Privacy Policy

1. Information We Collect

Depending on how you use FlowAfric, we may collect and process the following categories of information.

Personal and Account Information

This may include:

• Full name
• Phone number
• Email address
• Date of birth
• Account information
• Profile information
• Authentication and security information

Financial and Transaction Information

This may include:

• Wallet balances and wallet information
• Deposit and withdrawal information
• Bank account information required for supported transactions
• Transfer records
• Merchant payment records
• Transaction amounts, dates, references, and status
• Fees and payment records
• Subscription information
• Cryptocurrency transaction information where applicable

Identity Verification and Compliance Information

Where required, FlowAfric may process information used for identity verification, fraud prevention, and regulatory compliance.

This may include:

• BVN verification information
• NIN verification information
• Address verification information
• Liveness verification information
• AML screening results
• Sanctions screening results
• Fraud and risk assessment information
• Source-of-funds or other enhanced verification information where required

FlowAfric may use regulated financial partners and specialized verification and compliance providers to perform these checks.

Where liveness verification is required, FlowAfric may use AWS Amazon Rekognition for liveness detection.

Communication Information

For FlowAfric's in-app communication services, we may process information such as:

• Communication metadata
• Call and messaging timestamps
• Participants or account identifiers
• Call duration
• Delivery and service status
• Device and technical information required to provide the service

Where applicable, the content of messages and communications is protected using end-to-end encryption or other security technologies designed to protect user communications.

FlowAfric does not ordinarily access the content of end-to-end encrypted communications except where technically necessary for a particular feature, where permitted by law, or where the communication is not protected by such encryption.

Location Information

Where you grant permission, FlowAfric may collect location information to provide location-based services, including:

• Nearby merchant discovery
• Marketplace functionality
• Service optimization
• Fraud prevention and security purposes where appropriate

You can disable location permissions through your device or browser settings. Certain location-based features may not function correctly if location access is disabled.

Technical and Device Information

We may collect technical information such as:

• IP address
• Browser type
• Operating system
• Device type
• App version
• Device identifiers
• Network information
• Login and session information
• Security and diagnostic information

This information may be used to operate, secure, troubleshoot, and improve FlowAfric.

Cookies and Similar Technologies

FlowAfric may use cookies and similar technologies on its website and web applications for authentication, security, session management, analytics, preferences, and performance. Further information is provided in our Cookie Policy.

2. How We Use Personal Information

FlowAfric may process personal information for purposes including:

• Creating and managing user accounts
• Providing wallet and payment services
• Processing deposits, transfers, and withdrawals
• Processing merchant transactions
• Providing FlowHub services
• Providing communication services
• Providing cryptocurrency services where applicable
• Performing identity verification
• Performing AML and sanctions screening
• Preventing fraud and financial crime
• Protecting accounts and platform security
• Processing subscriptions and service fees
• Providing customer support
• Investigating disputes and transaction issues
• Improving platform functionality and reliability
• Conducting analytics and operational monitoring
• Communicating with users about their accounts and services
• Complying with legal, regulatory, and lawful governmental requirements

3. Identity Verification and Compliance

FlowAfric may be required to verify user identity before providing certain services or allowing certain transaction limits.

Depending on the applicable requirements, verification may involve:

• BVN verification
• NIN verification
• Address verification
• Liveness verification
• AML screening
• Sanctions screening
• Fraud prevention checks
• Additional compliance verification

BVN, NIN, and address verification may be performed through FlowAfric's financial or verification partners, including VFD where applicable.

Where required, liveness verification may be performed using AWS Amazon Rekognition.

FlowAfric may also conduct additional checks where required by applicable law, financial partners, regulatory requirements, or internal security and risk controls.

4. Legal Bases for Processing

Depending on the circumstances and applicable law, FlowAfric may process personal information on one or more lawful bases, including:

• Providing services requested by the user
• Performing contractual obligations
• Complying with legal or regulatory obligations
• Preventing fraud, abuse, and financial crime
• Protecting the security of users and the FlowAfric platform
• Legitimate interests where permitted by applicable law
• User consent where consent is required

Where processing is based on consent, you may withdraw consent where permitted by applicable law. Withdrawal of consent may affect our ability to provide certain services.

5. Sharing and Third-Party Service Providers

FlowAfric may share or disclose personal information with third parties where reasonably necessary to provide services, protect users, operate the platform, or comply with applicable law.

These third parties may include:

• Regulated financial institutions and banking partners
• Payment and financial infrastructure providers
• Identity verification providers
• AML and sanctions screening providers
• Fraud prevention and security providers
• Cloud hosting and infrastructure providers
• Communication and messaging infrastructure providers
• Blockchain and cryptocurrency infrastructure providers
• Analytics and technical service providers
• Customer support providers
• Professional advisers and service providers
• Government authorities, regulators, law enforcement, or other lawful authorities where required or permitted by law

Third-party service providers may process personal information on FlowAfric's behalf and may be subject to contractual, confidentiality, security, and legal obligations.

We do not sell users' personal information for advertising purposes.

6. International Data Processing

Some FlowAfric service providers or infrastructure providers may process or store personal information outside Nigeria.

Where personal information is transferred or processed across borders, FlowAfric will take measures required or permitted by applicable Nigerian data protection laws, which may include appropriate contractual, organizational, technical, or other safeguards.

7. Data Security

FlowAfric uses reasonable technical, administrative, and organizational measures designed to protect personal information against:

• Unauthorized access
• Unauthorized disclosure
• Loss
• Alteration
• Misuse
• Destruction

Security measures may include encryption, access controls, authentication mechanisms, monitoring, logging, security testing, and other appropriate safeguards.

However, no electronic transmission, storage system, or security measure can be guaranteed to be completely secure.

8. Data Retention

FlowAfric retains personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law.

Certain information may need to be retained after an account is closed for purposes including:

• Financial and transaction recordkeeping
• Regulatory compliance
• AML and fraud prevention
• Dispute resolution
• Legal claims
• Security investigations
• Enforcement of agreements
• Other lawful business or regulatory purposes

Retention periods may therefore vary depending on the type of information and the applicable legal or operational requirements.

9. Your Data Protection Rights

Subject to applicable laws and any lawful limitations, you may have rights relating to your personal information, including the right to:

• Request access to personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of eligible personal information
• Object to certain processing activities
• Request restriction of certain processing
• Request data portability where applicable
• Withdraw consent where processing is based on consent
• Exercise other rights available under applicable Nigerian data protection law

Some requests may be limited where FlowAfric is legally required or permitted to retain or process information.

To exercise your rights, contact FlowAfric using the contact details provided below. We may need to verify your identity before processing certain requests.

10. Account Closure and Deletion

You may request closure of your FlowAfric account through the available account or support channels.

Closing an account does not necessarily result in immediate deletion of all personal information.

FlowAfric may retain information where necessary to comply with legal, regulatory, financial, fraud-prevention, security, dispute-resolution, or other lawful requirements.

11. Children's Privacy

FlowAfric services are not intended for individuals who are not legally permitted to use the relevant financial or other services.

Where applicable, FlowAfric may take reasonable steps to prevent accounts from being created or used in violation of applicable age or eligibility requirements.

If we become aware that personal information has been collected from an individual who is not eligible to use a particular service, we may take appropriate steps in accordance with applicable law.

12. Data Security Incidents

If FlowAfric becomes aware of a personal data security incident, we may investigate and take reasonable steps to contain, mitigate, and address the incident.

Where notification is required by applicable law or regulatory requirements, FlowAfric will make the required notifications within the applicable timeframe.

13. Cookies and Similar Technologies

FlowAfric may use cookies and similar technologies for purposes including:

• Authentication
• Security
• Session management
• Preferences
• Analytics
• Performance
• Fraud prevention

Please see our Cookie Policy for further information.

14. Changes to This Privacy Policy

FlowAfric may update this Privacy Policy from time to time to reflect changes to our services, technology, business operations, legal requirements, or regulatory obligations.

Where appropriate, we may notify users of material changes through the platform, email, or other reasonable communication channels.

The updated Privacy Policy will become effective on the date stated in the updated version.

15. Contact Us

If you have questions, concerns, complaints, or requests relating to this Privacy Policy or the processing of your personal information, please contact:

FLOWAFRIC LIMITED

Email: support@flowafric.com

Website: www.flowafric.com

FlowAfric — Connect • Call • Pay