1. Data Controller Information

eTranzact International Plc is the data controller responsible for the collection, use, storage, transfer, and processing of personal data obtained through PocketMoni ("Application").

Our registered office and principal place of business is situated at:

4th & 5th Floor, Fortune Towers
27/29 Adeyemo Alakija Street, Victoria Island, Lagos State, Nigeria.

For all data protection-related enquiries, requests, or complaints, users may contact us through:

• Email: dpo@etranzact.com
• Telephone: 01-7101060
• Website: www.etranzact.com
• Data Protection Officer/Privacy Contact: dpo@etranzact.com

eTranzact processes personal data in compliance with the Nigeria Data Protection Act 2023 and other applicable laws and regulations.

2. Lawful Basis for Processing Personal Data

eTranzact shall process personal data only where a lawful basis exists under the Nigeria Data Protection Act 2023. Depending on the nature of the processing activity, personal data may be processed on one or more of the following lawful bases:

2.1 Performance of Contract

Processing is necessary for the performance of a contract with the user or to take steps at the request of the user prior to entering into a contract, including:

• account registration and onboarding;
• processing mobile money transactions;
• customer support services;
• wallet funding, withdrawals, and transfers.

2.2 Compliance with Legal Obligations

Processing is necessary to comply with applicable legal and regulatory obligations, including obligations relating to:

• anti-money laundering and counter-terrorism financing requirements;
• know-your-customer (KYC) obligations;
• fraud monitoring and prevention;
• tax, audit, and financial reporting requirements;
• lawful requests from regulatory authorities, courts, or law enforcement agencies.

2.3 Consent

Where required by law, eTranzact shall obtain the user's consent before processing personal data for specific purposes, including:

• marketing communications;
• optional biometric verification features;
• location-based services;
• promotional campaigns.

Users may withdraw consent at any time, provided that such withdrawal shall not affect the lawfulness of processing carried out prior to withdrawal.

2.4 Legitimate Interests

eTranzact may process personal data where necessary for its legitimate business interests, provided such interests do not override the rights and freedoms of the data subject. Such legitimate interests may include:

• fraud detection and prevention;
• network and information security;
• service improvement and analytics;
• dispute resolution;
• business continuity and risk management.

2.5 Vital Interests and Public Interest

Where applicable, personal data may also be processed to protect the vital interests of a user or another person, or where processing is necessary in the public interest or pursuant to lawful governmental authority.

3. Categories of Personal Data Collected

eTranzact may collect and process the following categories of personal data:

• identification information;
• contact information;
• financial and transaction data;
• device and log information;
• biometric data where applicable;
• geolocation data where enabled;
• customer support records;
• KYC and verification documentation.

eTranzact shall ensure that personal data collected is adequate, relevant, and limited to what is necessary for the specified purpose of processing.

4. Recipients of Personal Data

eTranzact may disclose personal data to the following recipients or categories of recipients where necessary and lawful:

• payment processors and settlement partners;
• banks and financial institutions;
• identity verification and KYC service providers;
• cloud hosting and IT infrastructure providers;
• fraud prevention and cybersecurity vendors;
• telecommunications operators;
• regulatory authorities and government agencies;
• auditors, legal advisers, and professional consultants;
• law enforcement agencies pursuant to lawful requests;
• third-party service providers engaged by the Company for operational support.

All third-party processors engaged by eTranzact shall be subject to contractual confidentiality and data protection obligations consistent with the Nigeria Data Protection Act 2023.

5. Data Retention Period

eTranzact shall retain personal data only for as long as necessary to fulfil the purposes for which such data was collected, including compliance with legal, regulatory, contractual, operational, and audit requirements.

Unless a longer retention period is required or permitted by law:

• customer identification and KYC records may be retained for a minimum period required under applicable financial regulations;
• transaction records may be retained for regulatory, audit, fraud prevention, and dispute resolution purposes;
• customer support records may be retained for service quality and legal defence purposes;
• marketing data shall be retained until consent is withdrawn or the data is no longer required.

Upon expiration of the applicable retention period, personal data shall be securely deleted, anonymised, or archived in accordance with the Company's retention and disposal procedures and applicable law.

6. Rights of Data Subjects

Users have the right, subject to applicable law, to:

• request access to their personal data;
• request correction of inaccurate or incomplete data;
• request deletion of personal data in certain circumstances;
• object to or restrict processing;
• withdraw consent where processing is based on consent;
• request portability of their personal data;
• lodge a complaint with the Nigeria Data Protection Commission.