Middlepay logo

Legal

Privacy Policy

Effective date:
30 October 2026
Last updated:
30 October 2026

This Privacy Policy explains how MiddlePay (Middle-Pay Technologies Limited) ("MiddlePay", "we", "us" or "our") collects, uses, stores, shares and protects personal data when you use our website, mobile application, marketplace, payment services, escrow services, cards, APIs and other services.

MiddlePay is committed to protecting your privacy and handling personal data responsibly in accordance with applicable Nigerian data-protection laws, including the Nigeria Data Protection Act 2023, and other applicable regulatory requirements.

By using MiddlePay, you acknowledge the practices described in this Privacy Policy.

1. Who We Are

MiddlePay is a digital commerce and transaction-protection platform that facilitates transactions between Buyers, Vendors and applicable financial and technology partners.

For purposes of applicable data-protection law, MiddlePay may act as a data controller or data processor depending on the nature of the processing activity.

2. Information We Collect

We may collect different categories of personal data depending on how you use MiddlePay.

2.1 Identity Information

This may include:

  • full name;
  • date of birth;
  • gender where necessary;
  • nationality;
  • photograph;
  • government-issued identification;
  • NIN;
  • BVN;
  • business registration information; and
  • other verification information.

2.2 Contact Information

This may include:

  • email address;
  • telephone number;
  • residential address;
  • business address;
  • delivery address; and
  • other contact information.

2.3 Financial and Transaction Information

Depending on the services you use, we may process:

  • bank account information;
  • account numbers;
  • transaction amounts;
  • transaction references;
  • payment history;
  • card-related information;
  • settlement information;
  • refund information;
  • payment status;
  • transaction counterparties; and
  • other information necessary to facilitate Transactions.

Where payment-card processing is performed by a third-party Payment Partner, the Payment Partner may process card information directly.

3. Information Collected from Businesses and Vendors

If you register as a Vendor or business, we may collect:

  • business name;
  • CAC registration details;
  • business address;
  • business category;
  • directors or beneficial-owner information;
  • tax information;
  • bank details;
  • business documents;
  • product and service information;
  • transaction history; and
  • KYC/KYB information.

4. Device and Technical Information

When you use MiddlePay, we may automatically collect information such as:

  • IP address;
  • device type;
  • operating system;
  • browser type;
  • application version;
  • device identifiers;
  • log information;
  • approximate location information;
  • login activity;
  • session information;
  • crash reports;
  • security information; and
  • interaction with our Platform.

This information helps us operate, secure and improve MiddlePay.

5. Cookies and Similar Technologies

MiddlePay may use cookies, SDKs, pixels and similar technologies.

We may use these technologies to:

  • keep you signed in;
  • remember preferences;
  • improve functionality;
  • understand how users interact with our Platform;
  • analyse performance;
  • detect fraud;
  • maintain security; and
  • support marketing where legally permitted.

You may be able to control cookies through your browser or device settings.

Disabling certain cookies may affect Platform functionality.

6. Information from Third Parties

We may receive information about you from third parties where legally permitted.

These may include:

  • banks;
  • payment processors;
  • identity-verification providers;
  • fraud-detection providers;
  • credit or risk-information providers where applicable;
  • card networks;
  • delivery providers;
  • business-registration databases;
  • regulators;
  • law-enforcement authorities; and
  • other service providers.

We may combine information received from these sources with information you provide directly.

7. Why We Use Your Personal Data

We may use your personal data to:

  • create and manage your account;
  • verify your identity;
  • verify businesses and Vendors;
  • process payments;
  • facilitate escrow Transactions;
  • process refunds;
  • facilitate settlements;
  • detect and prevent fraud;
  • monitor Transactions;
  • comply with legal and regulatory obligations;
  • respond to complaints and disputes;
  • provide customer support;
  • communicate with you;
  • improve our products and services;
  • maintain Platform security;
  • conduct analytics;
  • prevent abuse;
  • investigate suspicious activity;
  • develop new products;
  • send service-related communications; and
  • send marketing communications where legally permitted and, where required, with your consent.

8. Lawful Bases for Processing

Depending on the circumstances, MiddlePay may process personal data based on one or more lawful bases recognised under applicable law, including:

  • your consent;
  • performance of a contract with you;
  • compliance with a legal or regulatory obligation;
  • protection of vital interests where applicable;
  • performance of a task carried out in the public interest where applicable; and
  • legitimate interests where permitted by law.

Where processing relies on consent, you may withdraw your consent, subject to legal limitations and circumstances where another lawful basis permits continued processing.

9. KYC, AML and Fraud Prevention

Because MiddlePay facilitates financial and commercial transactions, we may process personal information for:

  • identity verification;
  • KYC/KYB;
  • anti-money laundering;
  • counter-terrorist financing;
  • sanctions screening;
  • fraud detection;
  • transaction monitoring;
  • risk assessment;
  • account-security monitoring; and
  • regulatory reporting.

Certain processing may be required by law and therefore may continue even if you withdraw consent.

10. How We Share Personal Data

We do not sell your personal data.

We may share personal data where necessary with:

Payment and Financial Partners

Including banks, payment processors, card schemes and other regulated or authorised financial-service providers.

Identity and Verification Providers

To verify identity, business information and other required information.

Fraud and Security Providers

To detect suspicious activity and protect Users and the Platform.

Technology Providers

Including cloud hosting, analytics, communications, customer-support and infrastructure providers.

Delivery and Logistics Providers

Where necessary to fulfil Transactions.

Professional Advisers

Including lawyers, auditors, accountants and consultants where reasonably necessary.

Regulators and Government Authorities

Where required by law, court order, regulatory requirement or lawful government request.

11. Data Processors

Some third-party service providers process personal data on MiddlePay's behalf.

Where appropriate, MiddlePay will require such providers to:

  • process data only for authorised purposes;
  • maintain appropriate security measures;
  • protect confidentiality;
  • assist with applicable privacy obligations; and
  • delete or return information when required.

12. International Data Transfers

Some of our technology or service providers may process information outside Nigeria.

Where personal data is transferred outside Nigeria, MiddlePay will take steps required by applicable data-protection law to ensure that the transfer is lawful and that appropriate safeguards are implemented.

13. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Retention periods may depend on:

  • the nature of the information;
  • the type of service;
  • legal requirements;
  • regulatory requirements;
  • accounting requirements;
  • dispute-resolution requirements;
  • fraud-prevention requirements; and
  • legitimate business needs.

Transaction and compliance records may need to be retained for specified regulatory or legal periods.

14. Data Security

MiddlePay takes reasonable technical and organisational measures to protect personal data against:

  • unauthorised access;
  • unlawful processing;
  • accidental loss;
  • destruction;
  • alteration;
  • disclosure; and
  • other security threats.

Security measures may include:

  • encryption;
  • access controls;
  • authentication;
  • monitoring;
  • logging;
  • secure infrastructure;
  • vulnerability management;
  • employee access controls; and
  • incident-response procedures.

However, no electronic system can be guaranteed to be completely secure.

15. Data Breaches

Where MiddlePay becomes aware of a personal-data breach, we will assess and respond to the incident in accordance with applicable law and regulatory requirements.

Where notification is legally required, we will notify the relevant regulator and/or affected individuals within the applicable timeframe.

16. Your Data Protection Rights

Subject to applicable law, you may have rights including the right to:

  • request access to your personal data;
  • request correction of inaccurate data;
  • request deletion of personal data in applicable circumstances;
  • request restriction of processing;
  • object to certain processing;
  • withdraw consent where consent is the lawful basis;
  • request portability of certain personal data;
  • object to certain direct marketing;
  • request information about how your data is processed; and
  • lodge a complaint with the relevant data-protection authority.

Some rights may be subject to legal or regulatory limitations.

17. How to Exercise Your Rights

To exercise a privacy right, contact:

Your request should include enough information for us to identify you and understand your request.

We may request additional information to verify your identity before processing a request.

We will respond within the timeframe required by applicable law.

18. Marketing Communications

MiddlePay may send you service-related communications necessary for your use of the Platform.

Where legally permitted, we may also send:

  • product updates;
  • promotional offers;
  • educational content;
  • newsletters; and
  • other marketing communications.

You may opt out of marketing communications at any time using the unsubscribe mechanism provided or by contacting us.

Opting out of marketing will not prevent us from sending essential service or transactional communications.

19. Children's Privacy

MiddlePay's services are intended for persons who are legally capable of entering into the relevant transactions.

We do not knowingly collect personal data from children where such collection is prohibited by applicable law.

If you believe that a child has provided personal data to MiddlePay in circumstances where such collection was not authorised, please contact us.

20. Third-Party Websites

MiddlePay may contain links to third-party websites or services.

Those websites operate independently from MiddlePay and may have their own privacy policies.

We are not responsible for the privacy practices of third-party websites.

21. Automated Decision-Making and Fraud Systems

MiddlePay may use automated systems to identify potentially fraudulent, suspicious or high-risk activity.

These systems may analyse information such as:

  • transaction behaviour;
  • account activity;
  • device information;
  • payment information;
  • historical activity; and
  • other risk indicators.

Where applicable law gives you rights relating to automated decision-making, you may contact us to exercise those rights.

22. Business Transfers

If MiddlePay is involved in a merger, acquisition, restructuring, financing, sale of assets or similar corporate transaction, personal data may be transferred as part of that transaction, subject to applicable law and appropriate safeguards.

23. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Where material changes are made, we may notify you through the Platform, email or another appropriate method.

The updated version will state its effective date.

24. Contact Us

If you have questions, complaints or requests concerning this Privacy Policy or the handling of your personal data, contact:

25. Complaints

If you believe that MiddlePay has processed your personal data unlawfully or has not adequately addressed your privacy concern, you should first contact us using the details above.

You may also have the right to lodge a complaint with the applicable Nigerian data-protection authority.