1. WHO WE ARE

FrameLaPay is a technology-enabled financial platform providing, depending on jurisdiction and eligibility, services that may include:

• international money transfers;
• payment services;
• multi-currency wallets;
• foreign-exchange services;
• digital-asset and cryptocurrency services;
• lending and credit-related services;
• account-management services;
• financial technology infrastructure; and
• related technology services.

Certain services may be provided through licensed financial institutions, payment processors, banks, digital-asset service providers, lenders, identity-verification providers and other third-party partners.

The legal entity responsible for processing your information will depend on the service you use and your jurisdiction.

2. OUR COMMITMENT TO PRIVACY

We process personal information responsibly and in accordance with applicable data protection laws.

For users in Nigeria, this includes the Nigeria Data Protection Act 2023 (NDPA) and applicable regulations, guidance and requirements issued by the Nigeria Data Protection Commission ("NDPC").

Depending on where you are located, additional privacy laws may apply.

Our privacy principles include:

• transparency;
• lawful and fair processing;
• purpose limitation;
• data minimisation;
• accuracy;
• security;
• confidentiality;
• accountability; and
• respect for individual privacy rights.

3. INFORMATION WE COLLECT

We may collect different categories of information depending on how you use FrameLaPay.

3.1 Identity Information

This may include:

• full name;
• date of birth;
• nationality;
• gender where legally required;
• photograph;
• government-issued identification;
• passport;
• national identity information;
• driver's licence;
• identification numbers;
• signature;
• residential address;
• proof of address;
• tax identification information; and
• other information necessary to verify your identity.

4. CONTACT INFORMATION

We may collect:

• email address;
• telephone number;
• postal address;
• emergency or authorised-contact information where appropriate;
• business contact information; and
• communication preferences.

5. FINANCIAL INFORMATION

When you use financial services, we may collect:

• bank-account details;
• account numbers;
• payment-card information;
• transaction information;
• wallet addresses;
• cryptocurrency transaction information;
• currency balances;
• transaction history;
• payment information;
• source-of-funds information;
• income information;
• employment information;
• financial records; and
• information relating to loans or credit applications.

Where possible, sensitive payment information may be processed directly by our regulated payment or banking partners rather than stored by FrameLaPay.

6. TRANSACTION INFORMATION

We may collect information concerning:

• amount;
• currency;
• sender;
• recipient;
• transaction date and time;
• transaction reference;
• payment method;
• destination;
• exchange rate;
• fees;
• wallet addresses;
• blockchain transaction IDs;
• transaction status; and
• related communications.

We use this information to process transactions, maintain records, detect fraud and satisfy legal obligations.

7. DEVICE AND TECHNICAL INFORMATION

When you access FrameLaPay, we may automatically collect information such as:

• IP address;
• device type;
• operating system;
• browser type;
• device identifier;
• application version;
• language;
• time zone;
• network information;
• approximate location;
• login information;
• authentication events;
• crash reports;
• performance information; and
• security-related information.

8. LOCATION INFORMATION

Where legally permitted and where necessary for a particular service, we may collect approximate or precise location information.

Location information may be used for:

• fraud detection;
• security;
• regulatory compliance;
• transaction verification;
• service availability;
• account protection; and
• providing location-dependent services.

You may be able to control location permissions through your device settings.

9. BIOMETRIC INFORMATION

For certain services, we may use biometric or biometric-derived information to verify identity.

This may include:

• facial images;
• facial-recognition information;
• liveness detection;
• biometric identifiers; and
• other identity-verification information.

Biometric information will only be processed where permitted by applicable law and where appropriate safeguards are in place.

Where a third-party identity-verification provider performs the verification, that provider may process biometric information on our behalf or independently, depending on the applicable arrangement.

10. INFORMATION FROM THIRD PARTIES

We may receive information from:

• banks;
• payment processors;
• financial institutions;
• credit-reference providers;
• identity-verification providers;
• fraud-prevention providers;
• blockchain analytics providers;
• sanctions-screening providers;
• government authorities;
• regulatory authorities;
• business partners;
• service providers; and
• publicly available sources.

11. INFORMATION FROM FINANCIAL INSTITUTIONS

Where you authorise a connection between FrameLaPay and another financial institution, we may receive information from that institution.

This may include:

• account details;
• transaction history;
• balances;
• account-holder information; and
• other information necessary to provide the requested service.

You can withdraw authorised access where technically and legally possible.

12. HOW WE USE YOUR INFORMATION

Provide Services

• create and maintain accounts;
• process payments;
• process transfers;
• operate wallets;
• exchange currencies;
• provide digital-asset services;
• facilitate lending;
• provide customer support; and
• deliver requested products.

Verify Identity

• verify users;
• prevent impersonation;
• perform KYC;
• perform customer due diligence;
• satisfy regulatory requirements; and
• protect accounts.

Prevent Fraud

• fraud;
• identity theft;
• account takeover;
• suspicious behaviour;
• money laundering;
• sanctions violations;
• payment fraud; and
• cyber threats.

13. ANTI-MONEY LAUNDERING AND COMPLIANCE

We may process personal information to comply with:

• anti-money laundering requirements;
• counter-terrorist financing requirements;
• sanctions laws;
• financial regulations;
• tax requirements;
• court orders;
• regulatory requests; and
• law-enforcement requests.

We may conduct:

• sanctions screening;
• PEP screening;
• adverse-media screening;
• transaction monitoring;
• risk scoring;
• source-of-funds checks; and
• enhanced due diligence.

14. ARTIFICIAL INTELLIGENCE AND AUTOMATED TECHNOLOGY

FrameLaPay may use advanced technologies including:

• artificial intelligence;
• machine learning;
• automated fraud detection;
• behavioural analytics;
• risk scoring;
• anomaly detection;
• biometric verification;
• blockchain analytics;
• automated customer support; and
• cybersecurity systems.

These technologies may analyse information to identify suspicious transactions, fraud, security threats and other risks.

Where automated decision-making has a legal or similarly significant effect on you, we will apply safeguards required by applicable law, which may include appropriate information, human review or mechanisms for challenging decisions.

15. CREDIT AND LENDING INFORMATION

Where FrameLaPay or its lending partners provide lending services, we may process information to:

• assess eligibility;
• assess affordability;
• prevent fraud;
• determine credit risk;
• manage loans;
• process repayments;
• monitor accounts; and
• comply with applicable lending laws.

This may include information from credit-reference agencies or other legally permitted sources.

16. MARKETING

Where legally permitted, we may use your information to send:

• product announcements;
• promotions;
• newsletters;
• educational material;
• service updates; and
• other marketing communications.

You may opt out of marketing communications at any time.

However, opting out of marketing will not prevent us from sending essential communications concerning:

• security;
• transactions;
• account activity;
• legal matters;
• regulatory requirements; or
• service changes.

17. LEGAL BASES FOR PROCESSING

Where applicable, we process personal information on one or more of the following grounds:

Consent

Where you have provided consent.

Contract

Where processing is necessary to provide a service you requested.

Legal obligation

Where processing is required by law.

Legitimate interests

Where processing is necessary for legitimate business interests, including:

• fraud prevention;
• cybersecurity;
• platform security;
• service improvement;
• business administration; and
• protecting users.

Vital interests

Where necessary to protect an individual's vital interests, where legally recognised.

18. DATA MINIMISATION

We seek to collect only information reasonably necessary for the relevant purpose.

We may nevertheless be required to collect additional information because of financial, regulatory, fraud-prevention or legal obligations.

19. WHO WE SHARE INFORMATION WITH

We may share personal information with:

• banks;
• payment processors;
• financial institutions;
• licensed financial partners;
• digital-asset service providers;
• lenders;
• identity-verification providers;
• fraud-prevention providers;
• cybersecurity providers;
• cloud-service providers;
• customer-support providers;
• professional advisers;
• auditors;
• insurers;
• regulators;
• government authorities;
• law-enforcement agencies; and
• other service providers necessary to provide the Services.

We do not sell personal information merely for the purpose of allowing third parties to independently market their products to you.

20. REGULATORY AND LAW-ENFORCEMENT DISCLOSURES

We may disclose information where reasonably necessary or legally required to:

• regulators;
• financial-intelligence authorities;
• law-enforcement agencies;
• courts;
• government agencies;
• tax authorities; or
• other competent authorities.

We may not always be able to notify you before making such disclosures where notification is prohibited or would compromise an investigation.

21. INTERNATIONAL DATA TRANSFERS

Because FrameLaPay may use international technology, financial and service providers, your information may be processed outside Nigeria or outside the country in which you reside.

Where required by law, we will implement appropriate safeguards for international data transfers.

These may include:

• contractual protections;
• adequacy mechanisms;
• approved transfer mechanisms;
• security safeguards; and
• other legally recognised measures.

22. DATA RETENTION

We retain personal information only for as long as reasonably necessary for:

• providing services;
• maintaining records;
• complying with legal requirements;
• resolving disputes;
• preventing fraud;
• enforcing agreements;
• financial reporting;
• regulatory requirements; and
• legitimate business purposes.

Financial and regulatory records may need to be retained for longer periods than ordinary account information.

When information is no longer required, we may securely delete, anonymise or otherwise dispose of it.

23. DATA SECURITY

We implement technical and organisational measures designed to protect personal information.

These may include:

• encryption;
• authentication;
• access controls;
• role-based permissions;
• monitoring;
• logging;
• network security;
• secure cloud infrastructure;
• vulnerability management;
• penetration testing;
• backups;
• incident response; and
• employee security training.

However, no technology system can guarantee absolute security.

24. ACCOUNT SECURITY

You are responsible for protecting your:

• password;
• PIN;
• authentication codes;
• recovery information;
• device;
• wallet credentials; and
• other security information.

You must notify us immediately if you believe your account has been compromised.

25. COOKIES

FrameLaPay may use cookies and similar technologies.

These technologies may be used for:

• authentication;
• security;
• functionality;
• analytics;
• performance;
• preferences; and
• marketing where permitted.

Our Cookie Policy provides further information.

26. CHILDREN'S PRIVACY

FrameLaPay's financial services are not intended for individuals who are below the minimum legal age required to use the relevant service.

We do not knowingly collect personal information from children in violation of applicable law.

If we learn that information has been collected improperly, we may take appropriate steps to delete it.

27. YOUR DATA PROTECTION RIGHTS

Depending on applicable law, you may have rights including:

• right to access your personal information;
• right to correct inaccurate information;
• right to request deletion;
• right to restrict processing;
• right to object to certain processing;
• right to data portability;
• right to withdraw consent;
• right to lodge a complaint;
• right to request information about automated decision-making; and
• other rights provided by applicable law.

Some rights are subject to legal exceptions.

For example, we may be unable to delete information that we are legally required to retain.

28. HOW TO EXERCISE YOUR RIGHTS

To exercise your privacy rights, contact:

We may need to verify your identity before processing your request.

This is necessary to prevent unauthorised access to personal information.

We will respond within the period required by applicable law.

29. DATA ACCURACY

You are responsible for ensuring that information you provide to FrameLaPay is accurate and current.

You should notify us if your personal information changes.

30. AUTOMATED DECISION-MAKING

Certain FrameLaPay systems may use automated processes to:

• identify fraud;
• determine transaction risk;
• identify suspicious activity;
• verify identity;
• assess eligibility;
• protect accounts; and
• support credit-related decisions.

Where applicable law provides rights concerning solely automated decisions, you may have the right to request information about the decision and seek appropriate review.

31. BLOCKCHAIN AND PUBLIC LEDGERS

Where you use cryptocurrency or blockchain services, certain transaction information may become permanently recorded on a public blockchain.

Blockchain information may be:

• publicly visible;
• difficult or impossible to delete;
• distributed across multiple jurisdictions; and
• outside FrameLaPay's ability to modify.

You should therefore carefully consider privacy implications before conducting blockchain transactions.

32. THIRD-PARTY WEBSITES

FrameLaPay may contain links to third-party websites or services.

We are not responsible for the privacy practices of third parties.

You should review their privacy policies before providing personal information.

33. THIRD-PARTY SERVICE PROVIDERS

Our service providers may process information on our behalf.

We seek to require appropriate confidentiality and security protections from service providers that process personal information for us.

34. DATA BREACHES

If a personal-data breach occurs, FrameLaPay will respond according to applicable law and our incident-response procedures.

Where notification is legally required, we will notify the appropriate regulator and/or affected individuals within the applicable timeframe.

35. PRIVACY BY DESIGN

We seek to incorporate privacy and security considerations into the development and operation of our products.

This may include:

• minimisation;
• access controls;
• encryption;
• security testing;
• privacy assessments;
• restricted access;
• data retention controls; and
• secure development practices.

36. BUSINESS AND CORPORATE USERS

If you use FrameLaPay on behalf of a company or organisation, you confirm that you have authority to provide information to us and to permit us to process that information for the relevant purpose.

Where FrameLaPay processes information on behalf of a business, additional contractual data-processing terms may apply.

37. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy periodically.

When we make material changes, we may notify users through:

• email;
• the website;
• application notifications; or
• other appropriate communication channels.

The "Last Updated" date at the beginning of this Privacy Policy will indicate when it was most recently revised.

38. CONTACT US

For privacy questions, requests or complaints:

39. DATA PROTECTION COMPLAINTS

If you believe that your personal information has been processed improperly, please contact FrameLaPay first so that we can investigate and attempt to resolve the matter.

You may also have the right to complain to the relevant data-protection authority, including the Nigeria Data Protection Commission, where applicable.

40. YOUR ACKNOWLEDGEMENT