Privacy Policy

02Scope of This Policy

This Policy applies to everyone who downloads, registers for, or uses the Gwong app — from onboarding through to closing an account. It covers information we collect directly from you, information generated by your use of the Services, and information we receive from our banking, identity-verification and payment partners on your behalf.

It does not cover third-party websites or services you may reach through links inside the app (for example, a biller's own website) — those are governed by their own privacy policies.

03Information We Collect

We collect only what is necessary to open your account, process your transactions, keep the Services secure, and meet our regulatory obligations.

3.1 Identity & verification information

When you register, we collect the details required by CBN "Know Your Customer" (KYC) rules: your full name, date of birth, gender, phone number, email address, residential address, account type (personal or business), and either your Bank Verification Number (BVN) or National Identification Number (NIN).

To confirm you are who you say you are, we also capture a live selfie and, where applicable, an identity document, using your device's camera. This is processed through Smile Identity, our identity-verification partner — see Section 5.

3.2 Financial & transaction information

Your account number, wallet balance, and the full detail of every transaction you make — transfers, airtime, data, TV subscription and electricity payments — including the amount, the recipient or biller, and the status of the transaction. If you save a recipient or biller as a beneficiary, we keep that reference so you can reuse it.

3.3 Device & technical information

Device model and identifiers, operating system and app version, IP address, crash and performance diagnostics, and how you navigate the app. We use this to keep the app working, to debug problems, and to detect fraud.

3.4 Camera & biometric authentication

The app requests camera access for two purposes: scanning QR codes to make transfers or payments, and capturing the selfie used for identity verification described in 3.1.

If you turn on Face ID or fingerprint sign-in, authentication happens entirely on your device through your phone's own operating system. Gwong never receives or stores your fingerprint or face data — we only receive a confirmation that your device recognized you.

3.5 Information you give us directly

Anything you tell us when you contact customer support, respond to a survey, or otherwise communicate with us.

Swipe horizontally to view all columns

04How We Use Your Information

• Open and manage your account — verifying your identity and meeting CBN KYC/AML requirements before your account is activated.
• Process your transactions — transfers, airtime, data, TV and electricity payments, including confirming your identity with your transaction PIN or biometric sign-in.
• Keep Gwong secure — detecting and preventing fraud, unauthorized access, and money-laundering.
• Communicate with you — transaction alerts, account notices, and responses to your support requests.
• Improve the Services — understanding how the app is used so we can fix issues and build features people need.
• Meet legal and regulatory obligations — including reporting to the CBN, NIBSS, and other authorities where required by law.
• Send promotional messages — about new features, rewards or offers, where permitted; you can opt out at any time from the app's notification settings.

05How We Share Your Information

We do not sell your personal data. We share it only where it is necessary to provide the Services, and only with:

• Banking and payment infrastructure partners — including our core banking processor and the Nigeria Inter-Bank Settlement System (NIBSS), to move money between accounts and banks.
• Bill-payment aggregators — to complete airtime, data, TV and electricity purchases with the relevant network, cable or utility provider.
• Smile Identity, to verify your identity during onboarding, as described in Section 3.1.
• Infrastructure and analytics providers (such as Firebase/Google) — for push notifications, crash reporting and app analytics. These providers process data on our behalf and are not permitted to use it for their own purposes.
• Regulators and law enforcement — the CBN, the Nigeria Financial Intelligence Unit, courts, and other authorities, where required by law or a valid legal process.
• A successor entity — if Gwong is involved in a merger, acquisition or asset sale, in which case we'll notify you before your data is transferred and becomes subject to a different privacy policy.

06Data Security

We protect your information with technical and organizational safeguards appropriate to a regulated financial institution, including encrypting data in transit, restricting internal access to what each system and staff role needs, and monitoring for suspicious activity.

07Data Retention

We keep your information for as long as your account is active, and afterwards for as long as we are required to by CBN record-keeping and anti-money-laundering rules — generally a minimum of five years from account closure or your last transaction, whichever is later. After that, we securely delete or anonymize it, unless a longer period is required to resolve a dispute or comply with the law.

08Your Rights

Under the NDPA, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your data, subject to our regulatory retention obligations (see Section 7).
• Object to or restrict certain processing, such as marketing communications.
• Request a copy of your data in a portable format.
• Withdraw consent, where processing is based on consent, without affecting anything already done.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe we have mishandled your data.

To exercise any of these rights, contact us using the details in Section 12. We will respond within the timeframe required by law.

09Children's Privacy

The Services are intended for account holders who meet the minimum age for opening a bank account under Nigerian law. We do not knowingly collect personal data from children. If we learn that we have done so, we will delete it.

10International Transfers

Some of our infrastructure and analytics providers may process data on servers located outside Nigeria. Where this happens, we require appropriate safeguards to protect your data to a standard consistent with the NDPA, wherever it is processed.

11Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or the law. We'll update the "Last updated" date above, and where a change is material, we'll let you know in the app before it takes effect.

12Contact Us

Questions about this Policy, or requests relating to your personal data, can be sent to: