurate or incomplete personal information.
Right to deletion — you may request deletion of your personal information where it is no longer necessary for the purpose for which it was collected. Note that we may be required by law to retain certain information (particularly KYB, KYC, and transaction records) and cannot delete it in those circumstances.
Right to data portability — where processing is based on consent or contract, you may request your data in a structured, commonly used format.
Right to withdraw consent — where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Right to object — you may object to processing based on legitimate interests, including direct marketing.
Right to lodge a complaint — if you are dissatisfied with how we handle your personal information, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

End-customers of operators should direct rights requests to the operator in the first instance, as the operator is the data controller for that processing. We will assist operators in fulfilling end-customer rights requests as required by our data processing agreements.

To exercise your rights as an operator representative, contact us at privacy@uverusbanking.com. We will respond within 30 days and may need to verify your identity before processing your request.

7. Cookies

We use cookies and similar technologies on our website and operator dashboard. Strictly necessary cookies are required to operate the platform and cannot be disabled. We also use analytics cookies to understand how the dashboard is used and to improve the operator experience.

You may configure your browser to refuse or delete non-essential cookies. Disabling strictly necessary cookies will prevent you from accessing the dashboard. We do not use cookies for advertising or cross-site tracking purposes.

8. Updates

We may update this policy from time to time to reflect changes in our services, applicable law, or our data practices. We will provide advance notice of material changes by email or by posting a notice on our website. The updated policy will take effect on the date stated at the top of this document.

Continued use of the Uverus Banking platform after the effective date of an updated policy constitutes your acceptance of the changes. If you do not agree to an updated policy, you must stop using the platform before the effective date.

9. Contact

For questions, concerns, or requests relating to this policy or your personal information, contact our Data Protection Officer:

Email: privacy@uverusbanking.com
Uverus Banking (Uverus Technologies Limited), Abuja, Nigeria

If you are not satisfied with our response, you may escalate your complaint to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.