Who we are
ZenvaPay operates a naira wallet and the services offered through it. For the purposes of the Nigeria Data Protection Act 2023, we are the data controller for the information described here. If you have a question about anything on this page, write to us at hello@zenvapay.com.
What we collect
We collect three kinds of information, and no more than each purpose needs.
- Account details. Your name, email address and phone number, so we can identify your account and reach you about it.
- Identity information. Your BVN or NIN, and where required a photograph or identity document. Nigerian financial regulation requires us to verify who holds an account before certain services can be used.
- Transaction records. What you bought, when, how much, and the outcome. These are the receipts behind your balance, and we are required to keep them.
We also record technical information — the device and approximate location a sign-in came from — because an account accessed from somewhere unusual is the earliest signal that something is wrong.
How we protect it
Your BVN and NIN are encrypted before they are stored, each with its own key, so a copy of our database does not reveal them. Your password and transaction PIN are hashed separately from one another and cannot be recovered by anyone, including us.
Our systems record only fields on an approved list. Identity numbers, card details, one-time codes and PINs are not on that list, so they do not appear in our logs at all — not by policy, but because the system has no path to write them there.
Who we share it with
We share the minimum necessary with the licensed providers who carry out a transaction — a bank, a payment processor, or an identity verification service — and only the fields that transaction requires. We share information with regulators and law enforcement when the law obliges us to.
We do not sell your information, and we do not share it for advertising.
How long we keep it
Transaction and identity records are kept for the period Nigerian financial regulation requires, which is currently seven years after an account closes. Information we are not required to keep is deleted when it is no longer needed for the purpose it was collected for.
Your rights
Under the Nigeria Data Protection Act you may ask us to:
- show you the information we hold about you;
- correct anything that is wrong;
- delete information we are not legally required to keep;
- provide your information in a portable form;
- stop processing it in certain circumstances.
Write to hello@zenvapay.com and we will respond within 30 days. If you are not satisfied, you may complain to the Nigeria Data Protection Commission.
Signing in with Google
If you choose to sign in with Google, we receive your Google account identifier, your email address, and whether Google has verified it. We use the identifier to recognise you on your next visit. We do not receive your Google password, and we request no access to anything else in your Google account.
Changes to this policy
If we change how we handle your information, we will update this page and change the date above. Where a change materially affects you, we will tell you directly rather than rely on you noticing.