Privacy Policy

1. Information We Collect

We collect information necessary to verify your business, facilitate secure payments, prevent financial fraud, and comply with regulatory regulations. This includes:

• Merchant Profile Information: Business legal name, trading name, registration number (e.g., RC number), tax identification details, business address, telephone numbers, and email address.
• Know Your Business (KYB) Documentation: Official documents such as business registration certificates (CAC documents), proof of business address, and government-issued identification of directors, beneficial owners, or account representatives.
• Financial & Transaction Details: Dedicated virtual accounts assigned to you, incoming and outgoing transaction logs, payment methods, transaction amounts, timestamps, sender/recipient details, and payout or settlement destination bank details.
• Technical & Telemetry Data: IP addresses, API requests and response logs, access tokens, browser type, operating system, diagnostic telemetry, and event history (e.g., webhook payload delivery).

2. How We Use Your Information

We use your information to operate, secure, and optimize our payment infrastructure services:

• Identity & Compliance Verification: Conducting mandatory KYB checks, Anti-Money Laundering (AML) assessments, and counter-terrorist financing screening to approve your merchant account.
• Payment Processing & Reconciliation: Provisioning dedicated virtual accounts, routing incoming transfers, performing automated credit reconciliation, and notifying your backend via webhooks.
• Service Maintenance: Monitoring system health, debugging API integrations, and maintaining transaction logs.
• Security & Fraud Mitigation: Tracking anomalous transaction patterns, blocking fraudulent attempts, securing client access tokens, and preventing financial crime.
• Communications: Sending transactional alerts, service notifications, API updates, and responding to developer support inquiries.

3. Sharing Your Information

We do not sell, rent, or trade your data to third parties. We only share information in the following compliance-driven or operational situations:

• Partner Financial Institutions: We partner with licensed commercial banks (including Wema Bank, Providus Bank, and Sterling Bank) to issue dedicated virtual accounts. Business identity and transaction records are shared with these partners under strict regulatory guidelines.
• Regulatory & Law Enforcement: We may share data with central banking authorities, financial intelligence units, or law enforcement bodies if required by law or to comply with AML/CFT regulatory requirements.
• Service Providers: Trusted third-party vendors who provide essential infrastructure (such as secure cloud hosting and database services) under strict data protection agreements.

4. Data Security & Retention

We prioritize data security by employing industry-standard technical and organizational measures:

All data transmitted through Kredar is encrypted using Transport Layer Security (TLS/SSL) in transit and Advanced Encryption Standard (AES-256) at rest. We implement robust firewalls, automated access logs, and strict access controls to ensure your dashboard and business documents remain secure.

We retain merchant data for as long as is necessary to fulfill our service commitments or as legally mandated by relevant financial record-keeping laws and banking regulations in Nigeria.

5. Your Rights

Depending on your jurisdiction (such as the Nigeria Data Protection Regulation - NDPR), you may possess rights regarding the data we hold, including:

• Requesting access to the personal or business records we retain.
• Requesting correction or updates to inaccurate, incomplete, or out-of-date information.
• Requesting restricted processing or deletion under specific circumstances (subject to banking retention requirements).

To exercise any of these rights, or to contact our Data Protection Officer, please reach out to us at privacy@kredar.xyz.

6. Policy Updates

We may revise this Privacy Policy periodically to reflect updates in regulatory requirements or changes to our payment infrastructure. We will notify you of significant changes by publishing the updated policy on this page with a revised “Last Updated” date.