1. Introduction
This Privacy Policy explains how EarlyHub Ltd ("EarlyHub," "we," "us," or "our"), the company that owns and operates the EarlyPay platform ("EarlyPay," the "Platform," or the "Service"), collects, uses, discloses, stores, and protects the personal data of individuals who use our website, mobile application, USSD channels, and related services (collectively, the "Services").
EarlyHub Ltd is a company duly incorporated in Nigeria under the Companies and Allied Matters Act (CAMA), with its registered office at:
No. 15, Unguwa Uku Zaria Road, Along Unguwa Uku Motor Park, Kano State, Nigeria.
By creating an account, accessing, or using EarlyPay, you agree to the collection and use of your information as described in this Privacy Policy. If you do not agree with this Policy, please do not use the Services.
This Policy is issued in compliance with the Nigeria Data Protection Act, 2023, the NDPA General Application and Implementation Directive, 2025, the Nigeria Data Protection Commission (NDPC) framework, the Central Bank of Nigeria (CBN) regulations applicable to payment service providers, and the Cybercrimes (Prohibition, Prevention, etc.) Act, as amended.
2. Scope of This Policy
This Policy applies to all personal data processed by EarlyHub Ltd in connection with the EarlyPay Platform, including data collected from:
- Registered users and account holders ("Users," "you")
- Visitors to our website or app who have not yet registered
- Merchants, agents, and business partners who integrate with EarlyPay
- Individuals who contact our customer support
It does not apply to third-party websites, applications, or services that may be linked to or integrated with EarlyPay but are independently operated (e.g. mobile network operators, DISCOs, cable TV providers, payment gateways). We encourage you to review the privacy policies of those third parties separately.
3. Information We Collect
We collect the following categories of personal data:
3.1 Identity & Contact Information
- Full name
- Email address
- Phone number
- Residential or business address
- Date of birth
- Gender (where provided)
- Government-issued identification details where required for KYC (e.g. Bank Verification Number (BVN), National Identification Number (NIN), voter's card, driver's licence, international passport)
- Passport photograph / selfie for identity verification (where applicable)
3.2 Financial & Transaction Information
- Wallet balance and transaction history
- Bank account details (for funding/withdrawal purposes)
- Card details processed via our licensed payment processors (EarlyPay does not store your full card number, CVV, or PIN — these are tokenized and handled by our PCI-DSS-compliant payment partners)
- Airtime, data, electricity, cable TV, and exam pin purchase history
- CAC business registration details submitted through our platform
3.3 Technical & Usage Information
- IP address
- Device identifiers, device type, and operating system
- Browser type and version
- Log data (access times, pages viewed, crash reports)
- Location data (where enabled, for fraud prevention and service delivery)
- Cookies and similar tracking technologies (see Section 10)
3.4 Communications
- Records of correspondence when you contact our support team (email, WhatsApp, live chat, phone)
- Survey responses and feedback
4. How We Collect Your Information
We collect personal data through:
- Direct provision — when you register an account, complete KYC, make a transaction, or contact support.
- Automated means — through cookies, SDKs, and analytics tools when you use our website or app.
- Third parties — including identity verification providers, mobile network operators, banks, payment processors (e.g. Remita), and regulatory databases (e.g. NIMC for NIN verification), where lawfully permitted.
5. Legal Basis for Processing
In accordance with Section 25 of the NDPA 2023, we process your personal data only where at least one of the following legal bases applies:
- Consent — you have given clear consent for us to process your data for a specific purpose.
- Contractual necessity — processing is necessary to perform our contract with you (e.g. completing a transaction).
- Legal obligation — processing is necessary to comply with a legal or regulatory obligation (e.g. CBN AML/KYC rules, tax reporting).
- Vital interests — processing is necessary to protect someone's life.
- Public interest — processing is necessary for a task carried out in the public interest.
- Legitimate interest — processing is necessary for our legitimate business interests (e.g. fraud prevention, service improvement), provided this does not override your fundamental rights and freedoms.
6. How We Use Your Information
We use the information we collect to:
- Create and manage your EarlyPay account
- Verify your identity and comply with Know-Your-Customer (KYC) obligations
- Process transactions (airtime, data, electricity, cable TV, exam pins, wallet funding/withdrawal, CAC registration)
- Detect, investigate, and prevent fraud, money laundering, and other illegal activity
- Send transactional notifications (OTPs, receipts, alerts) via email, SMS, or push notification
- Send service updates, security notices, and (where you have opted in) marketing communications
- Respond to customer support enquiries
- Improve, secure, and personalize the Platform
- Comply with applicable laws, regulations, court orders, and requests from law enforcement or regulatory bodies (including the CBN, NDPC, EFCC, and NFIU)
- Enforce our Terms of Service
We do not sell your personal data to third parties.
7. Sharing and Disclosure of Information
We may share your personal data with:
- Service providers and processors who help us operate the Platform (e.g. cloud hosting, SMS/email delivery, payment processing, identity verification), under written data processing agreements that bind them to confidentiality and security obligations consistent with the NDPA.
- Payment partners and financial institutions necessary to complete your transactions (e.g. Remita, licensed payment gateways, your bank).
- Utility and telecom providers (mobile network operators, DISCOs, cable TV providers, exam bodies) to the extent necessary to deliver the specific product you purchased.
- Regulators and law enforcement, including the CBN, NDPC, EFCC, NFIU, or a court of competent jurisdiction, where required by law or to protect our legal rights.
- Professional advisers (lawyers, auditors, insurers) where necessary.
- A successor entity, in the event of a merger, acquisition, or sale of all or part of EarlyHub Ltd's business, subject to equivalent privacy protections.
We require every third party we share data with to respect the security of your personal data and to treat it in accordance with applicable law.
8. Cross-Border Data Transfer
Where your personal data is transferred outside Nigeria (for example, to a cloud service provider with servers abroad), we will ensure that the transfer complies with the NDPA's cross-border transfer requirements, which may include verifying that the recipient country has an adequate level of data protection, obtaining your explicit consent, or relying on appropriate contractual safeguards approved by the NDPC.
9. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. In particular:
- Transaction and KYC records are retained for a minimum of five (5) years after the termination of your relationship with us, in line with CBN Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) regulations.
- Account information is retained for as long as your account remains active, and for a reasonable period after closure to resolve disputes and comply with legal obligations.
- Where data is no longer required, we securely delete or anonymize it.
10. Cookies and Tracking Technologies
We use cookies, SDKs, and similar technologies to:
- Keep you logged in and remember your preferences
- Understand how you use the Platform (analytics)
- Detect and prevent fraudulent activity
- Improve our Services
You can control cookies through your browser or device settings. Disabling cookies may affect the functionality of some parts of the Platform.
11. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:
- Encryption of sensitive data in transit and at rest
- Access controls and role-based permissions
- Regular security assessments and monitoring
- Tokenization of card data by our PCI-DSS-compliant payment partners (EarlyPay does not store full card details)
While we take reasonable steps to protect your data, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
12. Your Rights as a Data Subject
Under the NDPA 2023, you have the right to:
- Be informed about how your data is processed (this Policy)
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data, subject to our legal retention obligations (e.g. AML recordkeeping)
- Restrict or object to certain processing activities
- Data portability — receive your data in a structured, commonly used format, or have it transmitted to another controller
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal
- Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated
To exercise any of these rights, contact us using the details in Section 17. We will respond within the timeframe required by applicable law.
13. Children's Privacy
EarlyPay is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. Where parental or guardian consent is legally required for a data subject who cannot independently consent, we will only process such data with the necessary consent and safeguards. If we become aware that we have inadvertently collected data from a minor without appropriate consent, we will take steps to delete that data.
14. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the NDPC and affected data subjects without undue delay, in accordance with the notification timelines prescribed by the NDPA and GAID.
15. Marketing Communications
Where you have opted in to receive marketing or promotional messages, you may withdraw your consent at any time by using the "unsubscribe" link in our emails, replying "STOP" to SMS messages, or contacting our support team. You will continue to receive essential transactional and security communications (e.g. OTPs, transaction receipts) even after opting out of marketing.
16. Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes via email, in-app notice, or by posting the updated Policy on our website with a revised "Last Updated" date. Your continued use of the Services after such changes constitutes acceptance of the updated Policy.
17. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:
EarlyHub Ltd (operators of EarlyPay)
Address: No. 15, Unguwa Uku Zaria Road, Along Unguwa Uku Motor Park, Kano State, Nigeria
Email: support@earlypay.ng
Website: https://earlypay.ng
Data Protection Officer: [Insert DPO Name/Email, if designated]
You may also lodge a complaint directly with the Nigeria Data Protection Commission (NDPC) at www.ndpc.gov.ng.
18. Governing Law
This Privacy Policy is governed by and construed in accordance with the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act 2023 and its subsidiary regulations.