Uptech Innovations Limited (“Company”, “we”, “our”, or “us”) is committed to protecting the privacy and personal data of users of the Uptech Innovations platform (“Platform”). This Privacy Policy explains how we collect, use, store, disclose, and protect your personal data in compliance with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation 2019 (NDPR), and other applicable data protection laws.
This Policy applies to all users of our website, mobile application, and related services. By using the Platform, you consent to the collection and processing of your personal data as described in this Policy.
2. Data Controller
The Data Controller responsible for your personal data is:
Our Data Protection Officer (DPO) can be reached at support@uptechinnovations.com.
3. Personal Data We Collect
3.1 Information You Provide
Full name, email address, and phone number (during registration)
Transaction PIN and password (stored in hashed form, never in plaintext)
Company name, RC number, and contact details (for Corporate Accounts)
Phone numbers of bill payment beneficiaries
Customer support communications
3.2 Information Generated Through Use
Transaction history (service type, amount, provider, status, timestamps)
Account balances and funding history
Device information (device type, operating system, app version)
IP addresses and approximate location (derived from IP)
Login timestamps and session data
Bulk disbursement records (CSV uploads, batch status, recipient details)
3.3 Information from Third Parties
Payment verification data from Paystack (card type, last four digits, authorisation status)
Service delivery confirmations from VTU aggregators (airtime/data credit status, token numbers)
Account verification data from identity verification providers (where applicable)
3.4 Sensitive Data
We do not intentionally collect sensitive personal data such as biometric data, health information, religious beliefs, or political opinions. If we become aware that such data has been provided inadvertently, we will take steps to delete it.
4. Lawful Basis for Processing
We process your personal data on the following legal bases under the NDPA:
Consent: You consent to data processing when you create an account and accept these terms
Contractual Necessity: Processing is necessary to perform our services (e.g., executing bill payments, managing your account)
Legal Obligation: Processing is required to comply with applicable laws and regulations
Legitimate Interest: Processing is necessary for our legitimate business interests (e.g., fraud prevention, service improvement, security monitoring), provided these interests do not override your fundamental rights
5. How We Use Your Personal Data
5.1 Service Delivery
Processing bill payments, airtime purchases, data subscriptions, and other transactions
Managing your account (funding, debiting, balance tracking)
Processing bulk disbursements and corporate account operations
Generating transaction receipts and statements
5.2 Communication
Sending transaction confirmations and receipts via email
Login notification alerts for account security
Service updates, maintenance notices, and policy changes
Responding to your support requests and inquiries
5.3 Security and Fraud Prevention
Detecting and preventing fraudulent transactions and unauthorised access
Monitoring for suspicious activity and enforcing our Terms of Use
Maintaining audit trails for regulatory compliance
Cloud Providers: Cloud hosting, data storage, email delivery
All service providers are bound by data processing agreements that require them to protect your data and use it only for the purposes specified by us.
6.2 Legal and Regulatory Authorities
We respect and comply with legal obligations and may release information (including Personal Information and information about your account activities) in cooperation with a law enforcement investigation, in response to a valid legal request such as a court order or legal subpoena, as part of the process outlined by law or to defend, protect, or exercise our legal rights.
6.3 Corporate Transactions
In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction. We will notify you of any such transfer and any changes to the applicable privacy policy.
7. Data Retention
In compliance with the NDPR/NDPA data retention policy, we process your personal data for as long as necessary to fulfill the purposes for which it was collected and will retain the personal data for minimum of seven (7) years after the end of the customer relationship, or as required by applicable laws and regulations. This retention period has been established to enable us use the personal data for the necessary legitimate purposes identified, in full compliance with the legal and regulatory requirements.
8. Your Rights
Under the NDPA and NDPR, you have the following rights regarding your personal data:
Right of Access: You may request a copy of the personal data we hold about you
Right to Rectification: You may request correction of inaccurate or incomplete data
Right to Erasure: You may request deletion of your data, subject to legal retention requirements
Right to Restrict Processing: You may request that we limit the processing of your data in certain circumstances
Right to Data Portability: You may request your data in a structured, machine-readable format
Right to Object: You may object to processing based on legitimate interest
Right to Withdraw Consent: You may withdraw consent at any time, without affecting the lawfulness of prior processing
To exercise any of these rights, please contact us at support@uptechinnovations.com. We will respond to your request within thirty (30) days. We may request additional information to verify your identity before processing your request.
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
Encryption of data in transit (TLS/SSL) and at rest
Hashed storage of passwords and transaction PINs (never stored in plaintext)
Secure storage of API keys and credentials
Role-based access controls limiting employee access to personal data
Regular security assessments and vulnerability testing
Automated intrusion detection and monitoring
Account lockout mechanisms after failed login attempts
While we take all reasonable precautions, no method of transmission or storage is completely secure. In the event of a data breach, we will notify the Nigeria Data Protection Commission (NDPC) and affected individuals in accordance with the NDPA requirements.
10. Cookies and Tracking
The Platform uses essential cookies and local storage to:
Maintain your authenticated session (login state)
Store your language preferences
Remember your device for security purposes
We do not use third-party advertising or tracking cookies. We do not engage in behavioural advertising or profiling.
11. Children’s Privacy
The Platform is not intended for individuals under the age of eighteen (18). We do not knowingly collect personal data from children. If we become aware that we have collected data from a person under 18, we will promptly delete such data.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Policy on the Platform and, where practicable, by sending an email notification at least fourteen (14) days before the changes take effect. The effective date at the top of this Policy indicates the date of the most recent revision.
13. Contact Us
If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact:
General Inquiries: support@uptechinnovations.com Submit a question: Using our Contact Us form
You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data protection rights have been violated.
We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.
