Your data
Privacy policy
Last updated: [Date]
Draft for review. Text in [square brackets] must be completed, and a Nigerian lawyer should review this page before launch.
This policy explains what personal data [Company Name] Limited ("Lorapay", "we") collects through this website and its waitlist, why, and the rights you have under the Nigeria Data Protection Act 2023 (NDPA). The Lorapay app will have its own privacy policy when it launches.
Who is responsible
[Company Name] Limited (RC [RC number]), [Registered office address], Nigeria, is the data controller. For anything about your data, contact our Data Protection Officer at privacy@lorapay.io.
What we collect
| When | What | Why |
|---|---|---|
| You join the waitlist | Name, mobile number, email (if you give it), state, what you'd use Lorapay for, and how you found us (for example a link you followed) | To tell you when Lorapay opens in your state, and to understand where people want it |
| You send a message | Name, email, topic and your message | To reply to you |
| You visit the site | Standard server logs kept by our hosting provider (IP address, browser, pages requested, time) | To keep the site running and secure |
This website does not use advertising or analytics cookies, and doesn't track you across other sites.
Please don't send us your PIN, BVN, card or bank details. We never ask for them through this website.
Our lawful basis
- Consent for the waitlist: you tick the box when you join. You can withdraw it at any time.
- Legitimate interests for replying to messages you send us and keeping the site secure.
How long we keep it
- Waitlist details: until we've told you Lorapay is open in your state and [12] months after that, or until you ask us to remove you, whichever comes first.
- Messages: up to [24] months after our last reply.
- Server logs: as kept by our hosting provider, normally no more than [30] days.
Who we share it with
We don't sell your data or share it for marketing. We use service providers who process it for us under contract:
- Google (Google Workspace / Google Sheets) to store waitlist entries and messages.
- Vercel to host this website.
- [SMS provider] to send the launch message, when we send it.
Some of these providers store data outside Nigeria. Where they do, we rely on the safeguards the NDPA allows for transfers abroad, such as contractual protections. [Confirm the transfer basis with your lawyer.] We may also disclose data where the law requires it.
Your rights
Under the NDPA you can ask us to:
- tell you what data we hold about you and give you a copy;
- correct it if it's wrong;
- delete it, or remove you from the waitlist;
- restrict or object to how we use it;
- send it to you or another organisation in a common format;
- withdraw your consent, at any time, without affecting what we did before.
Email privacy@lorapay.io from the address or phone number you used. We'll answer within 30 days. If you're not happy with our answer, you can complain to the Nigeria Data Protection Commission (NDPC).
Security
Waitlist entries are sent over an encrypted connection (HTTPS) and stored in an account protected by two-step verification, which only the Lorapay staff who need it can open.
Children
Lorapay is for people aged 18 and over. Please don't join the waitlist if you're younger.
Changes
If we change this policy we'll update the date at the top, and tell waitlist members about important changes.