Privacy policy

UltraPay is operated by UltraPay Microfinance Bank (UPMFB), a microfinance bank licensed by the Central Bank of Nigeria, with deposits insured by the NDIC. UltraPay Microfinance Bank is the data controller for the personal data described in this policy and is the publisher of the UltraPay Android application.

Questions about this policy, or any request about your data, should go to support@ultrapaymfb.com.ng or 0700 000 0000.

• Identity data: your name, date of birth, gender, nationality, and your BVN or NIN, collected to satisfy CBN KYC requirements.
• Business data (business accounts): registration number, TIN, and details of directors and signatories.
• Contact data: your email address, phone number and postal or residential address.
• Account and transaction data: your account numbers, balances, transfers, bill payments and statements.
• Security data: a one-way hash of your transaction PIN, and a record of security events such as sign-ins, failed PIN attempts and password changes.
• Device and technical data: your device model, operating system and app version, IP address, and — in the Android app — a push notification token so we can deliver alerts to your device.
• Images you choose to submit: photographs of identity or registration documents, and a profile photo, where you use the camera or photo library to provide them.

We do not collect your location, your contacts, your calendar, your SMS messages or your call logs, and the app does not read files on your device other than an image you explicitly choose.

• To open and operate your account and to carry out the transactions you instruct.
• To verify your identity and to meet our legal obligations on KYC, anti-money-laundering and sanctions screening.
• To detect, investigate and prevent fraud and unauthorised access.
• To communicate with you about your account, including transaction alerts and one-time passwords.
• To keep the records that banking regulation requires us to keep, and to diagnose faults and improve the service.

We rely on the performance of our contract with you, our legal obligations as a licensed bank, and our legitimate interest in preventing fraud, as the bases for this processing.

We do not sell your personal data, we do not share it with advertisers, and we do not use it to build advertising profiles. UltraPay contains no advertising and no third-party analytics or tracking software.

The app requests a permission only at the point you use the feature that needs it, and you can refuse or later withdraw any of them in Android Settings. The app remains usable without them, except where noted.

• Notifications — to deliver transaction alerts, one-time passwords and security notices. Declining means you will not receive alerts on your device.
• Camera and photo library — used only when you choose to photograph or attach an identity document, a business registration document, or a profile photo. Images are uploaded to us for verification and are not accessed in the background.
• Biometrics (fingerprint or face) — an optional convenience for unlocking the app. The match happens entirely on your device through Android's biometric system. Your fingerprint or face data is never transmitted to us, and we never see or store it.
• Internet and network access — required to reach the bank.

We share personal data only where it is necessary:

• With the Central Bank of Nigeria, the NDIC and other regulators or law-enforcement agencies where we are required to.
• With NIBSS and other banks, to verify identities and to route transfers you have instructed.
• With the identity-verification and payment-processing providers that support the service, under contracts that restrict what they may do with the data.
• With Google, solely to deliver push notifications: Firebase Cloud Messaging receives a device token and the alert to be delivered. We do not send Google your balance, your account number or your identity data.
• With credit bureaux and the courts, where the law permits or requires it.

Your account and transaction records are held on infrastructure operated for UltraPay Microfinance Bank. Some of our service providers — including the push notification service — operate outside Nigeria, so limited data may be processed abroad. Where that happens we rely on contractual protections requiring a standard of protection comparable to that required by the Nigeria Data Protection Act.

Banking regulation requires us to keep customer identification and transaction records for a minimum period after a relationship ends — generally at least five years. We retain your data for at least that long, and delete or anonymise it once no legal, regulatory or legitimate business reason to keep it remains.

You can ask us to close your UltraPay account and delete your personal data at any time. Because we are a licensed bank, some records must be kept even after closure — the account deletion page explains exactly what is deleted, what we are obliged to retain and for how long, and how to make the request.

Connections are encrypted in transit. Access to customer data inside the bank is restricted to staff who need it for their work. Your transaction PIN is stored only as a one-way hash and cannot be read back by anyone, including our staff. Your BVN, NIN and PIN are never displayed in full in the app. See our security page for more detail.

UltraPay is not directed at children. You must be at least 18 years old to open and operate an account, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it, subject to any record-keeping obligation that applies.

The UltraPay website uses cookies that are strictly necessary to run the service — principally to keep you signed in securely and to remember your display preferences. We do not use advertising cookies. Blocking necessary cookies will prevent you from signing in. The Android app does not use cookies for tracking; it stores your session securely on the device and clears it when you sign out.

• Ask for a copy of the personal data we hold about you.
• Ask us to correct information that is inaccurate or out of date.
• Ask us to delete data, where no legal or regulatory obligation requires us to keep it.
• Object to, or ask us to restrict, certain processing.
• Withdraw consent where our processing was based on consent.
• Complain to the Nigeria Data Protection Commission if you are unhappy with how we have handled your data.

You can update your phone number and address yourself in Settings → Profile. Changes to your legal name or identity data must be made at a branch, because they are tied to your verified KYC records.

We may update this policy from time to time. The current version is always published here with the date it took effect, and we will notify you of material changes.

To exercise any of your rights, or to ask a question about this policy, contact support@ultrapaymfb.com.ng or call 0700 000 0000.