Verxt Privacy Policy

Introduction

This Privacy Notice explains how we collect, use, disclose, and protect the data we collect from our "Users", or "You" (our website visitors, mobile application users, and anyone who uses any of our current and future products and services), whether physically or digitally and whether stored electronically or in hardcopy. We handle your personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation (NDPR), and, where they apply to your data, other data-protection laws such as Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the UK GDPR.

Where you provide data about someone else, you warrant that you have that person's informed consent to provide it to us.

If you have any questions about your personal data, please contact our Data Protection Officer at legal@verxt.com.

Who we are

Verxt ("Verxt", "us", "we" or "our") is operated by Verxt Services. Verxt provides a technology platform that lets freelancers and businesses receive and move funds across borders, with a current focus on corridors into Africa.

Verxt is a technology provider. It does not itself hold money-transmission, payment, banking, or e-money licences in any jurisdiction. The regulated activities involved in delivering the Service, including holding funds, issuing accounts, executing payments and payouts, currency exchange, and identity and anti-money-laundering compliance, are carried out by licensed partner institutions in each corridor. We provide the Service by integrating with these partners, who are authorised to operate in the relevant jurisdictions, including the United Kingdom, Canada, and others.

Fiat balances associated with your account are held in virtual or dedicated accounts issued and maintained by these regulated partner institutions, not by Verxt. Verxt is not a custodian of your funds. Available corridors and account types vary by region, and some corridors support held balances while others are payout-only.

We value your privacy

We treat your personal information as confidential and are committed to protecting it as you use our services and interact with us. This Notice outlines the types of personal information we collect, what we do with it, the basis on which we process it, and the steps we take to safeguard it. We use your information internally to provide and improve our service, communicate with you, and verify your identity with third parties. We do not sell your personal information.

To use the full Service, you need to accept the collection, storage, use, disclosure, and processing of your data in accordance with this Notice. If you do not consent, you may be unable to use some or all of our services. Unless otherwise defined here, terms used in this Notice have the same meaning as in our Terms of Use.

Information we collect and why

The information we collect includes but is not limited to the following.

How we collect your data

We collect public and non-public data:

• Directly from you when you onboard, use the Service, or access our platform.
• Through your communication with us via email, chat, telephone, or other support channels.
• When you read our emails or notices.
• When you participate in surveys, competitions, and promotions.
• When you view the site via your browser's cookies or submit reviews, messages, or comments.
• When you transact and use your account.
• From third parties such as identity-verification services, credit reference agencies, sanctions and screening lists, regulatory and enforcement agencies, and public sources, in furtherance of our compliance obligations.
• Through other means permitted by law.

Lawful basis for processing

In using and processing your personal data, we rely on one or more of the following grounds:

• Legal obligation: in most cases, to comply with an obligation imposed by applicable law, including AML/CFT, sanctions, and tax-reporting requirements.
• Contractual necessity: where it is necessary to provide our products and services, perform a contract to which you are a party, or take steps at your request before entering a contract.
• Legitimate and public interest: where processing is in our legitimate interests, such as security and fraud prevention, and not overridden by your rights.
• Consent: where we process your data only with your express consent.

Location and mobile-device data

Access to your device location is used to help verify your address, expedite your KYC process, and support customer risk assessment and fraud prevention. On mobile, we may collect information such as device name and model, location, language settings, device identifier, network operator, and mobile network information, to identify the device and ensure that unauthorised devices do not act on your behalf.

Card details

When you input card details, we do not directly collect your card information. Our partner institution collects and processes card payments. If you have any issue relating to card payments or their security, you may refer it to us and we will escalate it to our card-payment partner.

Cookies

We use cookies and similar tracking technologies (beacons, tags, and scripts) to operate the Service, remember your preferences, support security and fraud prevention, and analyse traffic. Cookies are small files stored on your device that help us identify you as a user and tailor your experience. Examples include:

• Session cookies, to operate the Service.
• Preference cookies, to remember your settings.
• Security cookies, for security purposes.

You can instruct your browser to accept or refuse cookies through its Help feature. If you do not accept cookies, you may be unable to use some portions of the Service.

Transfer of data

Your consent to this Notice, followed by your submission of information, represents your agreement to the transfer described here. Data we collect may be transferred to and stored at a destination outside Nigeria, including in the corridors we serve. Whenever your information is transferred, we take all reasonable steps to ensure it is treated securely and in accordance with this Notice and applicable law. Your information will not be released, sold, or rented to any entity or individual except in accordance with this Notice and applicable law.

Disclosure of personal data

We may disclose your personal data to:

• Any person who works for or partners with Verxt, and our affiliated businesses.
• Regulated partner institutions that hold fiat balances and execute payouts, and other financial institutions we partner with to provide our services.
• Companies providing third-party services such as technical infrastructure, hosting, marketing and analytics, and web and app development.
• Companies that assist us with identity verification, background screening, and due diligence.
• Our professional advisers, external auditors, and consultants.
• Regulators, law enforcement agencies, and other government agencies.

We otherwise treat your personal data as private and confidential and will not share it except where you have permitted us to, where reasonably necessary to comply with law or protect rights, property, or safety, or where we transfer rights and obligations under our agreement with you.

Service providers

We may employ third-party companies and individuals to facilitate the Service, provide services on our behalf, or help us analyse how the Service is used. These parties access your personal data only to perform tasks on our behalf and are obligated not to disclose or use it for any other purpose. We manage this sharing through confidentiality and data-processing agreements.

Your rights over your data

You have the following rights over the information you submit or that we collect:

• To access and confirm the personal information we hold about you.
• To withdraw consent from or object to the processing of your information, without affecting processing already carried out.
• To rectify or update inaccurate or outdated information.
• To know the purpose for processing your information.
• To restrict processing, though we may continue where there are valid legal or operational reasons.
• To remove yourself from our mailing list, by contacting us or using the unsubscribe link.
• To request the erasure of information we hold, subject to applicable law and our retention obligations.
• To request a copy of your data in a structured, commonly used, machine-readable format, or to have it transmitted to a third party where the processing is based on consent or contract, is carried out by automated means, and is technically feasible (portability).
• To object to your information being used for direct marketing.
• To contest the accuracy of your personal data, in which case we have a specified period to verify it.

To exercise any right, contact us at legal@verxt.com. We aim to respond within one month. We reserve the right to charge a reasonable fee or refuse a request that is repetitive or excessive.

You may decline to provide your personal information when we request it, but certain services or all of the Service may then be unavailable to you.

If you believe your privacy rights have been violated, you may lodge a complaint with the relevant authority: in Nigeria, the Nigeria Data Protection Commission (NDPC); in Canada, the Office of the Privacy Commissioner of Canada; in the UK, the Information Commissioner's Office (ico.org.uk).

Storage of personal data

All personal information you provide is stored on our secure servers and cloud infrastructure. We have set up reasonable and appropriate technical and organisational measures to prevent accidental destruction, loss, misuse, or unauthorised access, modification, or disclosure. These include:

• Frequent updates of our security controls and processes to meet industry standards.
• Continuous training of employees on confidentiality.
• Role-based access control (RBAC) governing access to customer data.
• Encryption and firewall technologies in line with international standards.

No system involving the transmission of information over the Internet is entirely secure, so we ask you to take reasonable care: keep any password or security PIN confidential, do not share your authentication details, and sign off when using a shared device. We provide Two-Factor Authentication (a one-time password) as an added layer of security. You may disable it, but if you do so, despite our recommendation, Verxt shall not be liable for any resulting loss.

Record retention

In line with regulatory obligations, we may retain your data for five years or longer where necessary for the purposes for which it was collected. Retention is also determined by legal, regulatory, administrative, or operational requirements.

Account deletion

You may request deletion of your account via the Verxt platform or by contacting us at legal@verxt.com. Your request will be reviewed within 72 hours, after which you will receive a notification of the outcome. This timeline may be exceeded in extenuating circumstances.

Where your request is granted, your account will be deleted within seven days. Where it is denied, we will provide a reason so you can address it and reapply. We may continue to retain your personal data where there are valid legal, regulatory, or operational reasons.

External sites

Our Service may contain links to sites not operated by us. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party site or service. We advise you to review the privacy notice of every site you visit.

Children's privacy

Our products and services are not intended for anyone under 18, and we do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has provided us with personal data, contact us at legal@verxt.com for removal. If we become aware that we have collected personal data from a child without required consent, we will remove it from our servers.

Changes to this Privacy Notice

We will update this Notice from time to time to meet legal and regulatory requirements and as our technology evolves. We will notify you by posting the updated version on this page and, where required, by email or in-app notice before the change takes effect, and we will update the "Last updated" date. You are advised to review this Notice periodically.

Data protection review mechanism

Our compliance with applicable data-protection law is subject to periodic internal review, where potential gaps and weaknesses in our processes are identified and remedial actions are provided.

How to contact us

Data Protection Officer / Privacy team: legal@verxt.com
General inquiries and support: Contact Us
Verxt Services