GlobbaPayLegal

Legal

Privacy Policy

Last updated 25 September 2026 · Globba Technologies Limited (RC9856238)

In short

We collect the data needed to run GlobbaPay, verify identities, keep accounts secure, and meet our legal obligations. This includes identity documents and a selfie during verification.

We share data only with the partners and providers that help deliver the Services, and with authorities where the law requires. We never sell it. You can reach us at privacy@globbapay.com.

1.Who we are

GlobbaPay is a product of Globba Technologies Limited (“Globba”, “we”, “us”, or “our”), a company incorporated in Nigeria with registration number RC9856238 and its registered office at Plot 75, Jubilation Bethel Estate, Lokogoma, Abuja, FCT, Nigeria.

This Privacy Policy explains how we handle personal data when you visit globbapay.com, use the GlobbaPay Personal app or the GlobbaPay Business dashboard, or use our APIs. For these activities we are the data controller, and we process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and other applicable data protection laws.

Some businesses use our APIs to onboard and serve their own customers. In that case, the business decides how its customers’ data is used, and we process that data on the business’s behalf and on its instructions. If you are a customer of one of those businesses, please read that business’s privacy notice as well.

For any question about this policy or your personal data, contact privacy@globbapay.com.

2.The personal data we collect

Information you give us

IdentityFull name, date of birth, nationality.
ContactEmail address, phone number, residential address.
Account and securityPassword (stored only in hashed form), transaction PIN, two-factor authentication settings.
VerificationBank Verification Number (BVN), passport or other government ID number, images of identity documents, selfie and face images, and proof-of-address documents.
Business informationCompany name, registration number and documents, business address, industry, source of funds, and details of directors and ultimate beneficial owners (names, dates of birth, nationality, ownership).
Financial and transactionBalances, transaction history, recipients’ names and bank details, card details, and deposit and payout records.
CommunicationsMessages you send us, support requests, and complaints.

Information we collect automatically

  • Device and usage data, such as IP address, browser and device type, pages visited, and approximate location derived from your IP address.
  • Security data, such as sign-in times, device information, and records of sensitive actions, which we use to protect your account.
  • Information from cookies and similar technologies. See section 10.

Information from other sources

  • Identity verification, document verification, and fraud-prevention providers. This includes the results of checks against official records, such as BVN, passport, and company registries.
  • Screening providers, for results of sanctions, politically exposed persons (PEP), and adverse media screening.
  • Our financial and payment partners, about transactions and accounts they provide to you.
  • Businesses that onboard you through our APIs.

3.Selfies, liveness, and face matching

To confirm that you are a real person and that you are the owner of the identity document you provide, we ask you to use your device’s camera during verification.

  • The liveness check, in which you follow simple movements such as blinking or turning your head, is analysed on your device, in your browser.
  • We capture a selfie and compare it with the photo on your identity document or official record, using our identity verification provider.
  • We use face images and the results of these checks only for identity verification, fraud prevention, and meeting our legal obligations. We never use them for advertising, and we never sell them.
  • We ask for your explicit consent before capturing face images. We keep them only for as long as we need them for these purposes and for our legal record-keeping duties (see section 7).

4.How we use personal data, and why

We only use personal data where we have a lawful basis under the NDPA. The main purposes and bases are:

Creating and running your account and providing the ServicesPerformance of our contract with you.
Verifying your identity or business (KYC/KYB), and sanctions, PEP, and adverse media screeningLegal obligation, and our legitimate interest in preventing financial crime. Explicit consent for face images.
Processing payments, conversions, and other transactions with our partnersPerformance of our contract with you. Legal obligation.
Detecting and preventing fraud, and securing accountsLegitimate interests (protecting you, us, and our partners). Legal obligation.
Record-keeping, reporting, and responding to regulators and law enforcementLegal obligation.
Customer support and complaintsPerformance of our contract with you. Legitimate interests.
Improving the Services, using aggregated analyticsLegitimate interests (understanding how the Services are used).
Product updates and marketing messagesConsent, which you can withdraw at any time. We send service messages that you need to receive regardless of your marketing preferences.

Some identity and fraud checks are automated. If an automated check leads to a decision that significantly affects you, such as declining your application, you can ask for a person to review it (see section 9).

5.Who we share personal data with

We do not sell personal data. We share it only where needed for the purposes above, with:

  • Financial and payment partners that provide the regulated services made available through GlobbaPay, such as accounts, transfers, conversions, and cards.
  • Identity verification, document verification, screening, and fraud-prevention providers.
  • Service providers that host and run our platform, including cloud hosting, databases, analytics, and communications, under contracts that require them to protect the data and use it only on our instructions.
  • Professional advisers such as lawyers, auditors, and insurers.
  • Regulators, law enforcement, courts, and other authorities, where the law requires or permits it.
  • A business that onboarded you through our APIs, about the services you use through that business.
  • A buyer or successor, if our business or assets are reorganised, merged, or sold. Your data would stay protected under this policy.

6.International transfers

Some of our partners and service providers are located, or store data, outside Nigeria. When we transfer personal data outside Nigeria, we do so only as the NDPA permits. For example, we transfer it to countries with adequate protection, or under appropriate safeguards such as contractual commitments that protect your data to the standard required by law.

7.How long we keep personal data

We keep personal data for as long as your account is open and as long as we need it for the purposes in this policy. Anti-money-laundering and financial record-keeping laws require us to keep identity verification and transaction records for a minimum period after our relationship ends, generally at least five years, or longer where the law requires.

When we no longer need personal data, we delete it or anonymise it so that it can no longer identify you.

8.How we protect personal data

We use technical and organisational measures to protect personal data, including:

  • encryption of data in transit;
  • access controls that limit personal data to the people and systems that need it;
  • keeping authentication tokens on our servers rather than in your browser;
  • transaction PINs, re-authentication, and two-factor authentication for sensitive actions; and
  • monitoring for suspicious activity.

No system is completely secure. If you think your account or data has been compromised, contact us immediately at hello@globbapay.com. Where the law requires, we will notify you and the Nigeria Data Protection Commission of a personal data breach.

9.Your rights

Under the NDPA, and subject to certain exceptions, you have the right to:

  • be informed about how we use your personal data;
  • access the personal data we hold about you and receive a copy;
  • have inaccurate or incomplete data corrected;
  • have your data deleted, where we no longer have a lawful reason to keep it;
  • restrict or object to certain processing, including processing based on our legitimate interests;
  • receive your data in a portable format;
  • withdraw your consent at any time, without affecting processing that has already taken place; and
  • not be subject to a decision based solely on automated processing that significantly affects you, and to ask for a person to review it.

To exercise any of these rights, email privacy@globbapay.com. We may need to confirm your identity before we act on your request, and we will respond within the time the law requires. Some data must be kept to meet legal obligations even if you ask us to delete it, such as identity verification and transaction records.

If you are unhappy with how we have handled your personal data, please contact us first so we can put it right. You also have the right to complain to the Nigeria Data Protection Commission (NDPC). If you live in the United Kingdom or the European Economic Area, you may also have rights under the UK or EU GDPR and can complain to your local data protection authority.

10.Cookies and similar technologies

  • Strictly necessary cookies keep you signed in securely and protect your session. The Services cannot work without them.
  • Browser storage remembers where you are in the app during a session, such as a form you have started.
  • We use aggregated, cookie-free analytics to understand which pages are visited, so we can improve the site.

We do not use advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings, but if you block strictly necessary cookies, you will not be able to sign in.

11.Children

GlobbaPay is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact privacy@globbapay.com and we will delete it.

12.Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new “Last updated” date. If a change is material, we will tell you by email or in the app before it takes effect.

13.Contact us

Globba Technologies Limited (RC9856238), Plot 75, Jubilation Bethel Estate, Lokogoma, Abuja, FCT, Nigeria. Email privacy@globbapay.com for privacy and data protection matters. See also our Terms of Service.