Privacy policy

Last updated: 11 November 2026

This document is a draft pending legal and compliance review. It will be updated before public launch.

This privacy policy explains how Suzab ("Suzab", "we", "us") collects, uses, shares and protects your personal data when you use the Suzab mobile app, our website at suzab.com.ng and our related services (together, the "Services"). We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and other applicable laws.

1. Who we are

Suzab is the data controller responsible for your personal data. You can contact us, including our Data Protection Officer, at support@suzab.com.ng.

2. Data we collect

Information you give us

Identity and contact details: full name, date of birth, phone number, email address and residential address.
Identity verification (KYC) data: your Bank Verification Number (BVN), National Identification Number (NIN), and the details returned when we verify them, which may include your photograph.
Security credentials: your password and transaction PIN. These are stored only in encrypted or hashed form, and we can never see them.
Payment details: beneficiary names and account numbers, phone numbers you top up, meter and smartcard numbers, and similar details you enter to make a payment.
Support communications: messages, emails and call records when you contact us.

Information created when you use the Services

Account and transaction data: your account number, balance, transfers, bill payments, airtime and data purchases, card transactions, references and timestamps.
Device and technical data: device model, operating system, app version, IP address, language settings, and a device token used to send you notifications.
App usage and diagnostics: which features you use, and crash reports and performance data that help us fix problems.

Information from third parties

Identity verification services and official databases that confirm your BVN and NIN.
Banks and payment partners, when money is sent to or from your account.
Fraud prevention and compliance sources, where permitted by law.

3. Device permissions

The app asks for permission before it uses these features. You can change your choices in your device settings at any time.

Permission	Why we use it
Contacts	Only when you choose to pick a contact, for example to buy airtime for someone. Your contact list is read on your device and is never uploaded to our servers; only the number you select is used for that payment.
Fingerprint / Face ID	To let you sign in and approve actions with biometrics. Your biometric data is handled entirely by your device's operating system. We never receive or store it.
Notifications	To send transaction alerts, security notices and service updates.

4. How we use your data

To open, operate and maintain your account and provide your dedicated account number.
To process transfers, bill payments, airtime and data purchases, and card transactions.
To verify your identity and meet our know-your-customer (KYC) and anti-money-laundering obligations.
To detect, prevent and investigate fraud, unauthorised access and other illegal activity.
To send transaction alerts, security notices and important service messages.
To provide customer support and resolve complaints and disputes.
To understand how the app is used, fix errors and improve our Services.
To comply with laws, regulations, court orders and requests from regulators.

We do not use your personal data to make decisions about you based solely on automated processing that have legal or similarly significant effects, except where permitted by law (for example, automated fraud checks), and you may ask for a human review.

5. Legal basis

Under the NDPA, we rely on the following lawful bases:

Contract: to provide the Services you sign up for.
Legal obligation: to meet KYC, anti-money-laundering, tax and regulatory requirements.
Legitimate interests: to keep the Services secure, prevent fraud and improve the app, where these interests are not overridden by your rights.
Consent: for optional features such as marketing messages and device permissions. You can withdraw consent at any time.

We share personal data only where necessary, and we require every recipient to protect it. We share it with:

Banking and payment partners that hold funds, provide account numbers, and process transfers, cards and payments.
Identity verification providers that confirm your BVN and NIN.
Bill payment and airtime providers that deliver the services you buy.
Technology providers for cloud hosting, email and SMS delivery, push notifications, and analytics and crash reporting (Google Firebase).
Regulators, law enforcement and courts, such as the Central Bank of Nigeria, the Nigerian Financial Intelligence Unit and the Nigeria Data Protection Commission, where the law requires it.
Professional advisers, such as auditors and lawyers, under duties of confidentiality.
A buyer or successor, if our business is reorganised, merged or sold, subject to this policy.

We do not sell your personal data, and we do not share it with advertisers.

7. International transfers

Some of our service providers, such as Google Firebase, may process data outside Nigeria. When this happens, we transfer data only as permitted by Part VIII of the NDPA, for example where the recipient country provides an adequate level of protection or where appropriate contractual safeguards are in place.

8. How long we keep your data

Identity and transaction records: for as long as your account is open and for at least five (5) years after it is closed or after the transaction, as required by Nigerian anti-money-laundering law.
Support communications: for as long as needed to resolve your request and handle any follow-up.
Diagnostics and analytics data: for limited periods set by our providers, after which it is deleted or anonymised.

When we no longer need your data, we delete or anonymise it securely.

9. How we protect your data

We use technical and organisational measures to protect your data, including encryption in transit, encrypted storage of credentials, access controls, PIN and biometric authorisation of transactions, and monitoring for suspicious activity. No system is completely secure, so please keep your password, PIN and one-time codes private. Suzab will never ask for them.

10. Your rights

Under the NDPA, you have the right to:

be informed about how your data is used;
access the personal data we hold about you and receive a copy;
correct data that is inaccurate or incomplete;
ask us to delete your data, subject to our legal retention obligations;
restrict or object to certain processing, including processing based on legitimate interests;
receive your data in a commonly used, machine-readable format (data portability);
withdraw consent at any time, without affecting earlier processing; and
not be subject to decisions based solely on automated processing, with the safeguards described above.

To exercise any of these rights, email support@suzab.com.ng. We may need to verify your identity first, and we will respond within the time required by law. To close your account, see Delete your account.

If you are not satisfied with our response, you can complain to the Nigeria Data Protection Commission (NDPC).

11. Children

Our Services are for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us personal data, please contact us and we will delete it.

12. Marketing

We will only send you marketing messages if you have agreed to receive them. You can opt out at any time by contacting us or using the unsubscribe link in our emails. Service and security messages are not marketing and will continue while your account is open.

13. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new "Last updated" date and, for significant changes, notify you in the app or by email.

14. Contact us

For questions about this policy or your personal data, email support@suzab.com.ng. Our cookie policy explains how this website uses cookies.