Privacy Policy

This document sets out, in three parts, how Upesa ("Upesa," "we," "us," or "our") collects, uses, discloses, and protects personal data in connection with the Upesa website, mobile application - upesa.app, and related services (the "Platform"), including fiat-to-stablecoin on-ramping, stablecoin-to-fiat off-ramping, wallet infrastructure, foreign exchange (FX) services, and BackUp by Upesa. Upesa does not, as at the date of this document, issue its own proprietary stablecoin; references to stablecoins in this document are to third-party stablecoins supported on the Platform.

Part A is our comprehensive Privacy Policy. Part B is a concise Privacy Notice intended to give you an at-a-glance summary of our data practices at the point of data collection. Part C is our Cookie Policy, governing cookies and similar tracking technologies used on the Platform. Together, these documents are designed to comply with the Nigeria Data Protection Act 2023 ("NDPA"), the Nigeria Data Protection Commission's General Application and Implementation Directive 2025 ("GAID"), and, in respect of Users located in the European Union / European Economic Area, the EU General Data Protection Regulation ("GDPR").

Where a conflict arises between these Parts, the more specific provision addressing the subject matter shall prevail, and the more protective standard for the data subject shall apply where the NDPA/GAID and GDPR diverge.

This Privacy Policy applies to all personal data processed by Upesa in connection with your use of the Platform, whether you are a prospective User, a registered User, or a visitor to our website. It applies regardless of the device or channel you use to access the Platform.

Upesa is committed to processing personal data lawfully, fairly, and transparently, in accordance with the NDPA, the GAID, and, where applicable to Users located in the EU/EEA, the GDPR.

Upesa Limited, with its registered office at Ibadan, Oyo State, Nigeria, is the data controller responsible for your personal data in connection with the Platform. Where Upesa processes personal data of Users located in the EU/EEA and is required to appoint an EU representative under Article 27 GDPR, details of that representative will be published on the Platform.

Our Data Protection Officer ("DPO"), appointed in accordance with the NDPA and the GAID, can be contacted using the details in Section A15 below.

We collect the following categories of personal data, depending on your interaction with the Platform:

Identity Data: Full name, date of birth, gender, nationality, government-issued ID number and copies (e.g., National ID (NIN), international passport, driver's licence, BVN), photograph/selfie for liveness verification, proof of address.

Contact Data: Email address, phone number, residential and postal address.

Account Data: Username, password (hashed), account preferences, security questions, Recovery Options configured for BackUp by Upesa.

Financial and Transaction Data: Bank account details, card details (tokenised where applicable), transaction history, on-ramp and off-ramp amounts and currencies, wallet addresses, source-of-funds and source-of-wealth information, FX conversion records.

KYC/AML and Compliance Data: Identity verification results, sanctions and watchlist screening results, risk-scoring outcomes, politically exposed person (PEP) status, Travel Rule originator/beneficiary information exchanged with counterparty virtual asset service providers.

Technical and Device Data: IP address, device identifiers, device type and operating system, browser type, log-in timestamps, session data, crash logs.

Usage Data: Pages and features accessed, in-app navigation, click-stream data, session duration.

Communications Data: Correspondence with our support team, complaint records, survey responses, marketing preferences.

Recovery Data: Information you configure under BackUp by Upesa, including recovery contacts, recovery credentials, and records of recovery requests and Policy Engine determinations.

We do not intentionally collect special category or sensitive personal data except where strictly necessary for identity verification, fraud prevention, or as required by applicable law, and subject to appropriate safeguards.

• Directly from you, when you register, complete KYC, configure Recovery Options, contact support, or otherwise interact with the Platform;
• Automatically, through your use of the website and App (e.g., cookies, device and log data — see Part C);
• From third parties, including identity verification providers, credit reference and sanctions-screening providers, blockchain analytics providers, banking and payment partners, and counterparty virtual asset service providers exchanging Travel Rule data;
• From publicly available sources, where relevant to compliance, due diligence, or fraud prevention.

We process your personal data for the following purposes, on the following lawful bases:

Registering and administering your Account: Performance of a contract with you.

Verifying your identity (KYC) and performing due diligence: Legal obligation; performance of a contract.

Processing fiat on-ramp and off-ramp transactions and FX conversions: Performance of a contract; legal obligation.

Complying with AML/CFT/CPF laws, sanctions screening, and Travel Rule obligations: Legal obligation.

Providing and administering BackUp by Upesa, including Policy Engine recovery determinations: Performance of a contract; consent (where BackUp by Upesa is optional); legal obligation (once compulsory, to the extent mandated).

Detecting, investigating, and preventing fraud, security incidents, and financial crime: Legal obligation; legitimate interests.

Providing customer support and responding to enquiries: Performance of a contract; legitimate interests.

Improving the Platform, including analytics and product development: Legitimate interests; consent (for non-essential cookies — see Part C).

Sending service communications: Performance of a contract; legal obligation.

Sending marketing communications: Consent (opt-in), withdrawable at any time.

Complying with regulatory reporting, audits, and requests from competent authorities: Legal obligation.

Establishing, exercising, or defending legal claims: Legitimate interests; legal obligation.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and interests, and we can provide further information about this assessment on request.

We use automated tools, including rules-based systems and risk-scoring models, to support sanctions screening, fraud detection, transaction risk assessment, and Policy Engine recovery determinations under BackUp by Upesa. Certain decisions, such as a transaction being blocked, delayed, or flagged for manual review pending compliance checks, or a recovery request being escalated for further verification, may be made using automated processing. Where a decision produces legal or similarly significant effects and is based solely on automated processing, you have the right to request human review, to express your point of view, and to contest the decision, as further described in Section A9.

We may disclose personal data to the following categories of recipients, subject always to appropriate contractual and technical safeguards:

• Regulators and public authorities, including the NDPC, the Securities and Exchange Commission, the Central Bank of Nigeria, law enforcement agencies, and courts, where required by law or a valid legal request;
• Banking, payment, and FX partners involved in processing your fiat on-ramp and off-ramp transactions;
• Counterparty virtual asset service providers, for the purpose of Travel Rule originator/beneficiary information exchange;
• Identity verification, sanctions-screening, and blockchain-analytics service providers engaged to support our compliance obligations;
• IT infrastructure, cloud hosting, and customer support service providers acting as our data processors under written data processing agreements;
• Professional advisers, including legal, tax, audit, and insurance advisers;
• A successor entity in connection with a merger, acquisition, restructuring, or sale of assets, subject to equivalent confidentiality and data protection commitments.

We do not sell your personal data to third parties for their own independent marketing purposes.

Where we transfer personal data outside Nigeria (for example, to cloud service providers, identity verification vendors, or counterparty virtual asset service providers located abroad), we do so only where the destination country or receiving organisation offers an adequate level of protection comparable to that guaranteed under the NDPA, or where another lawful transfer mechanism recognised under the NDPA and the GAID applies, including standard contractual clauses, binding corporate rules, an approved certification mechanism, your explicit informed consent, or another statutory derogation (such as necessity for the performance of a contract with you).

Where personal data of Users located in the EU/EEA is transferred outside the EU/EEA, we rely on adequacy decisions, the European Commission's Standard Contractual Clauses, or another valid transfer mechanism recognised under the GDPR, together with supplementary measures where appropriate.

We maintain records of the countries to which personal data is transferred and the safeguards applied, and can provide further information on request, subject to confidentiality and security considerations.

Subject to applicable exceptions under the NDPA, the GAID, and (for EU/EEA Users) the GDPR, you have the following rights in respect of your personal data:

• Right of access to confirmation of whether we process your personal data, and to a copy of it;
• Right to rectification of inaccurate or incomplete personal data;
• Right to erasure ("right to be forgotten"), subject to our legal and regulatory retention obligations (see Section A10);
• Right to restriction of processing in certain circumstances;
• Right to data portability, in respect of personal data you have provided to us and which is processed by automated means on the basis of consent or contract;
• Right to object to processing based on legitimate interests or for direct marketing purposes;
• Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• Right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, save as permitted by law;
• Right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or, for EU/EEA Users, with the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement.

You may exercise these rights by contacting our DPO using the details in Section A15. We will respond within the timeframes prescribed by the NDPA, the GAID, and, where applicable, the GDPR, and may request additional information to verify your identity before acting on a request.

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, AML/CFT, and regulatory reporting requirements. In general, KYC, transaction, and Travel Rule records are retained for a minimum period following termination of your relationship with Upesa, as prescribed by applicable AML/CFT legislation and regulatory guidance (typically not less than five (5) years), unless a longer period is required by law — for instance the seven (7) years requirement under the Nigeria Tax Administration Act (NTAA 2025) specifically the fifth schedule Para 5(f) for virtual assets.

Recovery Data configured under BackUp by Upesa is retained for as long as your Account remains active and for a reasonable period thereafter to resolve any pending recovery requests, disputes, or regulatory enquiries.

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction, including encryption of data in transit and at rest, access controls, network monitoring, and the internal MultiSig controls governing the Policy Engine described in our Terms of Use. No system is completely secure, and we cannot guarantee the absolute security of information transmitted to or stored on the Platform.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the NDPC without undue delay in accordance with the notification timeframe prescribed by the NDPA and the GAID. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay, describing the nature of the breach and the measures taken or proposed to address it. Where applicable, we will apply equivalent notification obligations under the GDPR in respect of EU/EEA Users.

The Platform is not directed at, and is not intended for use by, individuals under 18 years of age, and we do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will take steps to delete such data promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services (including the transition of BackUp by Upesa to a compulsory feature), or applicable law. We will notify you of material changes through the Platform, by email, or other reasonable means, and will indicate the date the revised Privacy Policy takes effect. Your continued use of the Platform after that date constitutes your acknowledgment of the revised Privacy Policy.

If you have questions about this Privacy Policy or wish to exercise your data subject rights, please contact our Data Protection Officer at:

You may also lodge a complaint directly with the Nigeria Data Protection Commission (NDPC), or if you are located in the EU/EEA, with your local supervisory authority.

This Privacy Notice is a short-form summary provided at the point personal data is collected (for example, during registration or KYC verification). It supplements, and should be read together with, our full Privacy Policy in Part A, which contains complete details of our data processing practices.

Upesa is the data controller of your personal data. Full contact details are set out in Section A15.

Identity and KYC data (name, ID, photo, address): To verify your identity and open your Account. Legal basis: Legal obligation; contract.

Financial and transaction data (bank details, on-ramp/off-ramp records, wallet addresses): To process your fiat-to-stablecoin and stablecoin-to-fiat transactions. Legal basis: Contract; legal obligation.

Travel Rule originator/beneficiary data: To comply with FATF Recommendation 16 and Nigerian VASP requirements. Legal basis: Legal obligation.

Recovery Data (BackUp by Upesa): To operate the account recovery service and Policy Engine. Legal basis: Contract; consent; legal obligation (once compulsory).

Device and usage data: To secure the Platform, prevent fraud, and improve our Services. Legal basis: Legitimate interests; consent (cookies).

Communications data: To respond to your enquiries and provide support. Legal basis: Contract; legitimate interests.

Marketing preferences: To send you product updates, if you opt in. Legal basis: Consent.

Regulators (including the NDPC, SEC, and CBN), banking and payment partners, counterparty virtual asset service providers (for Travel Rule purposes), identity verification and sanctions-screening providers, IT and cloud service providers, and professional advisers. We do not sell your personal data.

Your personal data is primarily processed and stored in Nigeria. Where it is transferred abroad (for example, to a cloud provider or a counterparty VASP), we apply safeguards recognised under the NDPA, the GAID, and, where relevant, the GDPR, as detailed in Section A8.

We generally retain KYC, transaction, and Travel Rule data for a minimum of seven (7) years after your relationship with us ends, in line with AML/CFT requirements, or longer if required by law. See Section A10 for full details.

You can ask us to give you a copy of your data, correct it, delete it (subject to legal retention obligations), restrict or object to certain processing, move it elsewhere, and withdraw any consent you've given — at any time and free of charge, using the contact details in Section A15. You can also complain to the NDPC or, if you're in the EU/EEA, your local data protection authority. Full details of these rights are set out in Section A9 of the Privacy Policy.

Cookies are small text files placed on your device when you visit our website or use our App. Similar technologies include local storage, SDKs, pixels, and mobile device identifiers (collectively, "Cookies" for purposes of this Cookie Policy). Cookies allow the Platform to recognise your device, remember your preferences, and collect information about how you use the Platform.

Strictly Necessary: Enable core functions such as security, login sessions, load balancing, and fraud prevention. The Platform cannot function properly without these. Consent not required — exempt where strictly necessary for security, stability, or accessibility.

Functional: Remember your preferences (e.g., language, display settings) to enhance your experience. Consent required.

Analytics / Performance: Help us understand how Users interact with the Platform so we can improve it (e.g., page views, feature usage, crash reporting). Consent required.

Marketing / Advertising: Used to deliver relevant marketing communications and measure their effectiveness, where you have opted in to marketing. Consent required.

In accordance with Article 19 of the GAID, we obtain your prior, freely given, specific, and informed opt-in consent before placing any Cookie on your device other than Cookies that are strictly necessary for the security, stability, or accessibility of the Platform. We do not use pre-ticked boxes or imply consent from continued browsing. Where you are located in the EU/EEA, we apply equivalent consent standards required under the GDPR and applicable e-privacy laws.

When you first visit the website or open the App, you will be shown a clear and visible cookie banner explaining what Cookies we use, why, who deploys them (including any third parties), and how you can accept, reject, or customise your preferences.

You will not be required to scroll or search to find the cookie banner, and non-essential Cookies will not be set until you provide consent.

You may withdraw or change your consent at any time through the cookie preference centre available on the Platform, or through your browser or device settings. Withdrawing consent will not affect the lawfulness of any processing carried out before withdrawal.

We keep a record of the consent choices you make, including the date and scope of consent, in order to demonstrate compliance with applicable law.

Some Cookies on the Platform may be set by third-party service providers, such as analytics providers, fraud-prevention and blockchain-analytics vendors, and (where applicable) marketing platforms. These third parties may combine information collected via Cookies with other information they hold. We require such third parties to only process this data in accordance with our instructions and applicable data protection law.

In addition to the controls provided on the Platform, most web browsers and mobile operating systems allow you to manage or block Cookies through their settings. Please note that blocking strictly necessary Cookies may affect the availability or functionality of certain features of the Platform.

We may update this Cookie Policy from time to time to reflect changes in the Cookies and similar technologies we use, or to comply with changes in applicable law. Material changes will be notified through the Platform, and, where required, we will seek renewed consent.

For questions about this Cookie Policy, please contact our Data Protection Officer using the details in Section A15 of the Privacy Policy.