1. Who we are and what this policy covers
LuminPay Innovation Lab Limited, known as LuminPay (“LuminPay”, “we”, “us”), is a company incorporated in Nigeria (RC number 8388161) with its registered office at 1 Emmanuel Street, Ketu, Lagos, Nigeria. We provide a payment gateway that lets businesses accept stablecoin and crypto payments and receive settlement in naira, through our website (luminpay.co), merchant dashboard, payment links, invoices, developer tools and point-of-sale (POS) apps (together, the “Services”).
This policy explains how we collect, use, share and protect personal data under the Nigeria Data Protection Act 2023 (NDPA) and the regulations and guidance of the Nigeria Data Protection Commission (NDPC). It applies to:
- Merchants and their staff who open an account or use our dashboard, POS app or developer tools.
- Payers, meaning customers who pay a merchant through LuminPay.
- Visitors to our website, waitlist and social media pages.
Our role. For merchant account data, we are the data controller. For payment details that a merchant’s customer provides to complete a purchase, we are a controller for our own compliance, fraud-prevention and security purposes, and a processor acting on the merchant’s instructions for everything else. Each merchant is responsible for how it uses its own customers’ data.
2. Personal data we collect
Account and business details: full name, email address, phone number, job role, profile photo (if you add one), your sign-in PIN (stored only in hashed form), passkeys you register for biometric sign-in, and, if you sign in with Google or Apple, the name and email address they share with us. Also your business name, RC or business registration number, registration documents, business and outlet addresses, and team member details and their access roles.
Identity verification (KYC and KYB): your BVN and NIN, date of birth, a selfie or liveness check, proof of address, your CAC certificate and memorandum and articles of association (MEMART), details of directors and beneficial owners, and the results of sanctions, politically exposed person (PEP) and adverse-media screening.
Payout and financial details: Nigerian bank account details for payouts (including the account name returned by your bank when we verify the account), payout and settlement history, transaction amounts, fees, invoices and payment links you create.
Transaction and blockchain data: wallet addresses used to pay, transaction hashes, the asset and network used, timestamps, status and the conversion rate applied. Blockchain data is public by design (see section 6).
Payer details: wallet address, device and IP address, the amount and merchant, and any name or email entered for a receipt or invoice.
Technical and usage data: IP address, device type, operating system, app version, push notification tokens, log and session data, cookies and similar browser storage, and approximate location derived from IP address. If a merchant adds outlet locations, we store them.
Waitlist and communications: if you join our waitlist, your name, email, phone number (optional), business name, business type, approximate monthly sales, how you plan to accept payments, city, how you heard about us, the page or campaign link that brought you to us, and whether you agreed to receive marketing emails. We also keep support messages, survey answers and messages sent to our social media accounts.
We never ask for the private key or seed phrase of any wallet you use to pay us, and you should never share one with anyone.
3. How we use personal data and our lawful bases
| Purpose | Lawful basis under the NDPA |
|---|---|
| Create and manage accounts, process payments, convert to naira, settle and pay out | Performance of a contract |
| Verify identity and business, screen against sanctions and PEP lists, monitor transactions, keep records and report to authorities | Legal obligation, and legitimate interests |
| Prevent fraud and abuse, secure accounts, operate risk limits and our emergency kill switch | Legitimate interests, and legal obligation |
| Provide support and send service and security notices | Performance of a contract, and legitimate interests |
| Improve, test and develop the Services, and run analytics | Legitimate interests |
| Send news, launch updates and marketing (for example to waitlist subscribers) | Consent, which you can withdraw at any time |
| Enforce our terms and defend legal claims | Legitimate interests |
Automated decisions. Some risk checks, such as transaction and payout limits that depend on your verification level, are partly automated. You can ask for a human review of any decision that significantly affects you (see section 9).
5. Transfers outside Nigeria
Some of our providers store or process data outside Nigeria. We transfer personal data abroad only where the NDPA allows it: to a country or organisation with adequate protection, with appropriate safeguards such as contractual clauses, with your consent, or on another lawful basis.
6. Blockchain data
Payments on public blockchains are recorded permanently and visible to anyone. We cannot change or erase on-chain data. This limits the right to erasure for that data. We keep on-chain information to the minimum needed and, where the law allows, we will delete or de-link the off-chain records that tie a wallet address to your identity.
7. How long we keep personal data
- Account and verification records: for as long as your account is active and at least five (5) years after it closes, as Nigerian anti-money-laundering law requires.
- Transaction records: at least five (5) years from the date of the transaction.
- Support messages: two (2) years after the matter closes.
- Waitlist and marketing data: until you unsubscribe or withdraw consent, or until we no longer need it to contact you about joining.
- Technical logs: up to twelve (12) months.
After these periods we delete or anonymise the data, unless the law requires us to keep it longer.
8. How we protect personal data
We use technical and organisational measures that match the risk, including encryption of all connections to our Services (HTTPS/TLS), encryption of sensitive secrets such as two-factor authentication keys, encrypted storage of session credentials on POS devices, two-factor authentication for staff, role-based access controls, dual approval for sensitive internal actions, session controls, activity monitoring and audit logs, supplier checks and staff confidentiality duties. No system is completely secure, so please keep your PIN, API keys and devices safe and tell us at once if you suspect misuse.
If a breach is likely to put people’s rights and freedoms at risk, we will notify the NDPC within 72 hours of becoming aware of it, and tell affected people where the law requires.
9. Your rights
Under the NDPA you may ask us to:
- confirm whether we process your data and give you a copy;
- correct inaccurate or incomplete data;
- delete data we no longer need or have no right to keep;
- restrict or object to processing, including direct marketing;
- give you your data in a portable format;
- withdraw consent at any time, without affecting earlier processing;
- review an automated decision with a person.
Email support@luminpay.co. We may ask you to verify your identity, and we will respond within one month. Some requests may be limited by legal duties, for example record-keeping under anti-money-laundering law. If you are unhappy with our response, you may complain to the Nigeria Data Protection Commission.
11. Marketing and social media
We send launch updates and marketing only where you have joined our waitlist and ticked the box agreeing to receive them, or have otherwise agreed. We keep a record of what you agreed to and when. Every message has an unsubscribe option. Our social media pages are run on third-party platforms, which have their own privacy policies.
12. Children
The Services are for businesses and adults. We do not knowingly collect data from anyone under 18. If you think a child has given us data, contact us and we will delete it.
13. Third-party links
Our Services may link to websites and tools we do not control, including payers’ wallet apps. We are not responsible for their privacy practices.
14. Changes to this policy
We may update this policy as our Services or the law change. We will post the new version with a new date and, for material changes, tell merchants by email or in the dashboard before they take effect.
15. Contact us
For any privacy question or request, email our data protection contact. As we grow, we will appoint a Data Protection Officer where the NDPA requires one and update this policy.
- LuminPay Innovation Lab Limited (known as LuminPay), RC 8388161
- Registered office: 1 Emmanuel Street, Ketu, Lagos, Nigeria
- Data protection contact: support@luminpay.co
- NDPC registration: in progress