Privacy Policy

DottsPay is a product of Hiddekel Labs (“we”, “us”). This policy explains how we handle personal data when you visit our website, open a DottsPay account, or pay a business that uses DottsPay. We follow the Nigeria Data Protection Act 2023 and other data protection laws that apply to us.

From merchants:

• Account details, such as your name, email address, phone number and password (stored hashed).
• Business details and verification documents, such as registration information and identification for owners and directors.
• Bank account details for settlement.
• How you use the dashboard and API, including logs of actions taken on your account.

From customers who pay a merchant:

• Your name, email address and phone number, if the merchant asks for them.
• Payment details, such as the amount, currency, payment method and status. Card numbers are handled by our payment partners and are not stored by DottsPay.
• Technical details such as IP address and device information, used to prevent fraud.

From website visitors: basic technical and usage data, such as pages visited and browser type, and essential cookies that keep you signed in.

• To provide DottsPay: process payments, settle funds, send receipts and notifications, and support you.
• To verify identities and businesses, and to prevent fraud, money laundering and other crime.
• To meet our legal and regulatory duties, including record keeping and responding to lawful requests.
• To keep our service secure, fix problems and improve it.
• To send you service messages. We will only send marketing with your consent, and you can opt out at any time.

We process personal data to perform our contract with you, to meet legal obligations, for our legitimate interests in running a safe and reliable payments service, and, where needed, with your consent.

When you pay a business through DottsPay, that business decides why your data is collected. For those payments we act on the business’s instructions, and also use the data for our own legal duties and fraud prevention. Please read the business’s own privacy notice too.

We do not sell personal data. We share it only where needed, with:

• licensed payment processing partners, banks and card networks, to process and settle payments;
• the merchant you are paying, so they can fulfil your order;
• service providers who host our systems or send email for us, under contracts that protect your data;
• regulators, law enforcement or courts, when the law requires it;
• a buyer or successor, if our business is sold or reorganised, under the same protections.

Some of our partners and service providers may process data outside Nigeria. When that happens, we take steps the law requires to make sure your data stays protected.

We keep data for as long as your account is open and as long as needed afterwards to meet legal, tax and regulatory duties, which for financial records can be several years. When we no longer need it, we delete or anonymise it.

We use encryption in transit, encrypt sensitive credentials at rest, store passwords and API secret keys hashed, and limit staff access to what each role needs. No system is perfectly secure, so we also monitor for problems and will tell you and the authorities about a breach where the law requires it.

Depending on the law that applies to you, you can ask us to:

• give you a copy of your personal data;
• correct data that is wrong or incomplete;
• delete your data, where we are not required to keep it;
• restrict or object to certain uses, or withdraw consent you gave;
• move your data to another provider, where that applies.

To make a request, email us. You can also complain to the Nigeria Data Protection Commission or your local data protection authority.

DottsPay accounts are for adults running a business. We do not knowingly collect data from children to open accounts.

We may update this policy. If a change is significant, we will let you know by email or in your dashboard. See also our Terms of Service.

Questions or requests about your data? Email us at dottspay@hiddekellabs.com.