Flopay ("Flopay", "we", "us", or "our") is a revenue collection and payments platform owned and operated by I-Tech Platform Limited, a company incorporated in the Federal Republic of Nigeria with its registered office at 10th Floor, Unity Bank Building, Central Business District, Abuja, FCT, Nigeria.
We are committed to protecting the privacy and personal data of everyone who interacts with us. This Policy applies to:
We refer to the Website, the Web App, and the Mobile App together as the "Services." The Web App and the Mobile App are where revenue collection and payment data is processed, and we refer to them together as the "Platform."
This Policy covers everyone who interacts with us, including visitors to the Website, Organisations that use Flopay to collect revenue, Payers who make payments through Flopay, and Agents who facilitate transactions on the Platform.
We handle personal data in accordance with the Nigeria Data Protection Act, 2023 (the "NDPA"), the General Application and Implementation Directive, 2025 ("GAID") issued by the Nigeria Data Protection Commission ("NDPC"), and other applicable law, including financial services regulations.
Where we act as a Data Processor. When an Organisation uses Flopay to collect revenue, invoice, or manage payments from its Payers, the Organisation is the Data Controller for that Payer data. The Organisation determines what data is collected and the purposes for which it is used. I-Tech Platform Limited acts as a Data Processor, processing such data only to operate the Platform and facilitate transactions on the Organisation's behalf.
Where we act as a Data Controller. We act as a Data Controller for personal data we collect and decide the use of directly, including account registration data for Organisations, Payers, and Agents; technical and usage data collected through the Services; and data relating to customer support, marketing, and platform security.
4.1Account and registration data (we are Controller)
When you register for a Flopay account (as an Organisation administrator, Payer, or Agent), we collect information such as your name, email address, phone number, and login credentials.
4.2Identity verification data (we are Controller / Processor)
To comply with financial regulations and prevent fraud, we collect identity verification information, which may include your Bank Verification Number (BVN), National Identification Number (NIN), date of birth, and government-issued identification.
4.3Payment and transaction data (we are Processor on behalf of Organisations, Controller for platform operations)
We process data relating to transactions made through the Platform, including bank account details, payment amounts, transaction references, invoice details, payment history, and bank branch information associated with an Organisation.
4.4Sensitive personal data (we are Processor / Controller depending on context)
Depending on the features used, the Platform may process biometric data (such as fingerprint authentication for secure sign-in) and financial account information. We apply heightened safeguards to such data as required under the NDPA.
4.5Usage and technical data (we are Controller)
When you use the Services, we automatically collect technical information such as IP address, device and browser type, operating system, pages or screens viewed, access times, and diagnostic data.
4.6Mobile application data (we are Controller)
When you use the Mobile App, we may collect mobile device identifiers, app version, crash and performance data, and push notification tokens (so we can send you alerts such as payment confirmations or invoice notifications). With your permission, the Mobile App may access certain device features, including biometric authentication (to enable secure sign-in) and camera access (to upload documents or receipts). You can manage or revoke these permissions at any time in your device settings, although some features may not work without them.
4.7Communications and support data (we are Controller)
When you contact us for support or other enquiries, we collect the content of your communications and any information you choose to provide.
Under the NDPA, we (or the relevant Organisation, where they are the Controller) rely on one or more of the following lawful bases to process personal data:
Where we rely on consent, you may withdraw it at any time (see Section 9). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
As a Controller, we use personal data to:
As a Processor, we use personal data within the Platform solely to deliver the revenue collection and payment services that Organisations have configured.
We do not sell personal data. We may share it with:
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, accidental loss, or destruction. These include encryption in transit and at rest, access controls and role-based permissions, transaction PINs and biometric authentication options, network security controls, and monitoring. No method of transmission or storage is completely secure, but we work continuously to protect the data entrusted to us. In the event of a personal data breach that meets the relevant threshold, we will notify the NDPC and affected individuals as required under the NDPA.
Subject to the conditions and exemptions in the NDPA, you have the right to:
To exercise these rights, contact us using the details in Section 12. If your transaction relates to a specific Organisation, certain requests regarding that transaction data may need to be directed to that Organisation in the first instance, as they may be the Data Controller for that information. We will respond within the timeframe required by the NDPA and may need to verify your identity before acting.
You can request deletion of your Flopay account and associated personal data at any time through the app's Settings menu or by contacting us at info@itechplatform.net. On a verified request, we will deactivate your account and delete your personal data from our active systems, except where we are required to retain certain records (such as transaction history) to comply with financial, tax, anti-money laundering, or other legal obligations. Any retained data will be kept securely and used only for those compliance purposes.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, financial regulatory, tax, or anti-fraud requirements. Transaction records may be retained for extended periods as required under applicable financial services and tax laws, even after an account has been deleted. When personal data is no longer required, we securely delete or anonymise it.
If you have questions about this Policy or wish to exercise your rights, please contact:
I-Tech Platform Limited
Email: info@itechplatform.net
Address: 10th Floor, Unity Bank Building, Central Business District, Abuja, FCT, Nigeria
Phone: +234-8036157642
If you believe we have not handled your personal data in accordance with the law, we encourage you to contact us first so we can address your concern. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC):
Nigeria Data Protection Commission (NDPC)
Website: ndpc.gov.ng
Email: info@ndpc.gov.ng
Address: No. 12, Dr. Clement Isong Street, Asokoro, Abuja.
We may update this Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you. We encourage you to review this Policy periodically.
This Policy is governed by the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act, 2023, and is subject to the regulatory oversight of the Nigeria Data Protection Commission.
