Privacy Policy

This Privacy Policy explains how personal information is handled when you use Opreet: the Opreet website (opreet.com) and the Opreet web app (app.opreetpay.com).

It applies to customers and to visitors to our website. It is written to reflect the Nigeria Data Protection Act, 2023 (the NDPA) and the regulations and guidance issued under it. Please read it together with our Terms & Conditions and Cookie Policy.

Opreet is the brand under which [Opreet legal entity name: to be confirmed] provides the Opreet services. That entity is the controller of the personal information described in this policy.

We collect only what the service needs. Specifically:

Account information

• Your full name, email address and Nigerian mobile phone number, which you give us when you create an account or update your profile.
• Your password. It is handled by our authentication provider and is never visible to us in readable form.
• An Opreet account number and balance, which we assign to your account, and your notification preferences.

Transaction PIN

You set a 4-digit transaction PIN to approve payments and transfers. We store only a one-way hash of it (an irreversible scrambled form), never the PIN itself, together with counters that let us limit repeated incorrect attempts and support PIN recovery.

Transaction and payment information

• The type and category of each transaction (airtime, data, electricity, TV, sending money, receiving money), the amount, any fee, currency, status and reference number.
• Details of who or what you are paying, such as a phone number, meter number, smartcard number, or a recipient's bank account details.
• The service provider that handled the transaction, the provider's reference, any failure reason, and timestamps.
• The name or address a provider returns when you verify a recipient, meter or smartcard, so that you can confirm it before paying.

Notifications and communications

• In-app notifications about your transactions and account security.
• Emails we send you, such as receipts, security alerts and PIN reset codes.
• Messages you send us when you contact support or make a complaint, and any information you include in them.

Technical information

Our website and web app keep you signed in using cookies and similar browser storage, described in our Cookie Policy. Our hosting and infrastructure providers may also automatically record technical information such as IP address, browser type and request times in server logs, which we use to keep the service secure and working. We do not currently use advertising or product-analytics tools.

Identity verification information

At the date of this policy, Opreet does not ask you for identity documents or government identification numbers in the web app. If identity verification is introduced, or is required by law or by a regulated partner, we will tell you what is needed and why, and update this policy and our KYC Policy.

The Opreet website itself has no accounts or forms. If you email us, we receive the information you choose to send.

• Directly from you, when you sign up, update your profile, set your PIN, make a payment or contact us.
• Automatically, as you use the service: transaction records, notifications and technical logs.
• From service providers, for example when a provider confirms a recipient, meter or smartcard, or reports the outcome of a transaction.

We use personal information only for the purposes below, and rely on one of these legal bases under the NDPA for each.

We use only the cookies and browser storage needed to keep you signed in and to remember your display preferences. Details, including exactly what is stored, are in our Cookie Policy.

We do not sell your personal information. We share it only as needed to run Opreet, and only with:

• Infrastructure providers. We use Supabase for authentication and our database, and Resend to send transactional emails. Our website and web app are also served by hosting providers.
• Payment and bill-payment providers and, for transfers, the receiving bank, so that your transactions can be carried out. Providers used in production: [payment and bill-payment service providers: to be confirmed].
• Regulated partners through whom regulated activities are performed: [licensed partner and Opreet's role: to be confirmed].
• Professional advisers, auditors and insurers, under confidentiality duties.
• A successor, if Opreet's business is reorganised or transferred, with the protections of this policy continuing to apply.

We require providers that handle personal information for us to protect it and to use it only for our purposes. Where the law allows, we do not share more than is needed.

We may disclose information to courts, regulators, law-enforcement and other public authorities where we are legally required to, or where it is necessary to prevent or investigate crime. We will limit disclosures to what the request or law requires.

We use technical and organisational measures to protect personal information, including encrypted connections, access controls so that each customer can reach only their own records, and hashing of your PIN. No system is completely secure. See our Security page for how to help keep your account safe and how to report a concern.

We keep personal information only for as long as we need it for the purposes above, including to meet legal, regulatory, accounting and anti-fraud requirements and to resolve disputes. Some transaction records may need to be kept after you close your account.

Some of our providers may process information outside Nigeria. Where they do, we take steps to ensure the transfer is permitted by the NDPA and that the information stays protected. Where your data is stored and processed: [where customer data is stored and processed: to be confirmed].

Under the NDPA you have the right, in the circumstances the law sets out, to:

• be informed about how your information is used, and ask for a copy of it;
• have inaccurate information corrected;
• ask us to delete your information, or restrict how we use it;
• object to certain uses, including direct marketing;
• receive your information in a portable format;
• withdraw consent where we rely on it, without affecting earlier use.

To exercise a right, contact [privacy / data protection email address: to be confirmed]. We may need to confirm your identity first, and some rights are limited where we must keep information by law. If you are unhappy with how we handle your information, you may complain to us, and you also have the right to complain to the Nigeria Data Protection Commission.

You can ask us to close your account and delete the personal information we are not required to keep. Closing an account is different from signing out or closing a browser tab. See Delete your account for how it works and what we may need to retain.

Opreet is not intended for anyone under the age of [minimum age: to be confirmed]. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will take appropriate steps.

We may update this policy as the service or the law changes. We will publish the new version here with a new version number and date, and tell you about material changes in the web app or by email before they take effect.