This Privacy Policy explains how WePay, a product of Supreme-Tech Company Limited ("WePay", "we", "us" or "our"), collects, uses, shares, stores and protects your personal information when you use the WePay platform, website and mobile experience (together, the "Service"). It applies to every visitor to wepayafrica.net and every registered user of the Service.
This policy forms part of, and should be read together with, our Terms of Service, our Usage Policy and our Refund & Cancellation Policy. By creating an account or otherwise using the Service, you acknowledge that you have read and understood this Privacy Policy.
1. Definitions
- Personal Data — any information that identifies, or can reasonably be used to identify, a natural person, including your name, contact details, government-issued identifiers and device information.
- Processing — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer and deletion.
- Data Controller — the entity that determines the purposes and means of processing your Personal Data. For the Service, this is Supreme-Tech Company Limited.
- Service Provider — a third party that processes Personal Data on our behalf and under our instructions, such as payment rails, card issuers, identity-verification vendors and email or notification providers.
- You — the visitor or registered user of the Service whose Personal Data we process.
2. Information We Collect
2.1 Information you give us
- Identity and contact data — your name, email address, phone number and country of residence.
- Account credentials — your password (stored only as a one-way hash) and, where enabled, two-factor authentication settings.
- Identity verification (KYC) data — government-issued identification documents, selfie or liveness images, date of birth and any information returned by our identity-verification provider.
- Financial and payout data — bank account or mobile-money details, cardholder name and the transaction details you supply when you fund your wallet, transfer money, request a payout, buy a gift card or submit a payment link.
- Support and form submissions — the content of messages you send us, including the details you provide when you request a service such as Ads Services or submit a contact or enquiry form.
2.2 Information we collect automatically
- Device and technical data — IP address, device type, browser and operating system, screen size, language and a device fingerprint used to recognise trusted devices and detect account takeover attempts.
- Usage data — the pages you view, the features you use, the actions you take on the Service, session identifiers and the approximate location we derive from your IP address.
- Cookies and similar technologies — session cookies required to keep you signed in and to protect against cross-site request forgery, together with local storage used to remember your preferences. If you subscribe to push notifications, our notification provider stores a browser or device subscription identifier.
2.3 Information from third parties
- Bank and payment networks — confirmation of payments, settlement records and, where relevant, the reason a payment failed.
- Identity-verification and fraud-prevention providers — verification results, sanctions and politically-exposed-person screening outcomes, and risk scores.
- Public and regulatory sources — information from public registries and lawful requests from regulators or law-enforcement agencies.
3. How We Use Your Information
We process your Personal Data to:
- create and administer your account, and provide the products and services you request;
- verify your identity and satisfy our anti-money-laundering, counter-terrorism-financing and know-your-customer obligations;
- process funding, transfers, payouts, card issuance, gift card purchases, subscription billing and any other transaction you initiate;
- detect, investigate and prevent fraud, abuse, money laundering and unauthorised access, including by screening activity against risk signals and applying transaction limits;
- provide customer support, respond to your enquiries and fulfil service requests you submit through the platform;
- send you transactional messages such as payment confirmations, security alerts, verification codes and service notices;
- send you product updates and marketing communications where you have consented or where we are otherwise permitted to do so, and where you can always opt out;
- maintain, monitor and improve the Service, including debugging, testing, analytics and capacity planning;
- comply with applicable law, respond to lawful requests, and enforce our Terms of Service and other policies; and
- establish, exercise or defend legal claims.
4. Legal Bases for Processing
Depending on your jurisdiction, we rely on one or more of the following legal bases:
- Performance of a contract — to provide the Service you have signed up for.
- Legal obligation — to comply with financial-crime, tax and record-keeping laws.
- Legitimate interests — to protect against fraud, secure the Service, improve our products and support our users, where those interests are not overridden by your rights.
- Consent — for example, to send you marketing communications or to enable optional push notifications. You may withdraw consent at any time.
- Vital interests and public interest — in the narrow circumstances where processing is necessary to protect someone's life or to prevent serious harm.
5. Cookies and Tracking Technologies
We use strictly necessary cookies to operate the Service — for example, to keep you signed in, to protect forms against cross-site request forgery and to remember your country and currency settings. We also use limited local storage to remember interface preferences. We do not use third-party advertising cookies to build cross-site behavioural profiles of you.
You can block or delete cookies through your browser settings. Blocking strictly necessary cookies may prevent you from signing in or completing transactions.
6. How We Share Your Information
We do not sell your Personal Data. We share it only as described below:
- Service providers — payment rails, virtual-card issuers and processors, gift card suppliers, identity-verification vendors, cloud hosting, email and push-notification providers, and customer-support tooling, all of whom act on our instructions.
- Financial institutions and regulators — banks, payment networks and supervisory authorities where necessary to process a transaction or meet a legal obligation.
- Professional advisers — auditors, lawyers and insurers who are bound by confidentiality obligations.
- Law enforcement and public authorities — where we are required by law, or where disclosure is necessary to investigate fraud or protect the rights, property or safety of WePay, our users or the public.
- Business transfers — in connection with a merger, acquisition, financing or sale of assets, where Personal Data may be transferred as part of the transaction, subject to this policy.
Where a Service Provider processes Personal Data outside your country, we take steps to ensure an equivalent level of protection is maintained, including through contractual safeguards.
7. Data Retention
We keep your Personal Data for as long as your account is open and for as long afterwards as is necessary to satisfy our legal, regulatory and tax obligations. Transaction records and identity-verification results are generally retained for a minimum of five years after the end of our relationship with you, or longer where the law, an investigation or a dispute requires it. When Personal Data is no longer needed, we securely delete it or irreversibly anonymise it.
8. How We Protect Your Information
We apply administrative, technical and physical safeguards designed to protect your Personal Data against unauthorised access, loss, misuse and alteration. These include:
- encryption of data in transit, and encryption at rest for sensitive fields such as account numbers and card credentials;
- hashing of passwords so that they cannot be read, and mandatory email verification and new-device checks on sign-in;
- least-privilege access controls for staff, together with activity logging of administrative actions;
- rate limiting, bot protection and continuous monitoring for suspicious activity; and
- pre-deployment review of code that touches sensitive data.
No method of transmission or storage is completely secure. You are responsible for keeping your password and two-factor credentials confidential, and you should contact us immediately if you believe your account has been compromised.
9. Your Rights
Subject to applicable law, you may have the right to:
- Access the Personal Data we hold about you, and receive a copy of it;
- Correct inaccurate or incomplete information;
- Delete information that we no longer have a lawful reason to keep;
- Restrict or object to certain processing, including profiling and direct marketing;
- Port information you provided to us to another provider in a structured, machine-readable format;
- Withdraw consent at any time, without affecting processing carried out before withdrawal; and
- Lodge a complaint with your local data-protection authority.
To exercise any of these rights, contact us at support@wepayafrica.net. We will respond within the timeframe required by law. Some rights are limited by our record-keeping duties: for example, we cannot delete identity-verification records while we are legally required to retain them.
10. Marketing and Communications
We send service-critical messages (such as verification codes, security alerts and transaction confirmations) as part of the Service, and these cannot be switched off while your account is open. Marketing and product-update messages are sent only where we are permitted to do so and can be disabled from your profile settings or by following the unsubscribe link in the message. If you enable browser push notifications, you can revoke them at any time from your browser's notification settings.
11. Children's Privacy
The Service is not directed at, and may not be used by, anyone under the age of 18. We do not knowingly collect Personal Data from children. If we become aware that we have done so, we will close the associated account and delete the information, unless we are required by law to retain it.
12. International Transfers
WePay operates across borders, and the providers we rely on may process your Personal Data in countries other than your own. When we transfer Personal Data internationally, we require the recipient to protect it to a standard consistent with this policy and with applicable data-protection law, and we take account of the security and legal environment of the destination.
13. Third-Party Websites
The Service may link to websites and services we do not control, including gift card suppliers, card networks and social media pages. Their privacy practices are governed by their own policies, and we encourage you to review them. This Privacy Policy does not apply to those third-party services.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology or the law. Material changes will be communicated by email or in-app notification at least 30 days before they take effect. The version published on this page, with the "Last updated" date shown above, is the version in force. Continued use of the Service after the effective date constitutes acceptance of the revised policy.
15. Contact Us
For any question, request or complaint about this Privacy Policy or the way we handle your Personal Data, contact our privacy team at support@wepayafrica.net or visit our Contact page.
Supreme-Tech Company Limited (trading as WePay)
GV14, Ajah Ogombo Road (Charter House), Lagos Island, Lagos State, Nigeria
Website: wepayafrica.net
