Privacy Policy

BUKHASDATALINK ("we", "us", or "our") is a private company limited by shares registered in the Federal Republic of Nigeria (RC 9342546). We operate the BUKHASDATALINK mobile application and website at bukhasdatalink.com.ng (collectively, the "Platform"). This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and your rights under applicable Nigerian law — including the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation 2019 (NDPR). By using our Platform you agree to the collection and use of information as described in this policy. If you do not agree, please stop using the Platform.

We collect the following categories of personal data: Account information — your full name, email address, phone number, and password when you register. Identity verification data — BVN, NIN/NIMC number, and other government-issued identifier details you submit for KYC checks. This data is queried against official government databases and is not stored permanently on our servers beyond the period necessary to complete the check. Transaction data — details of every transaction you carry out on the Platform, including amounts, networks, phone numbers recharged, meter/smartcard numbers, and timestamps. Device & usage data — device type, operating system, app version, IP address, crash reports, and in-app navigation patterns collected automatically to improve our service. Financial data — your wallet balance, funding history, and the virtual account details we generate on your behalf. We do not store full debit or credit card numbers. Communications — messages you send to our support team.

We use your personal data to: • Create and manage your account and wallet. • Process transactions including airtime, data, cable TV, and utility payments. • Perform identity verification checks as required by law and our compliance obligations. • Send you transaction confirmations, OTPs, and service notifications. • Detect, investigate, and prevent fraudulent or unauthorised activity. • Comply with legal and regulatory obligations including AML/CFT requirements. • Improve our Platform through aggregated, anonymised analytics. • Respond to your support requests and complaints. • Send you promotional offers and updates (you may opt out at any time). We process your data on the lawful bases of: contractual necessity, legitimate interests, compliance with a legal obligation, and — where required — your explicit consent.

We do not sell your personal data. We may share it with: Service providers — payment processors (e.g. PalmPay), network operators, identity verification bureaux, cloud hosting providers, and analytics tools that help us deliver the Platform. All processors are contractually bound to protect your data. Government & regulatory bodies — the Corporate Affairs Commission, Central Bank of Nigeria, NITDA, law enforcement, or courts when required by law or to protect our legal rights. Business transfers — in the event of a merger, acquisition, or sale of assets, your data may transfer to the new entity. We will notify you before this happens. We require all third parties to respect your data and to process it only for the specified purposes and in accordance with Nigerian law.

We retain your personal data for as long as your account is active or as needed to provide the service. After account deletion we retain certain records for a minimum of five (5) years to comply with AML, tax, and financial regulation requirements. Identity verification records are retained in line with the Central Bank of Nigeria's KYC/AML guidelines. You may request deletion of non-regulatory data at any time (see Section 8).

We implement industry-standard technical and organisational measures to protect your data including: • AES-256 encryption for data at rest. • TLS 1.2+ for all data in transit. • Secure transaction PINs and optional biometric authentication. • Role-based access controls limiting staff access to personal data. • Regular penetration testing and vulnerability assessments. No method of transmission over the internet is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

Our mobile application does not use browser cookies. Our website (bukhasdatalink.com.ng) uses essential cookies necessary for the site to function, and analytics cookies (with your consent) to understand how visitors use the site. You may manage cookie preferences through your browser settings. Disabling essential cookies may affect website functionality.

Under the NDPA 2023 you have the right to: • Access — request a copy of the personal data we hold about you. • Rectification — ask us to correct inaccurate or incomplete data. • Erasure — request deletion of your data (subject to regulatory retention obligations). • Restriction — ask us to limit how we process your data in certain circumstances. • Data portability — receive your data in a structured, machine-readable format. • Object — object to processing based on legitimate interests or for direct marketing. • Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing. To exercise any right, contact us at privacy@bukhasdatalink.com.ng. We will respond within 30 days.

Our Platform is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal data, please contact us immediately and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice in the app or sending an email to your registered address. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised policy. The date at the top of this page indicates when this policy was last updated.

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact: Data Protection Officer BUKHASDATALINK (Sofix Digital Technologies Ltd) Abuja, Federal Capital Territory, Nigeria Email: privacy@bukhasdatalink.com.ng Support: support@bukhasdatalink.com.ng You also have the right to lodge a complaint with the National Information Technology Development Agency (NITDA), Nigeria's data protection authority.