PERCENTPAY PRIVACY POLICY

Last updated: 14 June 2026 (Version 2.1)

This Privacy Policy (“Privacy Policy”) explains how Personal Information is collected, used, stored, disclosed and otherwise processed by Percent Technologies Limited (“PercentPay”, “we”, “us”, and “our”). It is issued in compliance with the Nigeria Data Protection Act 2023 (the “NDPA”), the Nigeria Data Protection Regulation 2019 (the “NDPR”), the NDPC General Application and Implementation Directive 2025 (the “GAID”), the CBN Consumer Protection Regulations 2019, and other applicable data protection laws and regulations.

The provisions of this Privacy Policy supersede all previous notices and statements regarding our privacy practices in respect of our Services.

1. Application of this Privacy Policy

This Privacy Policy applies generally to the business of PercentPay and sets out our approach to Personal Information, including the Personal Information of our consumer Users (“Users”). It applies to the systems, operations, and processes of PercentPay that involve the collection, use, storage, transfer, and disclosure of Personal Information.

This Privacy Policy applies to your use of our website at https://percentpayapp.com, the PercentPay mobile application, and all affiliated websites, applications, online services, related services, sales, marketing, promotional events, and social media activities (collectively, the “Services”). For Users, this Privacy Policy is part of, and incorporated by reference into, our Terms and Conditions.

This Privacy Policy applies to your use of the Services regardless of the means of access — desktop, laptop, mobile phone, tablet, or any other consumer electronic device (each, a “Device”). It also applies to offline interactions with PercentPay.

By accessing or using our Services, you confirm that you have read, understood and accepted this Privacy Policy.

2. Our Role and Legal Basis for Processing

For the purposes of the NDPA, PercentPay is a Data Controller in respect of the Personal Information of its Users. In some processing activities (such as where we process Personal Information on behalf of business customers under a separate written agreement), we act as a Data Processor.

We rely on the following lawful bases under section 25 of the NDPA for processing your Personal Information:

• Performance of a contract: where processing is necessary for the performance of our contract with you (these Terms) or to take steps at your request prior to entering into that contract — for example, to open and operate your PercentPay Account, process Payment Instructions, and operate Spaces.
• Legal obligation: where processing is required to comply with our legal obligations, including under the CBN AML/CFT/CPF Regulations 2022, the Money Laundering (Prevention and Prohibition) Act 2022, the Terrorism (Prevention and Prohibition) Act 2022, the Companies Income Tax Act, the Federal Inland Revenue Service (Establishment) Act, and any sanctions regime applicable to PercentPay or its Partner Bank.
• Legitimate interest: where processing is necessary for our legitimate interests (or those of a third party), provided your interests, rights and freedoms do not override those interests — for example, fraud prevention, network and information security, and product improvement.
• Consent: where you have given consent — for example, for marketing communications, optional product features, or the processing of special-category data. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Vital interest: where processing is necessary to protect your vital interests or those of another natural person, in exceptional circumstances.

3. Information We Collect and How We Collect It

3.1 Information You Provide to Us

In general, you can visit https://percentpayapp.com without telling us who you are. When you submit an inquiry, register for a PercentPay Account, register for a PercentPay event, interact with us on social media, take part in competitions or promotional activities, or otherwise volunteer information to us, we may collect Personal Information about you (collectively, “Personal Information”).

As a User, we will also ask you to create login information for your PercentPay Account, such as a username (a “PercentPay Tagname”) and password. Where you provide your mobile phone number, we may ask for your consent to receive text messages relating to our Services on that number.

The kinds of Personal Information we may collect, use, store, and transfer include:

• Identity Information: first name, last name, maiden name (where applicable), username, marital status, title, date of birth, gender, and government-issued identifiers such as your Bank Verification Number (BVN) and National Identification Number (NIN).
• Contact Information: billing address, delivery address, email address, and telephone number(s).
• Financial and Transaction Information: bank account details, debit/credit card details (where applicable), wallet balance, transaction history, Virtual Account Numbers (VANs), Internal Flow and External Inflow records, and Space contribution records.
• Device Information: hardware model, operating system version, unique Device identifiers, mobile network information, and mobile phone number.
• Profile Information: username, password (in encrypted form), profile picture, interests, preferences, feedback, and survey responses.
• Usage Information: details of your use of our Services, including pages viewed, features used, and interactions with Spaces, votes cast, and transactions initiated.
• Marketing and Communications Information: your preferences in receiving marketing from us and our third parties, and your communication preferences.
• Location Information: your current location disclosed by GPS technology or any other location-detection means, where you grant consent.

We may also collect, use and share aggregated data (such as statistical or demographic data) for any lawful purpose. Aggregated data does not, on its own, identify you.

3.2 Information About Your Transactions

We collect Personal Information about your transactions with us and with others. Users may provide business-related information regarding their customers, staff, personnel, and related data in the course of using our Services. We may also collect information from a User’s customers in the process of providing our Services.

3.3 Information from Third Parties

We may collect Personal Information about you from other companies — for example, from a consumer reporting agency, from your employer (where your employer provides a service to PercentPay), from our Partner Bank in connection with KYC and transactional information, or from a User where your Personal Information is provided in a Next-of-Kin form.

3.4 Information Automatically Collected

We (or our service providers acting on our behalf) may collect information about your use of our Services. This information may include Personal Information as well as statistical information that does not identify you (“Analytics”). When Analytics are, directly or indirectly, associated or combined with Personal Information, they will be treated as Personal Information for the purposes of this Privacy Policy.

Information that we automatically collect includes:

• Device-specific information (such as hardware model, operating system version, unique Device identifiers, and mobile network information);
• The Device’s Internet Protocol (IP) address;
• Identification numbers associated with your Devices;
• Device event information (such as crashes, system activity, and hardware settings);
• Location preferences;
• Date and time stamps of transactions;
• System configuration information; and
• Other interactions with our Services.

3.5 Information Collected Through Cookies and Similar Technologies

We use cookies to personalise our Services and to collect aggregate information about usage. A cookie is a text file or other local storage identifier provided by your browser or associated applications. General information about cookies is available at www.allaboutcookies.org.

The cookies we may use include:

• Session cookies: temporary cookies that expire and are automatically erased whenever you close your browser. We use session cookies to grant Users access to authenticated content.
• Persistent cookies: cookies that remain in your browser until they expire or you manually delete them. We use persistent cookies to better understand usage patterns so we can improve our Services.
• Third-party cookies: we permit certain third parties (such as Google Analytics) to place cookies through our Services to provide us with insights into the use of our Services. We do not control the use of such third-party cookies and are not responsible for the actions or policies of such third parties.

By accessing or using our Services, you consent to the placement of cookies on your Devices as described in this Privacy Policy. If you prefer not to receive cookies, you may adjust your browser settings. If you set your browser to refuse all cookies, some features of our Services may be limited.

3.6 Do-Not-Track Signals

Do Not Track (“DNT”) is an optional browser setting allowing you to express your preferences regarding tracking by advertisers and other third parties. At present, we do not use technology that recognises DNT signals from your web browser.

4. How We Use Your Information

We use your Personal Information for the lawful purposes set out in Section 2, including:

• to perform our obligations under our contract with you, including operating your PercentPay Account, processing Payment Instructions, operating Spaces (Private and Public), issuing VANs through the Partner Bank, and applying the External Inflow Fee;
• to send you important notices, such as communications about transactions, account activity, and changes to our terms, conditions and policies;
• to ensure that content from our Services is presented in the most effective manner for you and to notify you about changes to our Services;
• to administer our Services and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
• to comply with our AML/CFT/CPF, sanctions, tax and other regulatory obligations;
• to measure or understand the effectiveness of advertising and to deliver relevant advertising to you;
• to make suggestions and recommendations about goods or services that may interest you;
• to detect, prevent, investigate, and respond to fraud, security and abuse incidents; and
• to offer our products and services, and the products and services of selected third parties, where you have consented.

We may combine information we receive from other sources with information you give to us and information we collect about you, and use the combined information for the purposes set out above.

We may use your email address to respond to your inquiries and to provide information about our Services. You may opt out of receiving promotional emails from us by clicking the “unsubscribe” link in any such email or by contacting us as indicated below. If you unsubscribe, we may still send you non-promotional communications relating to your Account or our ongoing business relations.

5. How We Share Information

You agree that we may share your Personal Information, and other information that you share with us:

• if you request or authorise it;
• if the information is provided to help complete a transaction for you;
• with any of our affiliated companies and service providers;
• with our Partner Bank, 9 Payment Service Bank Limited (9PSB), or any other CBN-licensed institution providing underlying banking, escrow, wallet, or VAN services;
• with other financial service providers, including the financial institutions identified in your cardholder bank agreement that provide banking services in connection with your PercentPay Account;
• with another User where you sign up via a referral link (the referring User may receive information indicating you have enrolled);
• with non-financial companies, such as email service providers performing marketing services on our behalf, and fraud-prevention service providers;
• with a non-affiliated third party to access and transmit your personal and financial information from a relevant financial institution, in accordance with that third party’s privacy policy;
• with selected third parties including business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you;
• with third parties in connection with the sale, transfer, merger, financing, acquisition of, or investment in, any part of our business;
• in response to a valid request for information from any governmental, regulatory, quasi-governmental, law enforcement, judicial or quasi-judicial authority, or where required by law, court order, subpoena, or other legal process;
• for our everyday business purposes;
• for the publication of our events and competitions on digital and print media;
• to protect our rights, property, or safety, or the rights, property, or safety of our Users or others;
• with relevant law enforcement officials or other third parties, such as investigators or auditors, if we believe it is appropriate to investigate fraud or other unlawful conduct.

We do not share your Personal Information with: (a) other companies for joint marketing purposes without your consent; or (b) any other third parties so that they can independently market to you.

If you or your customers provide us with bank account, debit card or other payment information through our Services, we may share that information with third-party payment processors and other third-party service providers, solely to the extent necessary to provide the relevant Services.

When you are no longer our User, we may continue to share your information as described in this Privacy Policy, to the extent permitted by law.

We may disclose Analytics with third parties for our commercial purposes, as described elsewhere in this Privacy Policy.

6. Cross-Border Data Transfers

We may transfer your Personal Information to recipients located outside Nigeria for the purposes set out in this Privacy Policy, including to our service providers, hosting providers, analytics providers, and Partner Bank affiliates. Where such transfer takes place, we will comply with the requirements of sections 41 to 43 of the NDPA, including by:

• confirming that the recipient is in a country that provides an adequate level of protection (as may be determined by the NDPC); or
• where the recipient is not in such a country, putting in place appropriate safeguards (such as standard contractual clauses, binding corporate rules, codes of conduct, or certification mechanisms approved by the NDPC); or
• relying on a permitted derogation under the NDPA, including your explicit consent, the necessity of the transfer for the performance of a contract with you, or the establishment, exercise, or defence of a legal claim.

You may obtain a copy of the safeguards we use for cross-border transfers by contacting our Data Protection Officer at dp*@***********pp.com.

7. Opt-Out Rights

If you do not wish to receive marketing offers or other notices from us in the future, you can “opt out” by contacting us at the address at the end of this Privacy Policy, or by following the “unsubscribe” instructions in any communication you receive from us. As a User, you cannot opt out of operational communications about your PercentPay Account or related transactions, as these are necessary for the performance of our contract with you.

8. Your Rights Under the NDPA

Subject to the NDPA and other applicable laws, you have the following rights in relation to your Personal Information:

8.1 Right to Information and Access

You can ask us whether we hold your Personal Information and request access to that information. Before responding, we will require you to provide proof of your identity. We will respond to your request as soon as possible and, in any event, within thirty (30) days of receipt.

8.2 Right to Rectification

You may request the correction of any inaccurate or incomplete Personal Information we hold about you. If you are a User, you can update certain Personal Information through your PercentPay Account profile. Changes to financial details (such as bank account information) will require direct contact with us. Any changes will only affect future processing of your Personal Information.

8.3 Right to Erasure (“Right to Be Forgotten”)

You may request the deletion or removal of your Personal Information where there is no good reason for us to continue processing it, where you have successfully objected to processing, where we have processed your information unlawfully, or where we are required to erase your Personal Information to comply with applicable law. We may decline an erasure request in specific circumstances permitted by law (for example, where the information is needed for legal compliance, regulatory record-keeping, or the establishment, exercise or defence of legal claims). We will notify you of any refusal at the time of the request.

8.4 Right to Restrict Processing

You may request that we restrict the processing of your Personal Information in certain circumstances, including where you contest the accuracy of the information, where you have objected to processing pending verification of our legitimate grounds, or where processing is unlawful but you do not want erasure.

8.5 Right to Object

You may object to the processing of your Personal Information where you feel it impacts your fundamental rights and freedoms. You also have the right to object at any time to processing for direct marketing purposes. Where we are processing on the basis of legitimate interests, we may continue processing if we can demonstrate compelling legitimate grounds that override your rights and freedoms.

8.6 Right to Data Portability

Where we process your Personal Information by automated means on the basis of consent or contract, you may request that we provide it to you, or transmit it directly to another data controller, in a structured, commonly used, machine-readable format.

8.7 Right to Withdraw Consent

Where our processing is based on consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of any processing carried out before withdrawal. If you withdraw consent, we may not be able to continue to provide certain Services to you, and we will advise you if this is the case.

8.8 Right to Lodge a Complaint

You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC). See Section 15 for details on how to escalate a complaint.

To exercise any of these rights, please contact our Data Protection Officer at dp*@***********pp.com. We will not charge a fee for responding to a request, unless your request is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or refuse to act on the request.

9. Automated Decision-Making and Profiling

In limited circumstances, we may make decisions about you based solely on automated processing (including profiling) — for example, automated fraud-prevention checks, transaction-risk scoring, or automated KYC verification. Such automated decisions may, in certain cases, produce legal or similarly significant effects on you (for example, the rejection of a transaction or the temporary restriction of your PercentPay Account).

Where this occurs, you have the right to:

• obtain human intervention by an appropriate member of our team;
• express your point of view; and
• contest the decision.

You may exercise these rights by contacting our Data Protection Officer at dp*@***********pp.com.

10. Information You Share Socially

Our Services may allow you to connect and share your actions, comments, content and information publicly or with friends. We are not responsible for maintaining the confidentiality of any information you choose to share publicly or with friends.

Our Services may also allow you to connect with us on, share on, and use third-party websites, applications and services. Please be mindful of your personal privacy needs and those of others as you choose what to share. We cannot control the privacy or security of information you choose to make public or share with others, and we do not control the privacy practices of third parties. Please contact those sites and services directly for information on their privacy practices.

11. Security of Your Personal Information

We have appropriate technical and organisational security measures in place to protect your Personal Information from accidental loss, unauthorised access, alteration, or disclosure. These measures include encryption (such as Transport Layer Security and Secure Sockets Layer) for the transmission of sensitive data, role-based access controls, network and infrastructure monitoring, regular security testing, and incident response procedures.

We limit access to your Personal Information to employees, agents, contractors and other third parties who have a business need to know. They are subject to a duty of confidentiality and process your Personal Information only on our instructions. We require our third-party service providers to maintain a written information security program with administrative, technical and physical safeguards reasonably designed to protect Personal Information from loss, misuse, or unauthorised alteration.

No method of electronic transmission or storage is 100% secure. We cannot, therefore, guarantee absolute security. You also play a role in protecting your Personal Information — please safeguard your email address, username and password, and do not share them with others.

If we receive instructions using your PercentPay Account login information or other Account security credentials, we will consider that you have authorised those instructions. You agree to notify us immediately of any unauthorised use of your PercentPay Account or any other breach of security.

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will, in accordance with the NDPA:

• notify the Nigeria Data Protection Commission (NDPC) of the breach within seventy-two (72) hours of becoming aware of it (where feasible), and where this is not possible, provide reasons for the delay;
• where the breach is likely to result in a high risk to your rights and freedoms, notify you without undue delay, describing the nature of the breach, the likely consequences, the measures we have taken or propose to take, and the contact details of our Data Protection Officer;
• maintain a record of all personal data breaches and the actions taken in response.

You can help us protect your Personal Information by promptly reporting any suspected breach or unauthorised use of your PercentPay Account to dp*@***********pp.com or in**@***********pp.com.

13. Data Retention

We will retain your Personal Information for only as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, tax, regulatory, or reporting requirements.

The specific Retention Period for each category of Personal Information is set out in our Data Deletion Policy, available at https://percentpayapp.com/data-deletion. The Data Deletion Policy reflects the record-keeping obligations under the Money Laundering (Prevention and Prohibition) Act 2022, the CBN AML/CFT/CPF Regulations 2022, the Companies and Allied Matters Act 2020, the Federal Inland Revenue Service (Establishment) Act, and other applicable Nigerian laws. Where multiple Retention Periods apply, the longest applicable period prevails. We may retain certain information for longer where required by law or regulatory direction (for example, in connection with an ongoing investigation or dispute).

Where we no longer have a lawful basis to retain your Personal Information, we will securely delete, destroy, or anonymise it.

14. Protecting Children’s Privacy

Our Services are not directed to, or intended to be attractive to, children. Users must be at least eighteen (18) years old to register a PercentPay Account, in line with our eligibility requirements under our Terms and Conditions.

In accordance with section 31 of the NDPA, we do not knowingly collect Personal Information from any child under the age of thirteen (13) without the verifiable consent of the child’s parent or legal guardian. If you are under eighteen (18), please do not use our Services or submit any information to us. If you are a parent or guardian and become aware that your child or ward has provided us with Personal Information without your consent, please contact us immediately at dp*@***********pp.com so we can take appropriate action, including the deletion of such information.

15. Lodging a Complaint with the NDPC

If you believe that our processing of your Personal Information infringes the NDPA or any other applicable data protection law, you have the right to lodge a complaint with:

Nigeria Data Protection Commission (NDPC)

Website: https://ndpc.gov.ng

Email: in**@******ov.ng

We would, however, appreciate the opportunity to address your concerns before you approach the NDPC. Please contact our Data Protection Officer at dp*@***********pp.com in the first instance.

16. Links to Third-Party Websites

When you use our Services, you may be directed to other websites that are beyond our control. We may also allow third-party websites or applications to link to our Services. We are not responsible for the privacy practices of any third parties or the content of linked websites. We encourage you to read the applicable privacy policies and terms of conditions of such parties. This Privacy Policy only applies to our Services.

17. Data Protection Officer

We have appointed a Data Protection Officer (DPO) responsible for overseeing questions in relation to this Privacy Policy. The DPO can be contacted at:

Data Protection Officer

Percent Technologies Limited

Email: dp*@***********pp.com

You may contact the DPO with any questions about this Privacy Policy, to exercise any of your rights under Section 8, or to lodge a complaint about our processing of your Personal Information.

18. Changes to Our Privacy Policy

Subject to applicable law, we may revise this Privacy Policy from time to time. Where the revision is material, we will post the revised version on the Mobile Application and notify you (by in-App notification, email, or both) at least seven (7) days before it takes effect, with the updated effective date shown at the top of this Privacy Policy. Non-material revisions (such as typographical corrections or clarifications) may be made at any time and become effective on posting.

You are free to decide whether or not to accept a revised version of this Privacy Policy. Continued access to or use of our Services after a revised version takes effect constitutes your acceptance of the revised Privacy Policy. If you do not agree, your sole recourse is to terminate your access and use of our Services.

19. How to Contact PercentPay

If you have any questions, comments, or concerns about your Personal Information or this Privacy Policy, please contact us at:

Percent Technologies Limited

Email: in**@***********pp.com

Data Protection Officer: dp*@***********pp.com

Website: https://percentpayapp.com

 

— END OF PRIVACY POLICY —