xetral.com

PRIVACY POLICY

Effective Date: 27 July 2026
Last Updated: 27 July 2026

1. INTRODUCTION

This Privacy Policy explains how Xetral Ltd (“Xetral“, “we“, “us“, or “our), a company registered in Nigeria, collects, uses, stores, discloses, protects, and otherwise processes personal data when you use our services.

Our services may include our websites, web applications, WhatsApp-based financial services, WhatsApp Business Platform integrations, WhatsApp Flows, payment and wallet services, account services, financial technology products, customer support channels, and other services operated or provided by Xetral (collectively, the “Services“).

This Privacy Policy applies to customers, users, visitors, business representatives, recipients of transactions, persons who communicate with us, and other individuals whose personal data we process in connection with the Services.

We are committed to processing personal data fairly, lawfully, transparently, securely, and only for legitimate and specified purposes.

This Privacy Policy is intended to operate in accordance with applicable Nigerian data-protection and privacy laws, including the Nigeria Data Protection Act, 2023 (the “NDPA”), applicable regulations, guidelines, and other applicable legal and regulatory requirements.

2. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?

Unless otherwise stated in a specific notice, Xetral Ltd is the data controller responsible for the personal data we collect and process in connection with our Services.

Depending on the specific service and arrangement involved, Xetral may also process personal data on behalf of a business, financial institution, payment provider, or other organisation as a data processor or service provider.

Where another organisation independently determines the purposes and means of processing your personal data, that organisation may also be a separate data controller and its own privacy policy may apply.

3. INFORMATION WE COLLECT

The information we collect depends on how you use our Services.

3.1 Account and identity information

We may collect:

  • Full name;
  • First name and last name;
  • Business name;
  • Email address;
  • Telephone number;
  • WhatsApp telephone number;
  • WhatsApp profile name and related account information;
  • Account credentials and authentication information;
  • Account status and account identifiers;
  • Referral codes and related account information.

3.2 Verification and financial information

Where required for account creation, identity verification, fraud prevention, payment processing, regulatory compliance, or provision of financial services, we may collect or process:

  • Bank Verification Number (BVN);
  • Bank account number;
  • Bank name and bank code;
  • Bank-account ownership and account-name verification information;
  • Virtual-account information;
  • Payment account information;
  • Transaction information;
  • Wallet information;
  • Payment status and settlement information;
  • Transaction references;
  • Transaction descriptions and amounts;
  • Information relating to recipients and beneficiaries.

We do not intend to store sensitive authentication credentials such as your transaction PIN in readable form. Where such information is used, it is processed using security measures designed to protect it.

3.3 WhatsApp and communications information

When you use our WhatsApp services, we may process:

  • Your WhatsApp telephone number;
  • WhatsApp account and profile information made available to us;
  • Your name or profile name;
  • Messages sent to or received from our WhatsApp service;
  • Interactive responses submitted through WhatsApp;
  • Information submitted through WhatsApp Flows;
  • Transaction and service requests made through WhatsApp;
  • Conversation and interaction metadata;
  • Delivery, status, and service-related information.

We process this information to provide the WhatsApp-based Services, authenticate users, respond to requests, complete transactions, provide customer support, maintain security, and comply with applicable legal obligations.

3.4 Information submitted through WhatsApp Flows

Our Services may use WhatsApp Flows and similar interactive interfaces to collect information required for specific services.

For example, a Flow may collect information required to:

  • Verify an email address;
  • Confirm an OTP or verification code;
  • Collect information required for identity verification;
  • Collect bank and account details;
  • Initiate or confirm a transaction;
  • Complete a payment or wallet-related action;
  • Display transaction results or account information.

The information submitted through a Flow is processed for the specific purpose for which the Flow is presented and for related purposes described in this Privacy Policy.

3.5 Transaction and wallet information

When you use our financial or payment-related Services, we may process:

  • Amounts sent, received, deposited, withdrawn, or paid;
  • Sender and recipient information;
  • Bank and account information;
  • Wallet balances and wallet activity;
  • Transaction status;
  • Payment-provider references;
  • Bills and service-payment information;
  • Airtime and data purchase information;
  • Withdrawal and payout information;
  • Receipts and transaction records;
  • Fraud, risk, dispute, and investigation information.

3.6 Website and application information

When you use our website or web application, we may collect:

  • IP address;
  • Browser type;
  • Device type;
  • Operating system;
  • Login and session information;
  • Authentication events;
  • Security logs;
  • Approximate technical location information derived from network or device information where necessary;
  • Information about how you interact with our Services;
  • Cookies and similar technologies where applicable.

3.7 Information from third parties

We may receive information from third parties, including:

  • Payment service providers;
  • Banks and financial institutions;
  • Account-verification providers;
  • Identity-verification providers;
  • Fraud-prevention providers;
  • WhatsApp and Meta service infrastructure;
  • SMS and email providers;
  • Technology and cloud-service providers;
  • Business customers using Xetral services;
  • Persons initiating or receiving transactions;
  • Publicly available sources where legally permitted.

4. HOW WE USE YOUR PERSONAL DATA

We may use personal data to:

4.1 Provide and operate the Services

This includes:

  • Creating and managing accounts;
  • Authenticating users;
  • Verifying email addresses and telephone numbers;
  • Providing WhatsApp-based services;
  • Providing wallet and payment services;
  • Processing transactions;
  • Processing withdrawals and payouts;
  • Processing bill, airtime, and data payments;
  • Providing virtual-account-related services;
  • Providing customer support;
  • Issuing receipts and transaction confirmations.

4.2 Verify identity and prevent fraud

We may process personal data to:

  • Verify identity and account ownership;
  • Verify bank-account ownership;
  • Conduct BVN or other required verification;
  • Detect suspicious activity;
  • Prevent fraud, abuse, money laundering, terrorist financing, and other unlawful activity;
  • Protect customers, financial partners, our Services, and the public.

4.3 Meet legal and regulatory obligations

We may process personal data to comply with applicable:

  • Nigerian data-protection laws;
  • Anti-money-laundering and counter-terrorist-financing requirements;
  • Financial-sector requirements;
  • Tax and accounting requirements;
  • Court orders;
  • Law-enforcement requests;
  • Regulatory requirements;
  • Recordkeeping obligations.

4.4 Secure and improve our Services

We may use information to:

  • Monitor security;
  • Detect and prevent unauthorised access;
  • Investigate incidents;
  • Maintain audit trails;
  • Troubleshoot technical problems;
  • Test and improve our systems;
  • Analyse service performance;
  • Improve user experience;
  • Maintain service reliability.

4.5 Provide automated and AI-assisted interactions

Some of our Services may use automated systems or artificial-intelligence technologies to help:

  • Understand user requests;
  • Provide conversational assistance;
  • Route users to relevant services;
  • Generate responses;
  • Provide support;
  • Improve service interactions.

Automated systems are not intended to replace legally required verification, security controls, transaction controls, or applicable regulatory processes.

Where applicable law gives you rights concerning solely automated decision-making or profiling, you may exercise those rights as described in this Privacy Policy.

4.6 Send service communications

We may send:

  • OTPs and verification messages;
  • Transaction notifications;
  • Security alerts;
  • Account notifications;
  • Service updates;
  • Receipts;
  • Customer-support messages;
  • Important legal or operational communications.

These communications may be sent through WhatsApp, SMS, email, or other communication channels.

4.7 Marketing and promotional communications

Where legally permitted and where required, we may send promotional or marketing communications about Xetral or relevant services.

You may opt out of marketing communications by following the unsubscribe or opt-out instructions provided in the communication or by contacting us.

Opting out of marketing communications does not prevent us from sending essential service, security, transaction, legal, or account-related messages.

5. OUR LAWFUL BASES FOR PROCESSING

Depending on the circumstances, we may process personal data on one or more of the following lawful bases:

5.1 Performance of a contract

We process information where necessary to provide Services you request or to take steps at your request before providing those Services.

5.2 Legal obligation

We process information where necessary to comply with applicable law, regulatory requirements, court orders, lawful requests, financial crime obligations, accounting obligations, recordkeeping requirements, or other legal obligations.

5.3 Consent

Where consent is required, we will request it.

You may withdraw consent where the processing is based on consent. Withdrawal of consent does not affect processing that occurred before withdrawal and does not affect processing that we are legally required or otherwise lawfully permitted to continue.

5.4 Legitimate interests

We may process personal data where necessary for legitimate interests, including:

  • Securing our Services;
  • Preventing fraud;
  • Protecting users;
  • Improving our Services;
  • Maintaining technical systems;
  • Operating our business;
  • Managing customer relationships;
  • Enforcing our legal rights.

We will consider your rights and interests when relying on legitimate interests.

5.5 Vital interests and public interest

Where permitted by applicable law, we may process information where necessary to protect vital interests or perform a task carried out in the public interest.

6. HOW WE SHARE PERSONAL DATA

We do not sell personal data as a business practice.

We may disclose personal data where necessary and lawful to:

6.1 Payment providers, banks, and financial partners

We may share information with payment providers, banks, financial institutions, account-verification providers, and other financial partners where necessary to:

  • Process payments;
  • Create or manage accounts;
  • Verify account ownership;
  • Process transfers;
  • Process withdrawals;
  • Complete settlements;
  • Conduct required compliance checks;
  • Prevent fraud.

6.2 Meta and WhatsApp service infrastructure

Our WhatsApp Services may use the Meta WhatsApp Business Platform and WhatsApp Flows.

Information sent through or processed in connection with WhatsApp may be processed by Meta and relevant service infrastructure in accordance with the applicable terms and privacy practices of those services.

Xetral uses WhatsApp and Meta technologies to provide communications and interactive service functionality. We do not represent that Meta is under Xetral’s control.

6.3 Technology and service providers

We may use service providers for:

  • Cloud hosting;
  • Data storage;
  • Database infrastructure;
  • Email delivery;
  • SMS delivery;
  • Payment processing;
  • Identity and account verification;
  • Security;
  • Fraud detection;
  • Analytics;
  • Customer support;
  • AI and technology services.

Service providers may process personal data only as permitted by applicable law and the relevant contractual arrangements.

6.4 Legal and regulatory authorities

We may disclose information where required or permitted by law, including to:

  • Regulators;
  • Law-enforcement authorities;
  • Courts;
  • Government agencies;
  • Tax authorities;
  • Financial-crime authorities;
  • Other competent public authorities.

6.5 Business transactions

If Xetral is involved in a merger, acquisition, restructuring, financing, sale of assets, or similar transaction, personal data may be transferred as part of that transaction, subject to applicable legal requirements.

7. INTERNATIONAL DATA TRANSFERS

Some of our service providers or technology infrastructure may be located outside Nigeria.

Where personal data is transferred outside Nigeria, we will take steps required by applicable Nigerian data-protection law, including appropriate safeguards where required.

Depending on the service used, international transfers may involve technology providers, cloud providers, communication providers, payment providers, or other service providers.

You may contact us for information about the categories of recipients and applicable safeguards relating to a specific processing activity, subject to lawful limitations.

8. DATA RETENTION

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

Retention periods may depend on:

  • The nature of the information;
  • The purpose for which it was collected;
  • Whether you maintain an active account;
  • Legal and regulatory requirements;
  • Financial and transaction-record obligations;
  • Fraud-prevention requirements;
  • Dispute-resolution requirements;
  • Security and audit requirements.

When information is no longer required, we may securely delete it, anonymise it, or otherwise remove identifying information.

Financial and transaction records

Deleting an account does not necessarily mean that every transaction or financial record can immediately be destroyed.

Certain financial, transaction, audit, fraud-prevention, accounting, or regulatory records may need to be retained for a period required by applicable law or regulatory obligations.

Where legally permissible, we may anonymise or de-identify retained records so that they are no longer reasonably linked to an identifiable individual.

9. ACCOUNT DELETION AND DATA DELETION

You may request deletion of your Xetral account and personal data by using the data-deletion process provided by Xetral or by contacting us at:

[email protected]

For security purposes, we may require verification that you are the account owner before completing a deletion request.

Where a verified deletion request is completed, we may delete or anonymise personal information associated with the account, subject to information that we are legally required or permitted to retain.

Deletion may include, where applicable:

  • Account identifiers;
  • Contact information;
  • Profile information;
  • Stored personal information;
  • Conversation history;
  • Saved recipients;
  • Saved actions;
  • Verification-session information;
  • Certain encrypted account information;
  • Other personal data that is not required to be retained.

We may retain or anonymise certain transaction, financial, audit, security, fraud-prevention, and legal records where required by law or necessary for legitimate legal purposes.

10. YOUR DATA-PROTECTION RIGHTS

Subject to applicable law and lawful limitations, you may have the right to:

  • Be informed about the processing of your personal data;
  • Request access to personal data we hold about you;
  • Request correction of inaccurate or incomplete personal data;
  • Request deletion or erasure of personal data;
  • Request restriction of processing;
  • Object to certain processing;
  • Withdraw consent where processing is based on consent;
  • Request data portability where applicable;
  • Object to certain direct marketing;
  • Request information about automated decision-making where applicable;
  • Request human intervention where applicable under applicable law;
  • Lodge a complaint with the relevant data-protection authority.

We may need to verify your identity before responding to certain requests.

Some rights are not absolute and may be limited where, for example, continued processing is required by law, necessary to establish or defend legal claims, or necessary for financial crime prevention or other lawful purposes.

11. DATA SECURITY

We use reasonable technical and organisational security measures designed to protect personal data against:

  • Unauthorised access;
  • Unauthorised disclosure;
  • Accidental loss;
  • Destruction;
  • Alteration;
  • Unlawful processing;
  • Other security threats.

Security measures may include access controls, authentication controls, encryption or encrypted storage where appropriate, monitoring, rate limiting, audit logging, security testing, and other safeguards appropriate to the nature of the information and the risks involved.

However, no internet transmission, electronic storage system, or technology platform can be guaranteed to be completely secure.

You are responsible for protecting your account credentials, verification codes, PINs, devices, and other authentication information.

Xetral will not ask you to disclose a transaction PIN or one-time verification code through an unsolicited request.

12. WHATSAPP, META, AND INTERACTIVE FLOWS

Our Services may be accessed through WhatsApp.

When you communicate with Xetral through WhatsApp:

  • Your telephone number is used to identify and communicate with your WhatsApp account;
  • Your messages and service requests may be processed to provide the requested service;
  • Information submitted through WhatsApp Flows may be used for the specific service requested;
  • Transaction and account information may be processed to complete or support a requested transaction;
  • WhatsApp and Meta may process information in accordance with their own applicable terms and privacy practices.

You should review the privacy information provided by the relevant third-party platform for information about how that platform independently processes personal data.

Xetral is responsible for the processing activities it controls. Meta and other third parties may be independently responsible for processing activities they control.

13. COOKIES AND SIMILAR TECHNOLOGIES

Our websites and web applications may use cookies, session technologies, local storage, and similar technologies to:

  • Keep users signed in;
  • Maintain secure sessions;
  • Remember preferences;
  • Protect against fraud;
  • Improve performance;
  • Understand service usage;
  • Maintain security.

Where applicable, you may manage cookies through your browser or available cookie controls.

Disabling certain technologies may affect the availability or functionality of some Services.

14. CHILDREN

Our Services are not intended for children who are not legally permitted to use the relevant financial or payment services.

We do not knowingly collect personal data from children in circumstances where such collection is prohibited by applicable law.

If you believe that a child has provided personal data to us improperly, contact us at [email protected].

15. PERSONAL DATA BREACHES

We maintain procedures designed to detect, assess, respond to, and manage personal-data security incidents.

Where applicable law requires notification of a personal-data breach to a regulator or affected individuals, we will take the required steps within the applicable timeframe.

16. ACCURACY OF YOUR INFORMATION

You are responsible for providing accurate, complete, and up-to-date information where required to use our Services.

You should notify us if your information changes or if you discover that information associated with your account is inaccurate.

We may take reasonable steps to verify or update information where required for security, compliance, or service purposes.

17. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time.

When we make material changes, we may provide notice through our website, application, WhatsApp, email, or other appropriate channels.

The updated version will indicate its effective or last-updated date.

Your continued use of the Services after an updated Privacy Policy becomes effective means that the updated policy applies to your use of the Services, subject to applicable law.

18. CONTACT US

For privacy and data-protection matters, including:

  • Privacy questions;
  • Requests to access personal data;
  • Requests to correct personal data;
  • Data-deletion requests;
  • Requests to exercise data-protection rights;
  • Privacy complaints;
  • Questions about this Privacy Policy;

contact:

Xetral Ltd
Email: [email protected]
Country of registration: Nigeria

Please include sufficient information for us to understand and respond to your request. We may request additional information to verify your identity before providing access to personal data or completing certain requests.

19. COMPLAINTS TO THE DATA-PROTECTION AUTHORITY

If you believe that your personal data has been processed in a manner that violates applicable data-protection law, you may first contact Xetral so that we can investigate and attempt to resolve the matter.

You may also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or another competent data-protection authority where applicable.

This Privacy Policy does not limit any rights you may have under applicable Nigerian law.

End of Privacy Policy