Privacy Policy

ZevPay Checkout ("we", "us") operates the payment gateway at zevpaycheckout.com, the merchant dashboard at dashboard.zevpaycheckout.com, and the checkout experiences our merchants embed on their own sites. We operate from Lagos, Nigeria, under partnership with 9PSB and VFD Microfinance Bank, licensed Nigerian institutions regulated by the Central Bank of Nigeria.

We are a registered data controller with the Nigerian Data Protection Commission, registration NDPC/DCP/12372. This policy is written to comply with the Nigeria Data Protection Act 2023 (NDPA).

From merchants (the businesses that use us):

• Account data: name, email address, phone number, and the business details you provide during onboarding (business name, registration number, address).
• Verification data: identity information required by Nigerian know-your-business rules, including BVN or NIN for business owners and directors, and corporate documents such as your CAC certificate. Identity numbers are used for verification against official registries and stored encrypted.
• Settlement data: the bank account details you register for payouts, stored encrypted.
• Usage data: API keys you create, webhook endpoints, dashboard activity, and support conversations.

From customers (people who pay a merchant):

• Payment data: the email address and name entered at checkout, the amount, the payment method used, and for bank transfers the sender name and account details our banking partners report with the transfer.
• Technical data: device type, IP address, and the interaction events needed to run and secure the checkout session.

We do not store full card numbers. Card payments are processed by our licensed card processing partners.

• To run the service: process payments, settle merchants, deliver webhooks, send receipts.
• To verify merchants as Nigerian law requires, and to prevent fraud, money laundering, and abuse.
• To support you: answer questions, investigate disputed or flagged transactions.
• To improve the product: aggregate, de-identified analytics about how the checkout performs.
• To meet legal obligations to our regulators and banking partners.

We do not sell personal data. We do not use customer payment data for advertising.

Under the NDPA we process personal data on these bases:

• Contract: processing a payment you initiated, settling a merchant, running your account.
• Legal obligation: identity verification, transaction records, reporting duties to regulators.
• Legitimate interest: fraud prevention, service security, product analytics that do not identify you.
• Consent: optional communications such as product updates. You can withdraw consent at any time.

• Banking partners: 9PSB and VFD Microfinance Bank, who provide the virtual accounts and move the money. They receive the data needed to process each transaction.
• Payment infrastructure: card processors and the Nigerian interbank network (NIBSS) as required to route payments.
• Service providers: cloud hosting and email delivery providers acting on our instructions under contract.
• Regulators and law enforcement: where a law, regulation, or valid legal process requires it.

Where a provider processes data outside Nigeria, we transfer it under conditions the NDPA permits, including contractual safeguards.

When you pay through our checkout, the merchant you paid also receives your payment details (name, email, amount, reference) as the record of their sale. The merchant is an independent controller of that copy. Direct requests about a purchase to the merchant first; direct requests about our copy of the data to us.

Transaction and identity-verification records are kept for as long as Nigerian financial regulations require, which is typically at least five years after the transaction or the end of the business relationship. Account data is kept while your account is active. Technical logs are kept for shorter, operational periods. When data is no longer required we delete it or irreversibly anonymise it.

• Encryption in transit (TLS) and encryption at rest for sensitive fields such as identity numbers and bank account details.
• Webhooks signed with HMAC-SHA256 so merchants can verify every event came from us.
• Role-based access inside our team, with sensitive admin actions gated by multi-factor authentication and audit-logged.
• Sandbox keys that cannot move real money.

No system is perfectly secure. If we learn of a breach that affects you, we will notify the NDPC and affected people as the NDPA requires.

Under the NDPA you can ask us to:

• confirm whether we hold your personal data, and give you a copy;
• correct inaccurate data;
• delete data we no longer have a legal duty to keep;
• restrict or object to certain processing;
• receive data you gave us in a portable format;
• withdraw consent where consent is the basis.

Write to support@zevpaycheckout.com. We respond within the timelines the NDPA sets. If you are not satisfied, you can complain to the Nigerian Data Protection Commission.

The dashboard uses cookies and similar storage strictly to keep you signed in and secure. The marketing site does not run third-party advertising trackers.

Our services are for businesses and adults. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

When we change this policy we will update the effective date at the top of this page, and for material changes we will notify merchants by email or dashboard notice before the change takes effect.

Privacy questions and rights requests: support@zevpaycheckout.com. Security reports: security@zevpaycheckout.com. ZevPay Checkout, Lagos, Nigeria.