Privacy Policy

1. Introduction

LAWADEY ENTERPRISE, operating as BabsPay, is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, share, and protect your data when you use our platform.

By using BabsPay, you consent to the data practices described in this policy.

2. Information We Collect

Information you provide directly:

• Full name, email address, phone number, and state/location
• Password (stored as a one-way cryptographic hash — never in plain text)
• Transaction PIN (stored in hashed form)
• KYC documents: BVN, NIN (used only for identity verification)
• Bank account details for refund processing

Information collected automatically:

• IP address, device type, and browser information
• Login timestamps and session activity
• Transaction history and service usage logs
• WhatsApp bot interaction data (sender number and message content)

3. How We Use Your Information

• Service delivery: To process VTU transactions (data, airtime, cable, electricity, exam pins).
• Account management: To create, verify, and manage your account.
• Security: To detect fraud, enforce blacklists, and prevent unauthorized access.
• Communication: To send OTPs, transaction alerts, and service notifications via email and WhatsApp.
• Customer support: To respond to complaints and resolve disputes.
• Legal compliance: To fulfill regulatory obligations under Nigerian law, including CBN and NDPC requirements.
• Service improvement: To analyze usage patterns and improve platform performance.

4. Information Sharing & Disclosure

We do not sell your personal data. We may share your information only in the following circumstances:

• VTU API Providers: Phone numbers are sent to network API providers (Topupmate, BillStack, etc.) solely to fulfil your transaction.
• Payment Processors: Virtual account providers (Monnify, Payvessel, etc.) receive minimal data to generate your dedicated account.
• KYC Verification: BVN/NIN data is transmitted to authorised verification services for identity checks.
• Legal Requirements: We may disclose data to law enforcement when required by Nigerian law or valid court order.
• Fraud Prevention: We share blacklist information with partner platforms (e.g. Topupmate global blacklist) to prevent cross-platform fraud.

5. Data Security

• All data is transmitted over HTTPS/TLS encryption.
• Passwords and PINs are stored using bcrypt hashing — irreversible one-way encryption.
• CSRF tokens protect all form submissions.
• Failed login attempts trigger automatic account lockout after 5 attempts.
• IP addresses are monitored and blacklisted on suspicious activity.
• OTPs expire after 10 minutes and are single-use only.
• Database access is restricted to server-side code only — no direct public access.

6. Notifications & Communications

• You will receive transactional notifications (OTPs, receipts, alerts) by email and WhatsApp. These are mandatory and cannot be opted out of.
• You may receive promotional messages (new offers, announcements). You can unsubscribe at any time from your profile settings.
• We will never ask for your password, PIN, or OTP via phone call, email, or WhatsApp.

7. Data Retention

• Transaction records are retained for a minimum of 5 years as required by Nigerian financial regulations.
• Account data is retained while your account is active and for 2 years after deletion.
• OTP logs are retained for 30 days for security auditing purposes.
• Notification logs are retained for 90 days.

8. Your Rights

Under the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act (NDPA), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your account and associated data (subject to legal retention requirements).
• Withdraw consent for promotional communications at any time.
• Complain to the National Information Technology Development Agency (NITDA) if you believe your rights have been violated.

To exercise these rights, contact: support@babspay.com.ng

9. Cookies & Local Storage

• We use session cookies for authentication and CSRF protection. These are essential and cannot be disabled.
• We use browser localStorage only to remember your theme preference (dark/light mode).
• We do not use third-party advertising cookies or tracking pixels.

10. Children's Privacy

Our Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has registered, contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify registered users via email of any material changes at least 7 days before they take effect. Continued use of the Service after changes constitutes acceptance.

12. Contact & Data Controller

Data Controller: LAWADEY ENTERPRISE
Platform: BabsPay (babspay.com.ng)
Email: support@babspay.com.ng
Country: Nigeria