01 Who we are
This Privacy Policy applies to the Zitch mobile app, website and related services (the "Platform"), operated by Zitch Technologies Ltd (RC 6920451), 10 Alh Jamiu Balogun, Ketu-Ikosi, Lagos, Nigeria ("Zitch", "we", "us"). We are the data controller for the personal information described here.
We handle personal data in line with the Nigeria Data Protection Act, 2023 (NDPA), the General Application and Implementation Directive, 2025 (GAID) issued by the Nigeria Data Protection Commission (NDPC), and other applicable laws. This policy should be read together with our Terms & Conditions.
02 Information we collect
Information you give us
- Account details — your name, phone number, email address and password.
- Identity & KYC information — where required to verify you or meet legal obligations: your date of birth, address, photograph, government-issued ID, and identifiers such as your Bank Verification Number (BVN) and National Identification Number (NIN).
- Biometric data — a live facial image (liveness) captured during identity verification and when you authorise certain high-value transactions. Face or fingerprint unlock happens on your device; we only receive confirmation that the check passed.
- Transaction details — the phone numbers, meter numbers, smartcard/IUC numbers, billers and amounts you use to make payments.
- Support messages — anything you send us when you contact support.
Information we collect automatically
- Usage & device data — app/site interactions, device type, operating system, and approximate location derived from your IP address.
- Log & security data — records used to keep your account safe and detect fraud.
03 Identity verification & KYC
To open certain accounts and to meet Central Bank of Nigeria and anti-money-laundering rules, we verify your identity through two licensed identity-verification providers, Prembly and Dojah. They act as our processors and may use your data only to carry out the checks we ask for. Using their identity products — Connect, Lookup and Prove — the data flow is:
- Lookup — we submit your BVN, NIN or phone number so the provider can confirm it against the authoritative national databases and return the matching record (such as your name, date of birth and photo), so we can confirm the details you gave us are genuine and belong to you.
- Prove — for facial verification and step-up checks on higher-value transactions, we capture a live selfie (liveness) and, where needed, a photo of your government ID; the provider matches your face to the record and screens the document for tampering.
- Connect — the secure, encrypted onboarding session through which this information (and, only if you choose to link a bank account, the account details you authorise) is collected and sent for verification.
We request only the data each check needs. Your BVN and NIN are stored only as one-way hashes — never as raw numbers — and we keep just the verification result and the minimum details for your account tier, protected and retained in line with the NDPA and the GAID.
04 How we use your information
We use your information to:
- create and manage your account and Wallet;
- process your transactions and deliver the value you buy;
- verify your identity and prevent fraud, money laundering and abuse;
- provide customer support and resolve disputes and reversals;
- send service messages such as receipts, alerts and security notices;
- improve and secure the Platform; and
- send promotional messages where you have agreed to receive them — you can opt out at any time.
05 Legal basis for processing
Depending on the activity, we rely on: performance of our contract with you (to deliver the Services), your consent (for example, marketing), legal obligations (such as anti-fraud and record-keeping duties), and our legitimate interests in operating and protecting the Platform. You can withdraw consent at any time where processing is based on it.
07 Payment information
Card and bank payments are processed by our licensed Payment Partners. Zitch does not store your full card number, CVV or bank credentials. Those details are handled directly by the payment processor under their own security standards.
We keep a record of your transactions (amounts, billers, references and status) so we can provide receipts, support and reversals, and to meet our legal obligations.
08 Data retention
We keep your information for as long as your account is active and for as long afterwards as we need to meet legal, accounting, tax and fraud-prevention requirements. In particular, identity and transaction records are kept for at least five (5) years after your last transaction or the end of our relationship, as required by Nigerian anti-money-laundering law. When information is no longer needed, we securely delete or anonymise it.
09 How we protect your information
We use technical and organisational measures to protect your data, including encryption of data in transit and at rest, one-way hashing of sensitive identifiers such as your BVN and NIN (so we never store the raw numbers), PIN-protected transactions, role-based access controls and monitoring. No system is completely secure, so we also encourage you to protect your PIN and password and to tell us right away about anything suspicious.
11 Your rights
Subject to applicable law, you have the right to:
- access the personal information we hold about you;
- ask us to correct inaccurate or incomplete information;
- ask us to delete your information where there is no lawful reason to keep it;
- object to or restrict certain processing, and withdraw consent;
- request a copy of certain information in a portable format; and
- lodge a complaint with us or with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
To exercise any of these rights, email support@zitch.ng. We may need to verify your identity before we act on a request.
12 Children
Zitch is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will remove it.
13 International transfers
Some of our service providers may process data outside Nigeria (for example, cloud hosting). Where that happens, we do so in line with the NDPA (sections 41–43) — transferring only to jurisdictions with an adequate level of protection or under appropriate safeguards such as binding contractual clauses, or with your consent or as otherwise permitted by law.
14 Changes to this policy
We may update this policy from time to time. We will change the "Last updated" date above and, for material changes, notify you in the app or by email. Please review it periodically.
15 Contact us
For privacy questions or to exercise your rights, contact:
- Data Protection Officer (DPO): support@zitch.ng
- Support: support@zitch.ng
- Phone / WhatsApp: +234 816 693 8327
- Address: 10 Alh Jamiu Balogun, Ketu-Ikosi, Lagos, Nigeria