RAFA

Privacy Policy

Last updated: October 3, 2026

RAFA ("we", "us", "our") is a SoftPOS merchant payment application operated by TrovaNaija Limited, a company registered in Nigeria. This Privacy Policy explains how we collect, use, store, share, and protect your personal and sensitive information when you use the RAFA mobile app and related services. We process personal data in line with the Nigeria Data Protection Act (NDPA) 2023 and the requirements of the Central Bank of Nigeria (CBN).

By creating an account or using RAFA, you agree to this Policy.

1. Information We Collect

Identity & KYC data

Full name, date of birth, gender, and residential/business address
Bank Verification Number (BVN) and/or National Identification Number (NIN)
Government-issued ID details (e.g. passport, driver's licence, voter's card)
Biometric data — a live "liveness" selfie used for facial verification and to confirm it is really you during onboarding and sensitive actions
For business/enterprise accounts: company name and CAC/RC registration details

Contact data

Phone number (verified by OTP) and email address

Financial & transaction data

Wallet balances, transaction history, fees, and settlement records
Linked bank account details and your dedicated virtual account number
Virtual card details you create and their activity
Card-present (tap-to-pay) transaction data when you accept card payments

Location data

Device GPS location to geo-tag transactions (a CBN/NIBSS payment-security requirement)
For enterprise field agents who enable "Share my location": continuous location shared with your head office for fleet coordination and cash-collection tracking — including in the background, while the sharing is switched on. We request your explicit consent before any background location access, and you can turn it off at any time.

Device & technical data

Device model, OS version, app version, IP address, and a device integrity (anti-fraud) attestation
Push notification token to deliver alerts

2. How We Use Your Information

To create and operate your account and wallet
To verify your identity and comply with KYC, AML, and CBN obligations
To process payments, deposits, withdrawals, transfers, bills, airtime, and card issuing
To detect, prevent, and investigate fraud, and to secure your account (biometric and device checks)
For enterprise accounts, to show head office the live location of field agents on shift
To send transaction alerts, OTPs, and service notifications
To provide customer support and improve the service

3. How We Share Your Information

We do not sell your personal data. We share the minimum necessary data with regulated service providers who help us deliver the service:

Provider	Purpose
Interswitch / Quickteller	Payment collections, virtual accounts, payouts, bill payments, and identity verification
Korapay	Payment processing and USD virtual card issuing
Sudo	Naira virtual card issuing
Termii	Sending SMS one-time passwords and alerts
Google (Firebase, Play Integrity)	Push notifications and device-integrity / anti-fraud attestation
Partner banks & NIBSS	Bank account verification and settlement

We may also disclose data where required by law, regulation, court order, or a lawful request from the CBN or other competent authority, and to protect our rights or prevent fraud.

4. Data Retention

We keep your personal and KYC data for as long as your account is active and for the period required by CBN and AML regulations after closure (typically a minimum of five years). Your enrolled selfie is retained in encrypted form for ongoing identity verification. We delete or anonymise data when it is no longer required.

5. Security

Sensitive data (such as BVN, NIN, and your biometric selfie) is encrypted at rest and in transit. Access is restricted and audited. Sensitive in-app actions require a PIN, and administrative access to personal data requires multi-factor authentication. No system is perfectly secure, but we work to protect your data using industry-standard safeguards.

6. Your Rights

Subject to applicable law, you may request to access, correct, or delete your personal data, withdraw consent (for example, by turning off location sharing), or object to certain processing. You can delete your account from within the app or by contacting us. Note that we may need to retain certain records to meet legal and regulatory obligations.

7. Children

RAFA is not intended for anyone under 18. We do not knowingly collect data from children.

8. Changes to This Policy

We may update this Policy from time to time. We will post the updated version here with a new "Last updated" date, and where appropriate notify you in the app.

9. Contact Us

For privacy questions or to exercise your rights, contact us at support@rafa.ng.