1. Who we are and how to contact us
TrustMoni.com Limited (RC 9436204) is the data controller for personal information you provide when you use TrustMoni Pay. As a data controller, we decide why and how your personal information is processed, and we are responsible for keeping it secure.
Our appointed Compliance Officer, who also handles data protection matters, is:
Casmir Chidera Johnson
Chief Compliance Officer
TrustMoni.com Limited
No. 37 Inyi Street, Mgbowo, Agwu, Enugu, Nigeria
Email: info@trustmonipay.com
If you have questions about how we handle your data, or want to exercise any of your rights listed in Section 8, write to that address.
2. What information we collect
We collect different types of information depending on what you do in the app and which verification tier you complete. Here is a complete breakdown:
Information you give us directly
| Information | When we collect it |
|---|---|
| Phone number and email address | At sign-up, used to verify your identity and send OTP codes |
| Full legal name | Tier 1 verification, to open your account in your correct legal name |
| Date of birth and gender | Tier 1 verification, to confirm you are at least 18 and for identity record matching |
| Bank Verification Number (BVN) | Tier 1 verification, checked against NIBSS records |
| Selfie / liveness photo | Tier 1 and Tier 2 verification, matched against your BVN or NIN record to confirm the account belongs to you |
| National Identity Number (NIN) | Tier 2 verification, checked against NIMC records |
| Residential address and next of kin details | Tier 3 verification, required for higher account and transaction limits |
| Proof of address document (such as a utility bill or bank statement) | Tier 3 verification, reviewed manually by our team before your limit is raised |
| Bank account details | When you add a bank account for withdrawals or when a deletion request is approved |
| Transaction PIN | Set by you, stored only as a one-way cryptographic hash, never readable by anyone |
Information we collect automatically
| Information | Why we collect it |
|---|---|
| Device type, model, and operating system | To optimise the app experience for your device |
| App version | To confirm you are on a supported version with current security patches |
| Login timestamps and IP address | To detect login patterns that may indicate unauthorised access |
| Push notification token | To deliver transaction alerts, security alerts, support replies, and service announcements to your device |
| Full transaction history | Required for your own account statements and for regulatory reporting |
| In-app error and crash logs | To identify and fix technical issues and improve the service |
Information from third parties
When you provide your BVN or NIN, we query NIBSS or NIMC to retrieve your registered name, date of birth, and photo for matching. We do not store your BVN or NIN as plain text anywhere in our systems. Both are encrypted immediately upon receipt.
3. Why we collect it and our legal basis
Under the Nigeria Data Protection Act (NDPA) 2023, we must have a lawful basis for processing your personal information. We do not collect anything we do not actually need. Here is the purpose and legal basis for each category:
| Purpose | Legal basis |
|---|---|
| Verifying your identity before opening your account or raising your tier | Legal obligation, required by CBN KYC guidelines and AML regulations |
| Processing payments, transfers, and bill payments you initiate | Performance of contract, you instruct us to move money on your behalf |
| Fraud monitoring and suspicious transaction detection | Legal obligation, required by the Money Laundering (Prevention and Prohibition) Act 2022 and NFIU reporting rules |
| Sending transaction alerts, security alerts, and OTP verification codes | Performance of contract, necessary to operate your account securely |
| Keeping your transaction records | Legal obligation, CBN requires financial records to be retained for a minimum of 5 years |
| Improving the app and fixing technical issues | Legitimate interest, we have a genuine business interest in providing a reliable service |
| Sending service announcements or policy updates by email or push notification | Legitimate interest, you need to know about changes that affect your account |
| Sending promotional messages about new features | Consent, only where you have not opted out, and you can request this to stop at any time |
We do not use your data for automated decisions that produce significant legal effects on you, except where fraud prevention systems require it. In those cases, you have the right to request a human review of any decision that affected your account.
4. How your information is protected
Security is built into TrustMoni Pay from the start, not added later. Here is specifically what we do:
- BVN and NIN: Encrypted at rest using AES-256 encryption. Never stored in plain, readable text anywhere in our systems.
- Passwords and PINs: One-way hashed with a unique salt per user. Even our own database administrators cannot see what your PIN is.
- Data in transit: All communication between the app and our servers uses TLS. Your data is encrypted every time it moves over the internet.
- Access control: Only staff who need your data to do their specific job can access it. All access is logged and periodically reviewed.
- Infrastructure security: Our servers are hosted on hardened infrastructure with regular security patching, vulnerability scanning, and intrusion monitoring.
- Transaction PIN protection: Repeated incorrect PIN attempts temporarily lock that check, protecting your funds even if your device itself is unlocked by someone else.
Selfie photos captured during verification are used for identity matching and are retained for as long as your account is active, since they form part of your KYC record. Once an account deletion request is approved, they are removed as part of that process, described in Section 9 below.
6. Where your data is stored
In line with CBN data residency expectations and the NDPA 2023, we prioritise storing your personal and financial data within Nigeria and take steps to keep it there as regulatory requirements evolve. Where any data is processed through an infrastructure provider located outside Nigeria, we put appropriate safeguards in place, including contractual clauses requiring that provider to protect your data to a comparable standard.
Your account and transaction data is hosted on servers operated by our infrastructure provider. Bill payment processing and virtual account services are provided by PayVessel (Nex Panther Technologies Limited), a payment solutions company operating under Nigerian law and CBN regulations.
7. How long we keep your information
We keep your information for as long as your account is active and, after you close it, for as long as Nigerian law requires. In practice:
- Transaction records: Minimum 5 years after the transaction date, as required by CBN regulations and the Money Laundering (Prevention and Prohibition) Act 2022. This applies even after an account deletion request is approved, as described in Section 9.
- KYC information including selfie photos, BVN, and NIN: For the duration of your account. Where your account is closed through the standard deletion process, these are removed from your account record at that point, while the fact that verification took place is kept as part of our audit trail for the period regulation requires.
- Login and device logs: 12 months from creation, unless they are relevant to an active fraud investigation or legal matter.
- Support and complaint records: 3 years from the date the matter was resolved.
- Marketing preferences: Until you ask us to stop or close your account.
When a retention period expires, we securely delete or anonymise the data. We do not keep anything longer than we have a reason to.
8. Your rights under Nigerian law
The Nigeria Data Protection Act (NDPA) 2023 gives you real rights over your personal information. Here is what they are and how to use them:
- Right to access: You can request a copy of the personal information we hold about you. We will provide it within 30 days of receiving your request.
- Right to correction: If anything we hold about you is wrong or out of date, you can ask us to correct it and we will do so promptly.
- Right to deletion: You can request deletion of your personal data directly from the app, described in Section 9. We will remove your personal identifying information where we are not legally required to keep it. CBN requires us to retain transaction records for at least 5 years regardless of a deletion request, so those remain, no longer linked to your name once your request is approved.
- Right to data portability: You can ask us to provide your personal data in a structured, machine-readable format so you can transfer it to another service provider. You can also request an account statement for any period directly from the app, sent to your registered email.
- Right to object: You can object to us processing your data for direct marketing at any time. You can also object to processing based on legitimate interest, and we will stop unless we can show a compelling reason to continue.
- Right to withdraw consent: Where processing is based on your consent, such as promotional messages, you can withdraw it at any time by contacting us. Withdrawal does not affect anything we did before you withdrew.
- Right to human review: If an automated system made a decision about your account, for example a fraud flag that restricted access, you have the right to request a human review and, where appropriate, an override of that decision.
To exercise any of these rights, email info@trustmonipay.com with the subject "Data Rights Request". We will respond within 30 days. We may need to verify your identity before processing the request.
9. Deleting your account
You can request deletion of your account directly from the app, under Profile. Because this is a financial account, the request goes through a short review before it is completed, rather than deleting anything the moment you ask.
- Your wallet balance must be at zero before a request can be submitted. If you still have funds, move them out first, then request deletion.
- You confirm the request with your transaction PIN, the same protection used for any sensitive account action.
- Your request is reviewed by our team, which can take a few days. You can cancel a pending request yourself at any time before it is reviewed.
- If approved, your name, email, phone number, BVN, NIN, address, and next of kin details are permanently removed from your account record. Your login is disabled immediately. You will receive a confirmation once this is complete.
- If declined, your account remains fully active and unaffected, and we will tell you why.
As explained in Section 7, your transaction history is not deleted as part of this process. CBN regulation requires us to retain it for a minimum of 5 years regardless of your request, but once your request is approved, that history is no longer linked to your identity in our systems.
10. Data breaches
No system is completely immune to risk. If a breach occurs that is likely to affect your rights or freedoms, we will:
- Notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware, as required by the NDPA 2023 and the NDPC General Application and Implementation Directive (GAID) 2025.
- Notify you directly by email and, where the risk to you is high, by push notification or SMS, without unnecessary delay.
- Tell you clearly what happened, what data was affected, what we have done to contain it, and what steps you can take to protect yourself.
We maintain an internal data breach register and carry out a post-incident review after every security event, regardless of how minor it appears.
12. Children
TrustMoni Pay is not designed for or directed at anyone under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe a child has opened an account with us, please contact us immediately at info@trustmonipay.com and we will close the account and remove the associated personal data.
13. Changes to this policy
We may update this policy from time to time. If we make a material change, one that reduces your rights or significantly alters how we use your data, we will notify you through the app and by email at least 30 days before the change takes effect.
For minor updates, such as adding clarity to an existing section or correcting a reference, we will update the effective date at the top of this page without a formal advance notification.
We recommend checking this page periodically so you are always aware of how we handle your information.
14. How to complain
If you are unhappy with how we have handled your personal information, please come to us first. Email info@trustmonipay.com with the subject "Privacy Complaint" and allow us 14 working days to respond.
If you are not satisfied with our response, or if you believe we are not processing your data lawfully, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC):
Nigeria Data Protection Commission (NDPC)
Website: ndpc.gov.ng
Email: info@ndpc.gov.ng