Privacy Policy

Capay Global operates a payment gateway that lets businesses across Africa accept mobile money, bank and card payments, send payouts and disbursements, operate virtual accounts, access foreign-exchange conversion and, where offered, issue virtual cards. This Privacy Policy explains how we collect, use, share, transfer, retain and protect personal data, and the rights available to the individuals whose data we process.

In this Policy, "Capay Global", "we", "us" and "our" mean Capay Global LLC, a limited liability company registered in the State of Wyoming, United States of America, with its principal office at 10511 EastWind Way, Columbia, MD 21044, United States. "You" means any individual whose personal data we process, including the authorised representatives, directors, officers and beneficial owners of merchants, and the payers and payees (end customers) whose payment data passes through the gateway.

This Policy sits alongside our Terms of Service, our Acceptable Use Policy, our Data Processing Addendum and our AML/KYC Notice. Where we act as a processor for a merchant, the merchant's own privacy notice governs its relationship with its customers, and our Data Processing Addendum governs the processing we carry out on the merchant's behalf.

Our data-protection role depends on the processing activity. We act as a data controller (in some jurisdictions, the "responsible party") when we determine the purposes and means of processing: for example when we verify a merchant's identity to onboard it, screen for sanctions and fraud, meet our own legal and regulatory obligations, secure our systems, and manage our own business.

We act as a data processor (in some jurisdictions, the "operator") when we process personal data on the documented instructions of a merchant, for example when we handle a payer's transaction data solely to execute a payment the merchant has initiated. Where we are a processor, the merchant is the controller and our Data Processing Addendum applies.

Some parties to a payment, for example mobile-money operators, card networks and settlement banks, are independent controllers in their own right and process personal data under their own privacy notices.

The data controller is Capay Global LLC, 10511 EastWind Way, Columbia, MD 21044, United States.

Our privacy team can be contacted about this Policy, about our processing, or to exercise your rights: [email protected], or by post at 10511 EastWind Way, Columbia, MD 21044, United States, marked "Privacy".

Where a jurisdiction requires a locally registered controller, a local representative, or a data-protection contact registered with a national supervisory authority, the local details are set out in the per-jurisdiction sections below or can be requested from [email protected].

General operational and support enquiries may be sent to [email protected], but requests to exercise data-protection rights should be sent to [email protected] so that they are logged and handled within the statutory time limits.

This Policy applies to the personal data of:

• Merchants and their people: the authorised representatives, directors, officers, employees, shareholders and ultimate beneficial owners of businesses that register for or use the gateway.
• Developers and dashboard users who create or use API credentials on a merchant's behalf.
• Payers and payees (end customers) whose payment data passes through the gateway when a merchant collects a payment or receives a payout, where we generally act as the merchant's processor.
• Website visitors and people who contact us for support, sales or other enquiries.

We collect only the personal data we need for the purposes described in this Policy. The categories below are a schedule of what we may process; not every category applies to every individual.

• Identity and KYC data: full name, date and place of birth, nationality, gender, residential and business address, government identification numbers and documents (for example national ID, passport, driver's licence, and country-specific identifiers such as the Nigerian BVN and NIN where lawfully required), tax identification numbers, photographs and selfie or liveness images, and proof-of-address documents.
• Business and KYB data (for merchants): legal and trading names, registration and incorporation numbers, regulatory licences, ownership and control structure, details of directors, officers, shareholders and ultimate beneficial owners, and business financial information.
• Transaction data: payment amounts, currencies, timestamps, references and narrations, payer and payee identifiers (including mobile-money numbers, bank account numbers, and card tokens or the last four digits and expiry of a card), payment method and channel, settlement and payout details, and records of refunds, chargebacks and disputes.
• Financial and risk data: account balances and settlement records, reserve and credit information, fraud and risk scores, sanctions, politically-exposed-person and adverse-media screening results, and case and investigation records.
• Device, technical and usage data: IP address, device and browser identifiers, operating system, approximate location derived from IP, log and audit data, cookies and similar technologies, and how you interact with our dashboards, APIs and websites.
• Communications data: the content and metadata of your messages to us, support tickets and emails, and, where lawful and where you are notified in advance, call recordings.
• Sensitive or special-category data: we do not seek to collect special-category data, but identity documents may incidentally reveal information such as a photograph or place of birth. Biometric data (for example a facial template used for a liveness check) is processed only where lawful and, where required, with your explicit consent or under a specific legal obligation.

We obtain personal data:

• Directly from you, when you register, complete verification, use the gateway, or contact us.
• From the merchant, when a merchant sends us the payment data of its payers and payees so that we can execute a transaction.
• From payment providers, mobile-money operators, banks and card networks involved in a transaction.
• From identity-verification, KYC, sanctions, politically-exposed-person and fraud-prevention vendors.
• From public and official sources, such as company registries, and sanctions, watchlist and PEP lists.
• Automatically from your device, through cookies, similar technologies and server logs.

We process personal data only where a lawful basis applies. The lawful bases recognised across the regimes we operate under include performance of a contract, compliance with a legal obligation, our legitimate interests (balanced against your rights), your consent, and the protection of vital interests. The purposes and their bases are:

• To provide the gateway and perform our contract: creating and administering accounts, executing collections, payouts and refunds, operating virtual accounts and FX, and providing support. Basis: performance of a contract with you or the merchant, and our legitimate interest in operating the service.
• To meet anti-money-laundering, counter-terrorist-financing, sanctions and other legal obligations: identity verification (KYC and KYB), ongoing monitoring, sanctions and PEP screening, suspicious-activity reporting and record-keeping. Basis: compliance with a legal obligation and, to the extent Capay Global is licensed or partners with a licensed institution, the obligations that attach to that status; where a strict legal obligation does not apply, our legitimate interest in preventing financial crime.
• To prevent, detect and investigate fraud and to secure our systems: risk scoring, transaction monitoring, authentication, logging and abuse prevention. Basis: legitimate interests in the security and integrity of the service and, where applicable, legal obligation.
• To manage risk, settlement, reserves and disputes: including chargeback and dispute handling and debt recovery. Basis: performance of a contract and legitimate interests.
• To communicate with you: service messages, security alerts, and changes to terms. Basis: performance of a contract, legal obligation and legitimate interests.
• To improve and develop the service and for analytics: Basis: legitimate interests and, for non-essential cookies and similar technologies, consent.
• For marketing, where offered: Basis: consent, or legitimate interests for business-to-business communications where local law permits; you may opt out at any time.
• To comply with lawful requests, to establish, exercise or defend legal claims, and in connection with a corporate transaction: Basis: legal obligation and legitimate interests.

We use automated tools to screen transactions and accounts for money laundering, sanctions exposure and fraud, and to score risk. These tools may automatically flag, delay, decline, hold or route a transaction for human review, and may contribute to a decision to restrict, suspend or offboard an account.

Where a decision produces legal or similarly significant effects and is based solely on automated processing, we apply the safeguards required by applicable law: we inform you, and we provide a route to obtain human intervention, to express your point of view and to contest the decision. An exception applies where disclosure or human review would prejudice the prevention or detection of financial crime or is otherwise restricted by law: for example, we cannot disclose the existence or content of a suspicious-activity report.

You can ask about the automated processing that affects you by contacting our privacy team at [email protected].

We share personal data only where necessary for the purposes in this Policy, and under appropriate contractual and legal protections. We share with:

• Payment providers and operators, including PawaPay, MTN and Orange, card networks including Visa and Mastercard and their processors, and acquiring, settlement and virtual-account partner banks.
• Identity-verification, KYC, sanctions, politically-exposed-person and fraud-prevention vendors.
• Cloud hosting, infrastructure, communications and analytics service providers that act as our processors under written data-protection terms.
• Professional advisers such as auditors, lawyers and accountants, and our insurers.
• Regulators, supervisory authorities, financial-intelligence units, tax authorities, courts, law-enforcement and other public authorities, where we are required or permitted by law to disclose.
• Parties to a corporate transaction (such as a merger, acquisition, financing or reorganisation), under confidentiality.
• Merchants, where we act as their processor, and the counterparties to a given payment.

We do not sell your personal data, and we do not share it for third-party advertising in exchange for payment. Where a service provider processes personal data for us, it does so on our instructions and for our purposes only.

Because payments and providers cross borders, and because our infrastructure and vendors may be located outside your country, personal data may be transferred to and processed in countries other than your own, including outside your region and outside the EEA and the United Kingdom.

We transfer personal data only where a lawful transfer mechanism and appropriate safeguards are in place. Depending on the exporting jurisdiction these include: an adequacy or equivalent decision; the European Commission's Standard Contractual Clauses (SCCs); the UK International Data Transfer Agreement or Addendum; binding contractual protections and, where required, a transfer risk assessment; and the cross-border transfer conditions of the applicable African data-protection laws, for example section 72 of POPIA in South Africa, the transfer provisions of the Kenya Data Protection Act 2019, the Nigeria Data Protection Act 2023, and the Ghana Data Protection Act 2012.

You may request information about the safeguards that apply to a specific transfer by contacting our privacy team at [email protected].

We keep personal data only for as long as necessary for the purpose it was collected for, and for as long as the law requires us to keep it. Anti-money-laundering law sets minimum retention periods that we must observe even after a relationship ends. Our retention schedule is:

• KYC and KYB identity and verification records, and records of transactions: kept for the duration of the business relationship and then for at least five (5) years after the relationship ends or the transaction is completed, consistent with FATF Recommendation 11 and applicable anti-money-laundering law, and for longer where a specific law requires.
• Transaction, settlement and accounting records: kept for the period required by applicable financial, tax and accounting law, typically between five (5) and ten (10) years depending on the jurisdiction.
• Fraud, sanctions and case records: kept for as long as necessary to manage the risk and to meet legal-hold and reporting obligations.
• Communications and support records: kept for as long as needed to handle your query and to meet our legal and evidential needs.
• Cookies and similar technologies: kept for the periods described in the Cookie Policy.
• When personal data is no longer needed and no legal obligation requires us to keep it, we delete, anonymise or securely restrict it.

We maintain technical and organisational measures designed to protect personal data, including encryption in transit and at rest, access controls and least-privilege access, network segmentation, logging and monitoring, and secure development and testing practices.

For card data, we maintain controls aligned with the Payment Card Industry Data Security Standard (PCI DSS), we minimise the card data we store, and we use tokenisation. We impose confidentiality obligations on our staff and train them, and we carry out due diligence on our vendors and bind them by contractual data-protection terms.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security; we work to reduce risk and to respond quickly if an incident occurs.

We maintain procedures to detect, investigate and respond to personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority within the time limits set by applicable law in each jurisdiction (for example, the GDPR sets a 72-hour deadline, and POPIA requires notification as soon as reasonably possible).

Where a breach is likely to result in a high risk to affected individuals, we notify those individuals as required by law, and we keep records of breaches and our response.

Subject to the conditions and exceptions of the law that applies to you, you have the following rights. The per-jurisdiction sections below name the specific law and supervisory authority for your country.

• The right to be informed about how we use your personal data (this Policy).
• The right of access to the personal data we hold about you.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure of data, subject to legal-retention limits, in particular anti-money-laundering record-keeping.
• The right to restrict processing in certain circumstances.
• The right to object to processing based on our legitimate interests, and to object to direct marketing at any time.
• The right to data portability, where the processing is based on consent or contract and is carried out by automated means.
• The right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• The right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to the safeguards and exceptions described above.
• The right to lodge a complaint with your supervisory authority.

Some rights are qualified. For example, we cannot delete records that we are legally required to keep for anti-money-laundering, tax or accounting purposes, and we cannot disclose information whose disclosure is restricted by law, such as the existence or content of a suspicious-activity report. Where we cannot fully meet a request, we will explain why, to the extent the law allows.

To exercise your rights, contact our privacy team at [email protected]. If you are a payer or payee whose data we process on behalf of a merchant (so that we are the processor and the merchant is the controller), please contact the merchant directly; we will support the merchant in responding.

We will take reasonable steps to verify your identity, we will respond within the time limits set by the applicable law (generally without undue delay, and typically within one month under the GDPR and within the periods set by each African law referenced below), and we will not charge a fee unless the law permits.

Where we process the personal data of individuals in Nigeria, we do so in accordance with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation 2019 (NDPR).

You have the rights of a data subject under the NDPA, including the rights to be informed, of access, to rectification, to erasure, to restrict and object to processing, to data portability, and to withdraw consent. Where we rely on consent, it is obtained freely and can be withdrawn.

The supervisory authority is the Nigeria Data Protection Commission (NDPC). You have the right to lodge a complaint with the NDPC. Our registration or data-controller status with the NDPC, and any engagement of a licensed Data Protection Compliance Organisation (DPCO), will be published in this Policy once completed; we do not assert a registration we do not hold.

Where we process the personal data of individuals in Ghana, we do so in accordance with the Data Protection Act, 2012 (Act 843).

You have the rights under Act 843, including the right of access, the right to correction of your data, the right to prevent processing that is likely to cause damage or distress, and the right to object to direct marketing.

The supervisory authority is the Data Protection Commission of Ghana. You have the right to complain to the Commission. Our registration status with the Commission will be published in this Policy once completed; we do not assert a registration we do not hold.

Where we process the personal data of individuals in Kenya, we do so in accordance with the Data Protection Act, 2019 and its regulations.

You have the rights of a data subject under the Act, including the right to be informed, of access, to rectification, to erasure, to object to processing, to data portability, and to restrict processing.

The supervisory authority is the Office of the Data Protection Commissioner (ODPC). You have the right to lodge a complaint with the ODPC. Our registration status with the ODPC will be published in this Policy once completed; we do not assert a registration we do not hold.

Where we process the personal information of individuals in South Africa, we do so in accordance with the Protection of Personal Information Act, 2013 (POPIA). Under POPIA, the controller is the "responsible party".

You have the rights of a data subject under POPIA, including the right to be notified, of access, to correction and deletion, to object to processing, and not to be subject to a decision based solely on automated processing.

The supervisory authority is the Information Regulator (South Africa). You have the right to complain to the Information Regulator. Our registration and, where applicable, the appointment of an Information Officer will be published in this Policy once completed.

Where we process the personal data of individuals in Cameroon, we do so in accordance with applicable Cameroonian law, including Law No. 2024/017 of 23 December 2024 governing the protection of personal data and Law No. 2010/012 of 21 December 2010 on cybersecurity and cybercrime, together with their implementing texts.

You have the rights available under applicable Cameroonian law, including the rights to information, access, rectification and objection, and, where processing is based on consent, the right to withdraw it.

Oversight of personal data and electronic communications in Cameroon has been exercised by the National Agency for Information and Communication Technologies (ANTIC). You have the right to complain to the competent authority under the applicable data-protection framework.

We operate in additional African countries. Where we process your personal data there, we comply with the applicable national data-protection and privacy laws and with the requirements of the relevant sector regulators, such as central banks and telecommunications regulators. In several of these countries the laws are modelled on the African Union Convention on Cyber Security and Personal Data Protection (the Malabo Convention).

You may contact our privacy team at [email protected] to ask which national supervisory authority is competent for you and how to exercise your rights; where a local registration is required, its status will be published in this Policy once completed.

Where we process the personal data of individuals in the European Economic Area (EEA) or the United Kingdom, we do so in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR and the UK Data Protection Act 2018.

You have the rights of a data subject under those laws, including access, rectification, erasure, restriction, objection, portability, the right to withdraw consent, and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to the exceptions those laws allow.

Transfers of personal data out of the EEA or the United Kingdom are protected by the safeguards described in the international-transfers section, including the Standard Contractual Clauses and the UK Addendum.

The supervisory authorities are the data-protection authority of the relevant EEA member state (and, at Union level, the European Data Protection Board) and, in the United Kingdom, the Information Commissioner's Office (ICO). You have the right to lodge a complaint with your local authority. Where we are required to appoint an EU or UK representative under Article 27, that representative's details will be published in this Policy.

Our websites and dashboards use cookies and similar technologies for strictly necessary purposes and, with your consent where required, for preferences and analytics. Our Cookie Policy explains what we use, why, and how to manage your choices.

Our services are intended for businesses and for individuals who are at least 18 years old, or the age of majority in their country. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact [email protected] and we will take appropriate steps.

We may update this Policy to reflect changes in our services, our technology, or our legal and regulatory requirements. Each published version carries an effective date and a version number, and we will notify you of material changes as required by law. The current version is 1.0, effective 2 September 2026.

If you have a concern about how we handle your personal data, please contact our privacy team at [email protected] first so that we can try to resolve it. You also have the right to complain to the supervisory authority in your jurisdiction, named in the per-jurisdiction sections above.

Privacy contact: [email protected].

Capay Global LLC, 10511 EastWind Way, Columbia, MD 21044, United States.

Related documents: our Terms of Service, Acceptable Use Policy, Data Processing Addendum, Cookie Policy and AML/KYC Notice.