Privacy Policy

Paysorta, a payment product built by GGTConnect (“we”, “us”, “our”), is committed to protecting personal data. This Policy applies to our website, dashboard, APIs, checkout, and related payment products (the “Services”).

Our privacy principles:

• Control: you should understand and be able to exercise choices about your data;
• Need-to-collect: we collect what is needed to provide, secure, and comply around the Services — no more;
• Transparency: we explain what we collect, why, and who sees it;
• Security: we protect data with administrative, technical, and physical controls, including PCI DSS handling for card data and ISO 27001 / SOC 2 aligned practices;
• Accountability: we keep data accurate where possible and respect local law in each market where we operate.

This Policy covers the Services only. Merchant websites, third-party checkouts, and linked sites have their own privacy notices, which you should review separately.

For users in Nigeria, the data controller is Paysorta (built by GGTConnect), 9, Younis Bashorun Street, Off Ajose Adeogun Rd, Victoria Island, Lagos, Nigeria, with Nigerian payment processing enabled under the CBN Payment Solution Service Provider (PSSP) licence of DotFit Technologies Inc. For users elsewhere, the contracting and controlling entity may be the relevant Paysorta/GGTConnect affiliate named in your agreement or product notice.

• Privacy enquiries and rights requests: [email protected]
• General support: [email protected]
• Our Data Protection Officer can be reached through [email protected].

Depending on how you use the Services, we may collect:

• Identity and verification data: name, date of birth, nationality, government-issued ID numbers and documents, photos or video for verification, business registration and ownership details (for KYC/KYB and AML/CFT checks);
• Contact data: email, phone number, billing and business addresses, country of residence;
• Financial and transaction data: bank account details, beneficiary details, merchant name and location, transaction amounts, dates, authorisation and settlement records, refund and chargeback records;
• Technical and usage data: IP address, device identifiers, browser and app information, pages and features used, click and scroll activity, login events, and approximate location derived from technical signals;
• Communications and marketing data: support messages and call/chat records, survey responses, event registrations, and your marketing preferences.

We do not intentionally collect sensitive personal data (such as health, biometric data beyond verification, or beliefs) unless required for verification or with a clear legal basis, in which case we apply additional safeguards. We also process anonymised or aggregated data that does not identify you.

We obtain personal data:

• Directly from you — when you register, verify your identity, use the dashboard or APIs, contact support, complete forms or surveys, or attend our events;
• From your transactions — when you pay a Paysorta merchant or receive funds through our rails, we receive the transaction details needed to process and reconcile it;
• From merchants and partners — merchants, banks, card schemes, mobile network partners, identity verification and fraud-prevention providers, and analytics providers may share data needed for processing, verification, and risk checks;
• From public sources — such as business registries and directories, for due diligence and compliance screening.

We process personal data on these bases, as applicable under the Nigeria Data Protection Act 2023 (NDPA) and other relevant laws:

• Consent — where you agree to specific processing (for example optional marketing or contact-list access in an app feature);
• Contract — to create and manage accounts and to provide the Services you request;
• Legal obligation — to comply with CBN directives, AML/CFT and sanctions laws, tax and record-keeping duties, and lawful requests from courts, law enforcement, or regulators;
• Legitimate interests — as permitted by law, to secure the Services, prevent fraud, improve products, and manage our business, balanced against your rights.

Where consent is the basis, you may withdraw it at any time (for example via account settings or an unsubscribe link). Withdrawal does not affect prior lawful processing, and some Services cannot be provided without certain data.

• Create, verify, and administer accounts, including KYC/KYB and risk assessment;
• Process payments — authorisation, clearing, settlement, refunds, chargebacks, and dispute handling — and provide transaction records and support;
• Detect, prevent, and investigate fraud, unauthorised transactions, and abuse, including sanctions and watchlist screening;
• Communicate about accounts, transactions, service updates, and regulatory notices (including one-time passcodes for authentication);
• Provide customer support and handle complaints, inquiries, and event registrations;
• Improve and develop products, run analytics, and measure performance;
• Send marketing where permitted, with the right to opt out at any time (transactional and service messages may still be sent where needed for the business relationship);
• Establish, exercise, or defend legal claims and meet regulatory duties.

We share personal data only as reasonably necessary for the purposes in this Policy:

• Service providers and partners: identity verification, fraud prevention, analytics, communications, IT hosting, and customer support vendors; banking and financial partners (including settlement banks and card networks) that process or settle transactions;
• Merchants and their customers: limited transaction details needed to complete, reconcile, or dispute a payment you were party to;
• Regulators and law enforcement: the CBN, financial intelligence units, courts, and other authorities where required by law or to protect against fraud, harm, or violations of our Terms of Use;
• Corporate transactions: where we are involved in a merger, acquisition, or sale, data may transfer to the parties involved, with continued protection under this or a communicated successor notice;
• With your direction: third parties you authorise (for example an app you connect). Their use is governed by their own notices.

Our vendors are required to process data on our instructions, keep it confidential, and apply appropriate security. Our Nigerian processing runs under a PSSP licence, which does not cover operating customer wallets or holding customer funds; settlement flows pass through licensed banks and partners.

We operate across markets, so personal data may be transferred to affiliates and providers in other countries, including countries without identical data protection laws. Where we transfer data internationally, we use safeguards required by the NDPA — such as adequacy considerations, standard contractual clauses, or other approved transfer mechanisms — and limit transfers to what is needed to provide the Services.

• Security: we maintain administrative, technical, and physical controls — including encryption in transit and at rest where appropriate, access controls, logging, secure development practices, and staff training. Card data is handled under PCI DSS requirements as applicable.
• Your role: use strong unique passwords, enable two-factor authentication, keep API keys and webhook secrets confidential, and tell us immediately at [email protected] if you suspect compromise.
• Retention: we keep personal data only as long as reasonably needed to provide the Services and meet legal duties — including CBN record-keeping and AML/CFT/fraud-monitoring obligations. Closed-account data may be retained in limited form where the law requires it, then deleted or anonymised.

We use cookies and similar technologies to operate the site, remember preferences (such as login state), measure engagement, and improve our Services. Strictly necessary cookies are needed for the site to function; analytics and marketing cookies are used only where you allow them through your browser or banner choices.

Most browsers accept cookies by default but can be set to decline them or alert you. If you disable non-essential cookies, some features may not work fully. For questions about specific cookies on this site, contact [email protected].

Under the NDPA and other applicable laws, you may have the right to be informed about processing; request access to or a copy of your data; request correction of inaccurate or incomplete data; request erasure where continued processing lacks justification; object to or restrict certain processing; withdraw consent; request portability in a structured, commonly used format where feasible; and not be subject to decisions based solely on automated processing with legal or similarly significant effects.

• Exercise rights free of charge at [email protected]. We may need to verify your identity, and authorised representatives must show proof of authority.
• Some rights are limited — for example, as a regulated payments provider we must retain certain records for compliance, and we may keep a minimal suppression record to honour marketing opt-outs.
• We respond within applicable statutory timelines (generally within 30 days, or as the NDPA requires). If a request is excessive or manifestly unfounded, we may charge a reasonable fee or decline it as permitted by law, and we will explain why.
• If you remain dissatisfied, you may complain to the Nigeria Data Protection Commission (NDPC) or your local supervisory authority, in addition to contacting us first.

• Children: the Services are not directed to persons under 18, and we do not knowingly collect their data. If you believe a minor's data was provided, contact us so we can investigate and take appropriate action.
• Updates: we may revise this Policy to reflect new Services, practices, or legal requirements. The current version will be posted here with its date; material changes will be notified by email, dashboard notice, or site banner where appropriate.
• Contact: Data Protection Officer via [email protected]; support via [email protected]; legal via [email protected]. 9, Younis Bashorun Street, Off Ajose Adeogun Rd, Victoria Island, Lagos, Nigeria. Hours: Monday–Friday, 9:00am–6:00pm (WAT).