BuyQuick Privacy Policy

Nigeria • Digital Payments, Bill Payments, Merchant API & Escrow Marketplace

Effective Date: 20 September 2026  |  Version: 1.1

This Privacy Policy explains how BuyQuick (“BuyQuick”, “we”, “us” or “our”) collects, uses, shares, stores and protects personal data when you use our website, mobile applications, merchant/API services, bill-payment and transfer services, referral/cashback features, marketplace and escrow features, customer-support channels, or otherwise interact with us.

1. Who We Are

BuyQuick operates a digital commerce and payment platform serving users and businesses in Nigeria. Our services include airtime and data purchases, electricity and other bill payments, internet and subscription payments, transfers, merchant/API services, referral and cashback programmes, and an escrow-enabled marketplace through which buyers and sellers may transact.

Website: buyquick.ng  •  Email: customer@buyquick.ng  •  Telephone: +234-9034313685  •  Address published on our website: Block 9, Flat G, FHS Zuba, 901101, FCT-Abuja, Nigeria.

For privacy requests, please contact customer@buyquick.ng with the subject “Privacy Request”. Where BuyQuick designates a dedicated Data Protection Officer (DPO) or privacy contact, that contact will supersede this address for privacy matters.

2. The Laws and Standards We Follow

This Policy is designed primarily around the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Act—General Application and Implementation Directive 2025 (GAID), and applicable Central Bank of Nigeria (CBN) rules governing payment and bill-payment activities. The NDPA is now the principal Nigerian data-protection statute; the former Nigeria Data Protection Regulation 2019 (NDPR) is treated here as historical background rather than the primary legal basis for current processing.

Where a service is delivered through a licensed bank, switch, payment processor, biller, telecom operator or other regulated partner, that partner may have separate privacy obligations and notices. Nothing in this Policy removes any mandatory rights or obligations imposed by applicable Nigerian law.

3. What We Mean by “Personal Data”

Personal data means information that identifies or can reasonably be linked to an individual. In a payment platform, this can include identity, contact, account, device, transaction, financial and security information. We aim to collect only information reasonably necessary for the service, security, compliance or other disclosed purpose.

4. People Covered by This Policy

• Customers and account holders using BuyQuick services.
• Buyers, sellers and other participants in the BuyQuick marketplace and escrow service.
• Merchants and businesses using BuyQuick APIs or business services.
• Visitors to buyquick.ng and users of our mobile applications.
• Persons who contact our support, participate in promotions/referrals, or otherwise communicate with us.

5. Information We Collect

A. Account and contact information

Depending on the service, we may collect your name, mobile number, email address, address or other contact information, account credentials, transaction PIN or security credentials (normally stored in protected form), referral identifiers and communication preferences.

B. Identity, verification and compliance information

Where required for onboarding, merchant verification, fraud prevention or legal/regulatory compliance, we may collect information such as date of birth, government-issued identification details, photographs, business registration/KYB information, beneficial-owner information and other verification information. We only request information proportionate to the applicable service and legal requirement.

C. Payment, financial and transaction information

We may process bank account details, beneficiary details, transaction references, amounts, payment status, biller information, merchant information, wallet balances, settlement information and limited card/payment information needed to complete or reconcile a transaction. Where a third-party payment processor handles card credentials, BuyQuick may receive tokens, masked details, references or status information rather than the full card credentials.

D. Marketplace and escrow information

For marketplace transactions, we may process seller profile information, listing details, product descriptions and images, buyer/seller contact or delivery information, order and payment records, delivery/confirmation evidence, dispute records and communications necessary to administer the transaction and resolve disputes.

E. Device, technical and usage information

When you use our website or applications, we may receive IP address, browser/device type, operating-system information, application version, device identifiers, approximate location derived from technical information where enabled, login events, pages/screens visited, timestamps, crash/diagnostic information and security signals. We use these mainly for authentication, service reliability, fraud detection, analytics and security.

F. Communications and support information

If you contact us, we may retain the content and metadata of emails, chats, calls or other support interactions, together with records needed to investigate complaints, resolve disputes and improve service quality.

G. Cookies and similar technologies

We may use essential cookies or similar technologies to keep you signed in, maintain security, remember preferences and understand basic service usage. Non-essential advertising and measurement technologies are not loaded until you accept them, and you can change or withdraw that choice at any time using the Cookie choices link in our website footer — Section 17 explains exactly which technologies these are, what they store and how to turn them off. You can also control cookies through your browser or device settings, although disabling essential technologies may affect functionality.

6. Why We Use Your Data

• To create and administer accounts and authenticate users.
• To process airtime, data, electricity, internet, subscription, bill-payment and transfer instructions.
• To operate marketplace and escrow transactions, including holding/releasing funds through the applicable payment arrangement, confirming delivery and handling disputes.
• To provide merchant/API services, issue credentials, monitor API activity and protect integration keys.
• To verify identity and businesses, prevent fraud, money laundering, account takeover and other unlawful activity, and maintain platform security.
• To provide receipts, alerts, service messages, support and transaction updates.
• To administer referrals, cashback and other programmes, including eligibility and abuse prevention.
• To analyse reliability, diagnose technical problems, improve products and develop safer services.
• To meet legal, regulatory, audit, accounting, tax, law-enforcement and dispute-resolution obligations.
• To send promotional communications where permitted and, where required, with your consent; you may opt out of marketing communications.

7. Our Lawful Bases for Processing

We do not rely on consent for every activity. Depending on the circumstances, we may process personal data because:

• Contract: processing is necessary to provide a requested service, execute a transaction, maintain an account or perform our agreement with you.
• Legal obligation: processing is required by applicable financial, tax, anti-fraud, AML/KYC, accounting, regulatory or other legal requirements.
• Legitimate interests: processing is reasonably necessary for security, fraud prevention, service improvement, network/API protection, dispute management and responsible operation of the platform, provided those interests do not override your rights.
• Consent: used where the law requires consent, including certain optional marketing, cookies or other optional processing. You may withdraw consent, but withdrawal does not affect processing lawfully carried out before withdrawal.
• Vital/public-interest grounds: only where applicable under law and appropriate to the particular processing.

8. When We Share Personal Data

We do not sell your personal data as a business model. We may disclose the minimum information reasonably required to the following categories:

• Banks, payment processors, switches, billers, telecom operators and other transaction partners needed to execute or reconcile a requested transaction.
• Marketplace participants, couriers or delivery partners, but only where information is needed to complete the relevant transaction or resolve a dispute.
• Technology, cloud hosting, analytics, communications, identity-verification, security, customer-support and other service providers acting under appropriate contractual and security controls.
• Professional advisers, auditors, insurers and other legitimate business-service providers where reasonably necessary.
• Regulators, courts, law-enforcement or other public authorities where disclosure is required or lawfully permitted.
• A buyer, investor, successor or acquiring entity in connection with a merger, restructuring, financing or sale of part of the business, subject to applicable confidentiality and data-protection requirements.

Where BuyQuick acts as a processor on behalf of a merchant or business customer, that customer may determine the purposes of certain processing. In those cases, the customer’s privacy notice may also apply, and BuyQuick will process the relevant data according to the customer’s instructions and applicable law.

9. International and Third-Party Processing

Some technology or service providers may process data outside Nigeria. Where this occurs, BuyQuick will use the transfer mechanisms and safeguards required by the NDPA, GAID and other applicable Nigerian requirements, and will take reasonable steps to ensure appropriate protection, confidentiality and security.

10. Security

We use technical, organisational and administrative safeguards appropriate to the risks of a digital payments platform. Depending on the system and risk, these may include encryption in transit, protected credential storage, access controls, authentication, least-privilege access, logging and monitoring, vulnerability management, backups, environment separation, secure API practices, incident response procedures and staff confidentiality obligations.

No internet-connected system can be guaranteed completely secure. You should protect your device, login credentials and transaction PIN, avoid sharing one-time codes or API keys, and notify BuyQuick promptly if you suspect unauthorised access or a fraudulent transaction.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including to provide services, maintain transaction records, meet legal/regulatory obligations, resolve disputes, prevent fraud and enforce agreements. Some transaction and compliance records may need to be retained for periods prescribed by applicable law. When retention is no longer required, data will be securely deleted, anonymised or otherwise rendered non-identifiable where appropriate.

12. Your Privacy Rights

Subject to the conditions and lawful exceptions under Nigerian law, you may have rights to:

• be informed about how your personal data is processed;
• request access to personal data we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion/erasure where the legal requirements for deletion are met;
• object to certain processing, including certain direct marketing;
• request restriction of processing in applicable circumstances;
• receive or request portability of eligible personal data in a structured, commonly used format;
• withdraw consent where processing is based on consent;
• request human intervention or challenge certain decisions based solely on automated processing where the applicable legal conditions are met; and
• lodge a complaint with the Nigeria Data Protection Commission (NDPC).

Some rights are not absolute. For example, we may need to retain information where a legal or regulatory obligation requires us to do so, or where retention is necessary for a legal claim, fraud investigation, transaction reconciliation or another lawful purpose.

13. How to Exercise Your Rights or Make a Privacy Complaint

Send your request to customer@buyquick.ng with the subject “Privacy Request”. Please describe the right you wish to exercise and, where necessary, provide enough information for us to identify your account and verify that the request is genuinely from you. We will not request unnecessary credentials, passwords, PINs or full payment-card information merely to process a privacy request.

We will assess and respond to requests within the timeframes required by applicable law. If additional time or information is reasonably necessary, we will explain this. If you are dissatisfied with our response, you may escalate the matter to the Nigeria Data Protection Commission or another competent authority as permitted by law.

14. Children and Vulnerable Persons

Our services are designed for persons who are legally able to enter the relevant transaction or service relationship. We do not knowingly collect children’s personal data for purposes that are not permitted by law. Where a service involves a minor or another person requiring legal representation, we may require the appropriate parent, guardian or authorised representative to provide or consent to the relevant information, where legally required.

15. Fraud, Security and Responsible Monitoring

Because BuyQuick processes transactions and operates an escrow marketplace, we may monitor activity and transaction patterns to identify account takeover, credential abuse, fraudulent payments, suspicious marketplace behaviour, API misuse, chargeback/dispute abuse and other security threats. Such monitoring may involve automated rules or risk signals. Where applicable law gives you rights regarding solely automated decisions, you may request appropriate review or human intervention.

16. Marketing and Communications

We may send essential service communications such as transaction confirmations, security alerts, password/PIN notices, service interruptions and important account messages. These are not optional marketing messages. Where we send promotional messages, you may unsubscribe using the mechanism provided in the message or by contacting us. We will continue to send essential service and legally required communications where necessary.

17. Advertising, Measurement and Attribution

This section describes the technologies we use to measure advertising and to understand which campaigns bring people to BuyQuick. It is written separately from Section 16 because advertising measurement is a different activity from sending you marketing messages, and it is governed by different choices.

A. On our website

Our public website pages use the TikTok Pixel, a measurement technology provided by TikTok. Where enabled, it tells us how many people arrived from a TikTok advertisement and which pages they viewed, so that we can measure whether that advertising works. It may set first-party cookies on buyquick.ng named _ttp, ttcsid, ttclid and _tt_enable_cookie, and may store a small amount of information in your browser for the duration of your visit.

This is not switched on until you agree to it. When you first visit a public page you are asked, in plain terms, whether you accept advertising cookies. Nothing is sent to TikTok, and no advertising cookie is stored, unless and until you accept. If you decline, the technology is not loaded at all on your subsequent visits.

You can change your mind at any time using the Cookie choices link in the footer of our website, and you can also clear or block cookies through your browser settings. Declining or withdrawing has no effect on your ability to sign in, buy airtime or data, pay a bill, transfer funds or use the marketplace — it only stops advertising measurement.

B. In our mobile applications

Current status: our mobile applications do not currently include third-party advertising or attribution software. The rest of this sub-section describes what will apply from the app version in which such software is first introduced. When that happens we will update this Policy, our Google Play Data safety disclosure and our Apple App Store privacy information in the same release, so that the three always agree.

Partners we expect to use: Meta, Google (Google Analytics for Firebase), TikTok and AppsFlyer, for install measurement and attribution. Each acts under its own privacy terms in addition to this Policy, and each may process information outside Nigeria as described in Section 9.

Advertising identifiers: mobile operating systems provide a resettable advertising identifier — the Google Advertising ID (GAID) on Android and the Identifier for Advertisers (IDFA) on iOS. These are device identifiers, not your name, and they are used to recognise that an advertisement led to an app install without identifying you personally to the advertiser. On iOS, the IDFA is only accessed if you grant permission through Apple’s App Tracking Transparency prompt; if you decline, it is not accessed.

What we would use them for: measuring how many people install the app after seeing an advertisement, attributing an install to the campaign that produced it, measuring conversions such as a first completed transaction, detecting advertising fraud, and reporting the cost and effectiveness of our marketing. We do not use advertising measurement to make automated decisions about your account, your transaction limits, your creditworthiness or your eligibility for a service.

Your controls: on iOS, Settings → Privacy & Security → Tracking lets you refuse or withdraw tracking permission for each app. On Android, Settings → Privacy → Ads lets you delete or reset your advertising ID. Using either control does not affect your ability to use BuyQuick. Our account deletion and data deletion page repeats these instructions.

C. What we do not do with advertising technologies

• We do not sell personal data.
• We do not share your transaction details, wallet balance, bank account or beneficiary details, meter or smartcard numbers, or identity-verification information with any advertising partner.
• We do not run advertising or measurement technologies on the signed-in parts of our website. Your dashboard, wallet, transaction history, receipts and verification pages carry no advertising tags.
• We do not use advertising identifiers to build a profile that affects the price you pay, the limits on your account, or the services offered to you.

18. Third-Party Websites and Services

BuyQuick may link to or integrate with third-party websites, billers, payment providers, app stores, banks, merchants and other services. Their privacy practices are governed by their own notices and terms. We encourage you to review those notices before providing information directly to a third party. BuyQuick is not responsible for privacy practices outside our control.

19. Changes to This Policy

We may update this Policy when our services, technology, regulatory requirements or privacy practices change. The current version will be published on our website or otherwise made available through our services. Material changes will be communicated where required by law. The effective date and version number at the top of this Policy indicate which version is current.

Version 1.1 (20 September 2026): added Section 17 (Advertising, Measurement and Attribution), covering the advertising measurement used on our website, the advertising identifiers and attribution software expected in our mobile applications, and how to refuse or withdraw both; expanded Section 5(G) accordingly; and added a link to our account and data deletion page.

20. Product-Specific Privacy Practices

Payments and bill services

For transaction services, we may need to exchange identifiers, account/beneficiary details, biller information, transaction values and references with the financial institution, processor, switch, biller or other participant necessary to complete the instruction. Transaction records may be retained for reconciliation, fraud prevention, customer support, audit and legal obligations.

Merchant and API services

Merchant users are responsible for keeping BuyQuick API keys confidential and for ensuring that data submitted to the API is collected and used lawfully. BuyQuick may log API requests, authentication events, IP/device information, endpoint usage, error information and transaction metadata for security, troubleshooting, billing, support and abuse prevention. Merchant API keys should be kept on a secure server and not exposed in client-side applications.

Marketplace and escrow

BuyQuick may process information needed to connect buyers and sellers, publish listings, facilitate payment, evidence delivery/acceptance, administer escrow instructions and resolve disputes. We will not disclose private information between parties beyond what is reasonably necessary for the transaction, safety, delivery, support or dispute process, subject to applicable law.

Referral, cashback and rewards

We may process referral codes, transaction activity, eligibility information and reward history to calculate and credit legitimate rewards and prevent duplicate, fraudulent or abusive claims. Rewards may be subject to separate programme terms.

21. Data Breach and Incident Response

If we become aware of a personal-data breach, we will assess and manage it under our incident-response procedures and the requirements of applicable Nigerian law, including any required notification to the NDPC and affected data subjects. We may temporarily restrict accounts, transactions, API access or other functionality where reasonably necessary to contain a security incident.

22. Governing Law

This Policy is governed by the laws of the Federal Republic of Nigeria. Nothing in this Policy limits a right or remedy that cannot lawfully be excluded.

23. Contact

• Privacy and data-protection requests: customer@buyquick.ng
• General customer support: customer@buyquick.ng
• Telephone: +234-9034313685
• Website: buyquick.ng
• Address: Block 9, Flat G, FHS Zuba, 901101, FCT-Abuja, Nigeria