Privacy Policy

1. Who we are (Data Controller)

Airkobo Technology Ltd is the Data Controller in respect of personal data collected through the Airkobo mobile application, website (www.airkobo.com) and all related services (together, the "Services"). As Data Controller we determine the purposes and means by which your personal data is processed.

2. Our Data Protection Officer (DPO)

In accordance with Section 32 of the NDPA, we have appointed a Data Protection Officer. You may contact our DPO at any time regarding this policy or any data-protection matter:

• Email: dpo@airkobo.com
• Post: Data Protection Officer, AIRKOBO TECHNOLOGY LTD, Lagos, Nigeria

3. Personal data we collect

We collect only the minimum data necessary for the purposes described in this policy (data minimisation). The categories of personal data we may collect include:

• Identity data: full legal name, date of birth, gender and a government-issued identity document (National Identification Number, International Passport, Driver's Licence or Voter's Card).
• Contact data: email address, mobile phone number and residential address.
• KYC and financial data: Bank Verification Number (BVN), account details and other information required by the Central Bank of Nigeria (CBN) and applicable Know-Your-Customer (KYC) rules.
• Transaction data: payment instructions, beneficiary details (meter numbers, decoder numbers, phone numbers), amounts, references, timestamps and fulfilment status.
• AI interaction data: text or voice instructions you give the AI assistant, interpreted intents and payment confirmations.
• Device and technical data: device model, operating system, unique device identifiers, IP address, app version, crash logs and session data.
• Usage data: features accessed, services browsed, frequency of use and in-app navigation patterns.
• Communications data: records of correspondence with our support team, feedback and complaints.

4. Sensitive personal data

BVN, biometric authentication data and financial records are treated as sensitive personal data under the NDPA. We process such data only to the extent required by law (CBN KYC obligations, EFCC/AML requirements) or on the basis of your explicit consent, and we apply enhanced security controls to it at all times.

5. Why and how we use your data

The NDPA requires us to identify a valid lawful basis for every processing activity. The table below sets out our purposes and the basis we rely on for each.

• Account creation and management (lawful basis: performance of a contract) — to register your account, verify your email and phone number, and maintain your profile.
• Identity verification / KYC (lawful basis: legal obligation) — to comply with CBN KYC Directives, the Money Laundering (Prevention and Prohibition) Act 2022 and EFCC requirements.
• Wallet provisioning and payment processing (lawful basis: performance of a contract) — to issue your dedicated NGN account, credit your wallet and execute the bill payments and top-ups you request.
• AI assistant personalisation (lawful basis: performance of a contract and legitimate interests) — to interpret your natural-language instructions, predict upcoming renewals and surface spending insights tailored to you.
• Fraud prevention and security (lawful basis: legitimate interests) — to detect suspicious activity, investigate potential breaches and protect you and other users.
• Customer support (lawful basis: performance of a contract) — to respond to queries, resolve disputes and process refunds.
• Service notifications and transactional alerts (lawful basis: performance of a contract) — to send payment confirmations, renewal reminders and security alerts.
• Marketing communications (lawful basis: consent) — to send you promotional offers or feature announcements. You may withdraw consent at any time via your in-app settings or by emailing support@airkobo.com.
• Legal and regulatory compliance (lawful basis: legal obligation) — to respond to court orders, subpoenas, NDPC investigations and other regulatory requirements.
• Service improvement and analytics (lawful basis: legitimate interests) — to analyse usage patterns, identify bugs and improve the performance and reliability of our Services.

6. Who we share your data with

We share personal data only where necessary and always with appropriate contractual safeguards in place. Recipients include:

• Licensed payment processors and switching companies: to execute transactions and settle funds.
• KYC and identity verification providers: to confirm your BVN and identity documents against official records.
• Billers and service providers (electricity DISCOs, cable TV operators, telecoms networks): to fulfil the specific payment or top-up you have requested.
• Cloud infrastructure providers: to host, store and process data on our behalf under binding Data Processing Agreements.
• Fraud-prevention and analytics partners: to detect and prevent financial crime.
• Regulators and law-enforcement agencies (CBN, NDPC, EFCC, NFIU, courts): where we are required to do so by applicable law.

We never sell, rent or trade your personal data to third parties for their own marketing purposes.

7. International data transfers

Some of our service providers operate outside Nigeria. Where we transfer personal data to a country that does not provide an adequate level of data protection equivalent to Nigeria's NDPA, we implement appropriate safeguards such as Standard Contractual Clauses approved by the NDPC, or we rely on your explicit consent. We do not transfer BVN or biometric data outside Nigeria except where compelled by law or expressly permitted by the CBN.

8. How long we keep your data

We retain personal data only as long as necessary for the purposes stated, or to meet regulatory and legal obligations:

• Account and KYC data: for the duration of your account and for a minimum of 5 years after closure, as required by AML legislation.
• Transaction records: at least 7 years from the date of each transaction, in line with CBN record-keeping requirements.
• AI interaction logs: up to 12 months, unless required longer for an ongoing investigation.
• Marketing consent records: until you withdraw consent and for 2 years thereafter as evidence of lawful processing.
• Support communications: 3 years from resolution of the matter.
• Device and technical logs: up to 90 days unless required for security investigation.

When data is no longer required we securely delete or anonymise it so that it can no longer be linked to you.

9. How we protect your data

We implement technical and organisational measures appropriate to the risk, including:

• TLS encryption in transit and AES-256 encryption at rest for all personal and financial data.
• Role-based access controls so that only authorised personnel can access personal data, and only to the extent their role requires.
• Multi-factor authentication for all administrative systems.
• Periodic penetration testing, vulnerability assessments and security audits.
• Staff training on data-protection obligations and incident-response procedures.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware and will inform affected users without undue delay, as required by Section 40 of the NDPA.

10. Cookies and similar technologies

Our website uses cookies and similar tracking technologies to improve your browsing experience, analyse traffic and remember your preferences. You can control cookie usage through your browser settings and through our Cookie Consent banner. For full details, see our Cookie Policy.

11. Children and minors

Airkobo is a financial services platform intended exclusively for persons aged 18 years and above. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact our DPO immediately at dpo@airkobo.com and we will delete the data without delay.

12. Automated decision-making and profiling

We use automated systems to assess risk, detect fraud and interpret payment instructions via our AI assistant. Where an automated decision produces a significant legal or similarly significant effect on you (for example, account suspension following a fraud flag), you have the right under Section 42 of the NDPA to:

• Request a human review of the automated decision.
• Express your point of view.
• Contest the decision.

Contact our DPO at dpo@airkobo.com to exercise this right.

13. Your rights under the NDPA

As a data subject, the NDPA 2023 grants you the following rights. All requests are free of charge and will be responded to within 30 days (or 60 days in complex cases, with notice to you):

• Right to be informed (Section 24): to receive clear information about how your data is being used. This Privacy Policy fulfils that obligation.
• Right of access (Section 35): to obtain a copy of the personal data we hold about you and information about how it is being processed.
• Right to rectification (Section 36): to require us to correct inaccurate or incomplete personal data without undue delay.
• Right to erasure (Section 37): to request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent, or where processing is unlawful. This right is subject to our retention obligations under Nigerian law.
• Right to restrict processing (Section 38): to limit how we use your data in certain circumstances, such as when you contest its accuracy or have objected to processing.
• Right to data portability (Section 39): to receive your data in a structured, commonly used and machine-readable format and to request its transfer to another controller where technically feasible.
• Right to object (Section 40): to object at any time to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds.
• Rights related to automated decision-making (Section 42): as described in Section 12 above.
• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

14. How to exercise your rights

To exercise any of the above rights, submit a written request to our DPO by:

• Email: dpo@airkobo.com
• In-app: Settings > Privacy > Data Requests
• Post: Data Protection Officer, AIRKOBO TECHNOLOGY LTD, Lagos, Nigeria

We may ask you to verify your identity before fulfilling your request. We will respond within 30 days. Where we cannot fulfil a request in full, we will explain why and advise you of any available remedies.

15. Lodging a complaint with the NDPC

If you are not satisfied with our response, or if you believe we have processed your personal data in violation of the NDPA, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC):

• Website: ndpc.gov.ng
• Email: info@ndpc.gov.ng
• Address: No. 5 Uke Street, Garki Area 11, Abuja, FCT, Nigeria

We encourage you to contact us first so we can resolve your concern before escalating to the NDPC.

16. Third-party links and services

Our Services may contain links to third-party websites or integrate with third-party billers and payment providers. This Privacy Policy does not cover the data practices of those third parties. We recommend you read their privacy policies before sharing any personal data with them.

17. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. Where changes are material, we will notify you at least 30 days before they take effect via in-app notification or email. The "Last updated" date at the top of this page always shows when the policy was last revised. Continued use of the Services after the effective date constitutes acceptance of the revised policy.

18. Contact us

For any privacy-related enquiry, please contact:

• Data Protection Officer: dpo@airkobo.com
• General support: support@airkobo.com
• Telephone: +234 800 000 0000
• Company: AIRKOBO TECHNOLOGY LTD, Lagos, Nigeria
• Registration No.: 9626141 (Corporate Affairs Commission (Nigeria))