Privacy Policy

This Privacy Policy explains what personal data BorderFlo Technologies Limited ("BorderFlo", "we", "us" or "our") collects when you use the BorderFlo app, website and related services (the "Platform"), why we collect it, who we share it with, how long we keep it, and your rights.

It is issued under the Nigeria Data Protection Act 2023 ("NDPA"), the Nigeria Data Protection Commission's General Application and Implementation Directive 2025 ("GAID"), and the CBN Consumer Protection Regulations 2019. Capitalised terms not defined here have the meaning given in our Terms & Conditions.

BorderFlo is the data controller for the personal data described in this policy.

Our Payment Partner, the CBN-licensed financial institution that holds your funds and executes your Transactions, also processes some of your data as a regulated financial institution in its own right, under its own privacy notice.

3.1 Identity and Contact Data

Your full legal name, date of birth, nationality, residential address, Nigerian mobile number, email address and BVN. We verify your BVN through our identity verification provider against NIBSS records. We collect gender only because it is returned with your BVN record and used to match your identity.

3.2 Biometric Data

During registration, our identity verification provider captures a short live image or video of your face to confirm you are a real person and to compare your face with the photograph on your BVN record. Biometric data is sensitive personal data under the NDPA, and we process it only with your explicit consent, given at registration.

BorderFlo stores only the result of the check (pass or fail, with a match score), not the image or video. The provider processes the image on our behalf, under contract, solely to perform the check, and deletes it immediately after the check is completed. We do not share biometric data with anyone else.

3.3 Financial and Transaction Data

For each Transaction: amount, currency, date and time, purpose, beneficiary details (name, bank or mobile money account, country), the FX Rate, fees and status. Your Balance and Transaction history are recorded by our Payment Partner and displayed to you through the Platform.

3.4 Device and Technical Data

Device model, operating system, device identifier, IP address, mobile network, app version, log data and the features you use. We use this to secure your Account and detect fraud.

3.5 Communications Data

Records of your messages with our support team, including tickets, chats and emails.

3.6 Compliance Data

Documents submitted for verification, sanctions and PEP screening results, Transaction monitoring records and any source-of-funds information you provide.

3.7 What We Do Not Collect

We do not collect your full card number, CVV or online banking credentials. We access your camera only for the liveness check, and your contacts or precise location only if you grant permission for a stated feature.

Each use of your data relies on one of the lawful bases in section 25 of the NDPA.

Where we rely on consent, you can withdraw it at any time in the Platform settings or by emailing privacy@borderflo.com. Withdrawal does not affect processing already carried out. Withdrawing consent to the liveness check means we cannot open or maintain your Account, because verification is legally required.

We keep personal data only as long as needed for the purpose it was collected for, or as long as the law requires. The Money Laundering (Prevention and Prohibition) Act 2022 requires records to be kept for at least five years; we keep them for seven.

At the end of the period, data is securely deleted or anonymised so it can no longer identify you.

6.1 We Do Not Sell Your Data

BorderFlo never sells your personal data or shares it with third parties for their own marketing.

6.2 Who We Share It With

We share only the data each party needs, under written contracts that require them to protect it and use it only for the stated purpose.

The names of our processors are available on request from our Data Protection Officer at privacy@borderflo.com.

6.3 Regulators and Law Enforcement

We disclose data to the CBN, NFIU, EFCC, NDPC, police or other competent authorities when required by law, court order or lawful directive. Where the law allows, we will tell you. In some cases, such as suspicious transaction reporting, the law prohibits us from telling you.

6.4 Business Transfers

If BorderFlo is merged, acquired or restructured, your data may transfer to the successor, which must honour this policy. We will notify you before that happens.

6.5 Transfers Outside Nigeria

Some recipients are outside Nigeria: banks and mobile money operators in the destination country of a Cross-Border Transaction, Institutional Payees abroad, and the servers of our cloud hosting provider, which are located outside Nigeria. We transfer data abroad only in line with sections 41 to 43 of the NDPA and the GAID, on one of these bases:

• the destination has adequate data protection, as recognised by the NDPC;
• we have contractual safeguards with the recipient approved under the NDPA; or
• the transfer is necessary to perform the Transaction you instructed.

Where a destination country's protections are weaker than Nigeria's, we tell you at the point of the Transaction and limit the data sent to what delivery requires.

We protect your data with technical and organisational measures, including:

• encryption in transit (TLS) and encryption of sensitive data at rest;
• transaction PINs stored only as salted hashes;
• multi-factor authentication for all staff access to admin systems;
• role-based access, so staff see only the data their job requires;
• regular security testing; and
• a documented incident response procedure.

If a personal data breach is likely to put your rights and freedoms at risk, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as required by section 40 of the NDPA. If the risk to you is high, we will also tell you directly, without undue delay, and explain the steps you can take to protect yourself.

To exercise any right, email privacy@borderflo.com. We may need to verify your identity first. We respond within thirty (30) days, free of charge unless a request is manifestly unfounded or excessive.

Our website and app use cookies and similar technologies for core functions, to remember your preferences and to analyse usage. Non-essential cookies are used only with your consent, which you can withdraw at any time. You can control or delete cookies through your browser settings at any time.

The Platform is only for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, email privacy@borderflo.com and we will delete it, unless the law requires us to keep it.

If you are concerned about how we handle your data, contact our Data Protection Officer at privacy@borderflo.com first. If you are not satisfied, you can complain to the Nigeria Data Protection Commission at www.ndpc.gov.ng.

We may update this policy to reflect changes in our practices, partners or the law. We will notify you of material changes through the Platform or by email before they take effect. The effective date at the top of this policy shows when it was last revised.