CreditPoint is a digital wallet and payments app operated by Hayim Global Ltd ("CreditPoint", "we", "us"). This policy explains what personal data we collect when you use the CreditPoint mobile app and website, why we collect it, who we share it with, and the choices you have. We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA).
1. Data we collect
| Category | What | Why |
|---|---|---|
| Account details | Phone number, password (stored encrypted), optional email address | To create and secure your account and sign you in |
| Identity (KYC) | Full name, date of birth, gender, address, Bank Verification Number (BVN), National Identification Number (NIN), selfie photo | To verify your identity as required for financial services, prevent fraud, and set your transaction limits |
| Profile photo | A photo you choose to upload | To personalise your profile |
| Financial and transaction data | Wallet balance, deposits, transfers, bill payments, recipient bank details, phone numbers and meter/smartcard/betting IDs you pay for | To process your payments, show your history and statements, and meet record-keeping obligations |
| Security data | Transaction PIN (stored encrypted), one-time codes, login and device sessions | To protect your account and approve payments |
| Referral data | The referral code you used and people you referred | To run the referral programme |
| Support communications | Messages you send us by email, phone or WhatsApp | To help you |
Biometrics: if you use fingerprint or face to unlock the app or approve payments, the check is done by your phone. We never receive or store your fingerprint or face data.
We do not collect your contacts, location, or browsing activity, and we do not show third-party advertising.
2. Who we share data with
We share only what each partner needs to provide the service:
- Flutterwave: payment processing, your dedicated account number, bank transfers, airtime, data and bill payments. Your name, BVN and transaction details are shared to open your account number and complete payments.
- Flutterwave's partner bank: the bank that issues your account number.
- VTUAfrica: betting wallet top-ups (betting ID and amount).
- Termii: sending SMS verification codes and transaction alerts (your phone number).
- Our hosting and email providers: to run our servers and send emails.
- Regulators and law enforcement: when required by Nigerian law, for example anti-money-laundering obligations.
We do not sell your personal data.
3. How we protect your data
- All data travels over encrypted connections (HTTPS).
- Passwords and PINs are stored as one-way hashes; we cannot read them.
- Your full BVN and NIN are never shown in the app; only a masked version is displayed.
- Identity photos are stored privately and are visible only to authorised staff reviewing your verification.
- Staff access to the admin system is role-based and every sensitive action is logged.
- Repeated wrong PINs or codes lock the account temporarily to stop guessing.
4. How long we keep data
We keep your account data while your account is open. When you close your account, we delete or anonymise your personal data, except transaction records and identity verification records, which Nigerian anti-money-laundering rules require us to keep for at least five (5) years after the account is closed. After that period they are deleted.
5. Your rights
Under the NDPA you can ask us to: access the personal data we hold about you; correct inaccurate data; delete your data (subject to the legal retention above); restrict or object to processing; and receive a copy of your data. You can also complain to the Nigeria Data Protection Commission (NDPC).
To make a request, contact us using the details below. To close your account and delete your data, see Delete your account.
6. Children
CreditPoint is for people aged 18 and over. We do not knowingly open accounts for children.
7. Changes to this policy
We may update this policy. We will post the new version here with a new "Last updated" date and, for significant changes, notify you in the app.