01Overview
Olapoint ("we", "us") operates a VTU platform at olapoint.com providing airtime, data, electricity bill payments, cable TV subscriptions, and exam result pins in Nigeria, accessible via web, mobile browser and our Telegram bot.
By creating an account or using the platform you agree to this policy. If you do not agree, please stop using the platform.
Effective Date: January 1, 2025. Applies to all users individuals, resellers, and API partners.
02Information We Collect
What you give us directly:
- Account data: Name, email address, phone number, and password on signup.
- Transaction data: Phone numbers, meter numbers, or smartcard numbers you enter when making a purchase.
- Payment data: Bank or card details for wallet funding processed by our licensed payment partner, never stored raw on our servers.
- Identity data: Government ID, BVN, or NIN where required by Nigerian financial regulations for certain account tiers.
- Support messages: Any correspondence you send to our team, including Telegram chats.
- Transaction PIN: Stored as a one-way hash we can never read it.
Collected automatically:
- IP address, browser type, device type, and operating system.
- Pages visited, features used, and session activity.
- Server logs with request timestamps and response codes.
- Authentication tokens and session cookies (see Section 9).
03How We Use Your Data
| Purpose | Data Used |
|---|---|
| Account creation & login | Name, email, phone, password, PIN |
| Processing VTU transactions | Recipient identifiers, wallet balance, transaction history |
| Wallet funding | Payment details (handled by third-party processor) |
| Fraud detection & security | IP address, device data, login history, transaction patterns |
| Customer support | Account details, transaction records, messages |
| Receipts & notifications | Email address, phone number, transaction details |
| Legal & regulatory compliance | Identity data, transaction records, IP logs |
| Platform analytics (anonymised) | Aggregated, non-identifiable usage statistics |
| Marketing (with consent only) | Email address, phone number |
We do not sell your data, use it for targeted advertising, or share it with advertisers.
04Legal Basis for Processing
Our processing is grounded in the Nigeria Data Protection Act 2023 (NDPA) and the NDPR:
- Contract performance: To deliver the services you request and maintain your account.
- Legal obligation: To comply with CBN KYC and anti-money laundering (AML) requirements.
- Legitimate interests: To detect fraud and secure the platform.
- Consent: For marketing only you may withdraw at any time.
06Data Retention
| Data Type | Retention Period |
|---|---|
| Account registration data | Duration of account + 2 years after closure |
| Transaction records | 7 years (Nigerian financial regulations) |
| KYC / identity data | 7 years from verification date |
| Payment records | 7 years |
| Support communications | 2 years from last interaction |
| Server & access logs | 90 days (rolling) |
| Marketing consent records | Until consent withdrawn + 1 year |
After retention periods expire, data is securely deleted or anonymised.
07Security
- All data in transit is encrypted with TLS 1.2+.
- Sensitive data at rest is encrypted with AES-256.
- Passwords and PINs are stored as one-way bcrypt hashes unreadable by us.
- Data access is restricted to authorised staff on a strict need-to-know basis.
- Login and sensitive endpoints are rate-limited against automated attacks.
- Authentication tokens expire automatically; idle sessions are terminated.
In the event of a breach affecting your rights, we will notify you and the relevant Nigerian authorities as required by the NDPA 2023.
08Your Rights
Under the NDPA 2023 and NDPR you have the right to:
- Access request a copy of your personal data.
- Rectification correct inaccurate or incomplete data.
- Erasure request deletion, subject to legal retention obligations.
- Restriction limit how we process your data in certain circumstances.
- Portability receive your data in a structured, machine-readable format.
- Objection object to processing based on legitimate interests or for marketing.
- Withdraw consent at any time where processing is consent-based.
Email privacy@olapoint.com to exercise any right. We respond within 30 days. If unsatisfied, you may complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
10Third-Party Services
- Telecom providers (MTN, Airtel, Glo, 9mobile) airtime and data delivery.
- Electricity DISCOs (EKEDC, IKEDC, EEDC, PHEDC, others) electricity bill processing.
- MultiChoice & Startimes cable TV subscription renewals.
- WAEC / NECO exam result pin validation and delivery.
- Payment gateways CBN-licensed processors for wallet funding.
- Email delivery & Telegram for receipts, OTPs, and account alerts.
- Cloud infrastructure servers with standard security controls.
We do not embed social media pixels or advertising networks on our platform.
11Children's Privacy
Olapoint is for users 18 years or older. We do not knowingly collect data from minors. If you believe a child has registered, email privacy@olapoint.com and we will delete the account promptly.
12Changes to This Policy
We may update this policy from time to time. Material changes will be communicated by updating the "Last Updated" date above, sending an email notification, and displaying a notice on the platform. Continued use after changes take effect constitutes acceptance.
13Contact Us
Questions or requests about this policy? Reach our data protection team at privacy@olapoint.com we respond within 30 days.