Privacy Policy

1. Overview & Commitment to Privacy

[Paytali Technologies Ltd. / Operating Entity] ("Paytali", "we", "us", or "our") respects your privacy and is dedicated to protecting your personal data. This Privacy Policy explains how we collect, process, store, disclose, and safeguard your personal information when you visit our website, utilize our mobile applications, or engage in our peer-to-peer (P2P) currency exchange matching service.

This Privacy Policy is designed to comply with applicable data protection regulations across our primary operating jurisdictions, notably the Egyptian Personal Data Protection Law (Law No. 151 of 2020 - PDPL) and the Nigeria Data Protection Act 2023 (NDPA).

2. Data Controller

The legal data controller responsible for the processing of your personal information under this policy is:

[Paytali Technologies Ltd.]
Data Protection Officer (DPO)
Email: dpo@paytali.com
Privacy Desk: privacy@paytali.com
Corporate Address: [Registered Address, Cairo / Lagos / Delaware]

3. Personal Data We Collect

We collect and process personal data strictly necessary to deliver secure P2P matching, prevent fraud, satisfy anti-money laundering (AML) compliance, and authenticate transactions. Categories of data collected include:

• Identity & Demographic Information: Full legal name, date of birth, gender, nationality, country of origin, and government identity document details (e.g., Nigerian National Identity Number [NIN], Bank Verification Number [BVN], Egyptian National ID, Egyptian residency permit, or International Passport).
• Biometric Data (Smile ID): High-resolution selfie images and real-time facial liveness video telemetry processed exclusively via our identity partner Smile ID to confirm that the person registering matches the government photo identity document. Biometric templates are stored securely and never sold or shared.
• Contact Information: Verified primary email address, verified mobile telephone number, and residential address.
• Financial & Payment Rail Identifiers: Bank account numbers and bank names (for Nigerian NIP transfers), InstaPay Payment Addresses (IPA) or registered mobile numbers (for Egyptian InstaPay and Vodafone/Orange/Etisalat Cash), and wallet identifiers for Francophone West Africa (Wave/Orange Money/MTN MoMo). Note: Paytali does not store bank account passwords, PINs, or card CVVs.
• Transaction & Order Telemetry: Currency pairs exchanged (EGP, NGN, XOF), amounts, timestamped execution stages, proof of payment receipts, merchant ratings, and dispute records.
• Device & Technical Telemetry: IP address, device model, operating system, browser type, unique device identifiers, and localized session logs.

4. Zero Counterparty Data Leakage Architecture

Your personal contact information is never exposed to counterparties.

A fundamental security principle of Paytali is bilateral anonymity between trading parties. Counterparties only see verified trading pseudonyms, completion rates, and the required payment destination coordinates (e.g. your designated bank account or InstaPay address required to complete the fiat transfer). Your phone number, email address, physical location, and government ID numbers remain strictly concealed.

5. Legal Bases for Data Processing

Under the Egyptian PDPL and Nigerian NDPA, we process personal data under the following lawful bases:

• Performance of a Contract: To register your account, match currency orders, coordinate settlement, and enforce the Terms of Service.
• Compliance with Legal & Regulatory Obligations: To fulfill statutory AML, CFT, and customer due diligence requirements under Egyptian and Nigerian financial intelligence laws.
• Legitimate Interests: To detect, investigate, and prevent payment fraud, safeguard the security of merchant collateral vaults, and maintain platform integrity.
• Explicit Consent: Where required by law, such as for non-essential cookies, marketing notifications, or specific biometric verification authorizations.

6. Third-Party Service Providers

We share data with trusted third-party service providers bound by strict contractual data protection agreements:

• Smile ID: Automated biometric verification, document validation, and identity database confirmation.
• Clerk: Secure user authentication, multi-factor verification (MFA), and session token management.
• Cloud Infrastructure Providers (AWS / Cloud Run): Encrypted database hosting, append-only ledger storage, and private object storage for KYC documentation.
• Paystack / Banking Partners: Processing merchant collateral deposits and statutory banking confirmations.

7. Data Security Measures

We maintain rigorous technical and organizational safeguards to protect personal data against unauthorized access, loss, or alteration:

• Encryption in transit across all web and mobile endpoints using Transport Layer Security (TLS 1.3);
• Encryption at rest for all database volumes and object stores using Advanced Encryption Standard with 256-bit keys (AES-256);
• Segregated object storage buckets with zero-public-access controls for KYC identity documents;
• Strict role-based access control (RBAC) ensuring only authorized compliance and security staff access sensitive records under dual-authorization audit logging.

8. Data Retention & Deletion

In compliance with statutory financial crime and anti-money laundering regulations in Egypt and Nigeria, financial transaction records and KYC identity documentation are retained for a minimum of five (5) years following the date of transaction completion or account closure.

Non-statutory telemetry data and ephemeral trade communications are automatically expunged after 90 days. For full details, consult our Data Retention and Deletion Policy.

9. Your Data Rights

Subject to applicable local laws (PDPL Law 151/2020 and NDPA 2023), you hold the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal information we hold about you.
• Right to Rectification: You may request correction of inaccurate, incomplete, or out-of-date personal data.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer required for statutory compliance or active legal proceedings.
• Right to Object or Restrict Processing: You may object to the processing of your data for marketing or analytics purposes.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the Egyptian Data Protection Center (EDPC) or the Nigeria Data Protection Commission (NDPC).

To exercise any of these rights, submit a written request to dpo@paytali.com. We respond to verified data subject requests within 30 days.

10. Policy Updates

We may update this Privacy Policy periodically to reflect technological changes, operational enhancements, or evolving legal frameworks. When material changes occur, we will notify you through an in-app notice, website banner, or email before the revisions take effect.