Privacy Policy

Effective 13 October 2026

This policy explains how Maiyakitech Digital Solutions Ltd (RC [number]), [registered address] ("Biyapoint", "we", "us"), the company behind Biyapoint, handles personal data. It covers business owners and their staff who use Biyapoint, and the customers who pay those businesses through Biyapoint. We follow the Nigeria Data Protection Act 2023 (NDPA).

1. What we collect

From businesses and their staff

Account details: name, email, phone number, password (stored only as a secure hash), two-factor settings.
Verification details: business name and registration (CAC) details, address, director and owner details, BVN or NIN, government ID, a live selfie check (short video frames and face measurements used only to confirm a real, present person), and the bank account for payouts.
Activity: transactions, wallet movements, withdrawals, invoices, shop products and orders, API usage, sign-in times, IP address and device or browser information.

From customers who pay a business

Name, email and phone number you enter; for deliveries, your address; for airtime and bills, the phone, meter or smartcard number and the account name it belongs to.
Transfer details from the bank: the paying account name, account number and bank, amount and time.
Reports you send us about a business.

2. How we use it

To provide Biyapoint: issue accounts, record payments, credit wallets, pay out withdrawals, deliver airtime and bills, send receipts and notices.
To verify businesses and keep fraudsters off the platform, including checking that payout accounts match the business.
To prevent and investigate fraud, money laundering and abuse, and to handle disputes and reports.
To meet legal and regulatory duties, including record keeping and reporting to authorities.
To keep the service secure, fix problems and improve it.
To send service messages. We send marketing only where you have agreed, and you can opt out at any time.

We do not sell personal data.

3. Our legal reasons

We process personal data because it is needed to perform our contract with a business; to comply with legal obligations (for example anti-money-laundering, tax and record-keeping rules); for our legitimate interests in keeping the platform safe and working, balanced against your rights; or with your consent, which you can withdraw. For businesses' customers, the business is responsible for the data it collects, and we also process it for the fraud-prevention and legal purposes above.

Our partner bank, 9 Payment Service Bank (9PSB), to issue accounts and move money.
Verification and account-check providers, for example to confirm the name on a bank account.
Airtime, data and bill providers, only the number and amount needed to deliver a purchase.
Email delivery (ZeptoMail by Zoho) to send codes, receipts and notices, and our hosting provider.
The business you pay, which sees your payment and the details you entered.
Authorities and regulators, when the law requires it, and professional advisers under duties of confidence.
A buyer or successor, if our business is sold or restructured, under this policy.

Our providers may only use the data to work for us and must protect it.

5. Data outside Nigeria

Some providers may store or process data outside Nigeria. When that happens we transfer it only as the NDPA allows, for example to countries with adequate protection or with contractual safeguards in place.

6. How long we keep it

We keep account, verification and transaction records for as long as your account is open and for at least [5] years after it closes or after the transaction, as financial and anti-money-laundering rules require. Selfie-check images are kept only as long as needed to verify and review the account, then deleted. Other data is deleted or anonymised when no longer needed.

7. How we protect it

We use encryption in transit, hashed passwords, two-factor sign-in, access limited to staff who need it, audit logs of staff actions, and secured servers. No system is perfectly secure; if a breach affects your data and puts you at risk, we will notify you and the Nigeria Data Protection Commission as the law requires.

8. Your rights

Under the NDPA you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to our use of it; give it to you or another provider in a usable format; and not to be subject to decisions made only by automated means that significantly affect you. You can withdraw consent at any time. Some data we must keep by law even if you ask us to delete it; we will explain if so. Email privacy@biyapoint.com; we will reply within 30 days.

9. Cookies and browser storage

Biyapoint uses your browser's storage only for things the service needs: keeping you signed in, remembering a shop cart, and settings such as hiding your balance. We do not use advertising or tracking cookies.

10. Children

Biyapoint is for businesses and is not meant for anyone under 18. We do not knowingly collect children's data for accounts.

11. Changes

We will post updates here and tell businesses about significant changes by email or in the dashboard.

12. Contact and complaints

Data Protection Officer: [name], Maiyakitech Digital Solutions Ltd, [registered address]. Email privacy@biyapoint.com.

If you are not satisfied with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).