Legal
Privacy Policy
Zero-Knowledge Proof ArchitectureEffective Date: 12 March, 2026 | Last Updated: 25 March, 2026
This Privacy Policy explains how RoviPay, operated by Aldenfort Ltd ("RoviPay", "we", "us", or "our"), collects, uses, stores, and protects your personal information when you use our web application at rovipay.ng or our mobile application (collectively, "the Platform").
By creating an account or using any part of the RoviPay Platform, you confirm that you have read and understood this Privacy Policy and agree to the collection and use of your information as described here.
This Policy is governed primarily by the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR) 2019. Where applicable, we also comply with the UK GDPR and EU GDPR for users accessing our Platform from the United Kingdom, Germany, and other European jurisdictions.
Who We Are
RoviPay is a Nigerian fintech platform offering USD virtual card services and bill payment services (airtime, mobile data, electricity, cable TV subscriptions, and betting wallet funding) to Nigerian users and Nigerian diaspora users abroad.
Company Name
Aldenfort Ltd
RC Number
RC 8976948
Registered Address
Abuja, Nigeria
Platform
rovipay.ng (web) and RoviPay mobile app (iOS and Android)
Data Controller
Aldenfort Ltd
Contact Email
privacy@rovipay.ng
Data Collection
2.1 Information you provide directly
- check_circleFull name
- check_circlePhone number
- check_circleEmail address
- check_circleBank Verification Number (BVN) — submitted for identity verification purposes only
- check_circleNational Identification Number (NIN) — submitted for identity verification purposes only
- check_circleProfile photograph (if provided)
- check_circleTransaction PIN
2.2 Information collected automatically
- check_circleDevice information (device type, operating system, unique device identifiers)
- check_circleIP address and approximate location derived from IP
- check_circleApp usage data (pages visited, features used, session duration)
- check_circleTransaction data (amounts, timestamps, service type, transaction status)
- check_circleLog data (error reports, crash data, API call logs)
2.3 Information from third-party services
- check_circleIdentity verification results from YouVerify (pass/fail status and reference ID)
- check_circlePayment confirmation data from Flutterwave (transaction reference, amount, status)
- check_circleCard transaction data from Maplerad (transaction reference, merchant name, amount, status)
- check_circleBill payment confirmation data from VTU.ng (transaction reference, service type, status)
How We Use Your Information
| Purpose | Legal Basis |
|---|---|
| To verify your identity before granting platform access (KYC) | Legal obligation (CBN KYC requirements, NDPA) |
| To create and manage your RoviPay wallet and account | Performance of contract |
| To process wallet funding, card transactions, and bill payments | Performance of contract |
| To issue and manage your USD virtual card via Maplerad | Performance of contract |
| To send transaction notifications and account alerts via SMS and push notification | Performance of contract |
| To prevent fraud, money laundering, and unauthorized account access | Legal obligation (AML/CFT regulations) |
| To respond to your support requests and resolve disputes | Legitimate interest |
| To improve the Platform through usage analytics | Legitimate interest |
| To comply with legal obligations, court orders, or regulatory requests | Legal obligation |
| To send product updates and offers (only with your consent) | Consent — you may opt out at any time |
Third-Party Sharing
We do not sell your personal data. We do not share your information with advertisers or marketing third parties. We share your information only in the following limited circumstances:
4.1 Service providers
- YouVerify — for BVN/NIN identity verification during onboarding.
- Maplerad — for USD virtual card issuance and management.
- Flutterwave — for processing wallet funding via bank transfer and card payments.
- VTU.ng — for processing bill payments (airtime, data, electricity, cable TV, betting wallet funding).
- Termii or Africa's Talking — for delivering OTP and transaction SMS notifications.
4.2 Regulatory and legal disclosures
We may disclose your information to regulatory authorities, law enforcement agencies, or courts where we are legally required to do so — including in response to requests from the Central Bank of Nigeria (CBN), the Nigerian Financial Intelligence Unit (NFIU), or equivalent authorities in other jurisdictions.
4.3 Business transfers
In the event of a merger, acquisition, or sale of all or part of Aldenfort Ltd's business, your personal data may be transferred to the acquiring entity. We will notify you via email or prominent in-app notice before your data is transferred.
Data Retention
We retain your personal data for as long as your account is active and for a minimum of 5 years after account closure, in compliance with Nigerian AML/CFT regulations and CBN guidelines for financial record-keeping.
Transaction records are retained for a minimum of 5 years from the date of each transaction.
Identity verification records are retained for a minimum of 5 years after the last transaction on your account.
If you request account deletion, we will delete or anonymize all data that we are not legally required to retain, and we will inform you of what data must be retained and for how long.
Security Protocols
HTTPS/TLS encryption for data in transit
Hashed storage of transaction PINs
Need-to-know access controls
Webhook signature verification
No system is 100% secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, as required by the NDPA 2023.
Your Rights
Right to access
You can request a copy of the personal data we hold about you.
Right to rectification
You can ask us to correct inaccurate or incomplete data.
Right to erasure
You can request deletion of your data, subject to our legal retention obligations.
Right to restrict processing
You can ask us to limit how we use your data in certain circumstances.
Right to data portability
You can request your data in a structured, machine-readable format.
Right to object
You can object to processing based on legitimate interests, including direct marketing.
Right to withdraw consent
Where processing is based on consent, you can withdraw it at any time.
To exercise any of these rights, contact us at privacy@rovipay.ng. We will respond within 30 days.
Children's Privacy
RoviPay is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a user is under 18, we will immediately suspend their account and delete their data. Contact privacy@rovipay.ng if you believe a minor has created an account.
International Data Transfers
Your personal data is primarily stored and processed in Nigeria. Some of our third-party service providers (including Maplerad and Flutterwave) may process data outside Nigeria. Where data is transferred internationally, we ensure that appropriate safeguards are in place.
For users in the UK and EU: transfers of your data outside the UK/EEA are conducted under appropriate transfer mechanisms in compliance with UK GDPR and EU GDPR requirements.
Third-Party Links
The RoviPay Platform may contain links to third-party websites or integrate with third-party services. This Privacy Policy applies only to RoviPay. We are not responsible for the privacy practices of third-party services.
Policy Changes
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or phone and display a prominent notice within the Platform for at least 14 days before the changes take effect. Your continued use of the Platform after the effective date constitutes your acceptance of the changes.
Contact Us
For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact our Data Protection Officer:
Data Protection Officer
Lanre Adebayo
Company
Aldenfort Ltd
Address
House 8, Gwazo Close, Area 11, Abuja, Nigeria
Phone
+234 812 456 6929