YDPay Privacy Notice

Privacy Notice  
Version: 1.0
Last Updated: 6 October 2025  

‍General Introduction
Welcome to YDpay (“YDPay”, “We”, “Our”). We are redefining how our Customers (“you”) experience crypto starting from our transparency with the data you give to us. This privacy notice is our little explanation of the categories of data we collect from you, why we collect them, what we do with them, our duties to you and how you can exercise your rights.  

‍Scope
This Privacy Notice applies to you if; You are a YDPay customer You are an intending YDPay customer reviewing our website or any of our products  

‍Why Does a Crypto Exchange Want My Data?
Let’s face it. Nobody really likes to give out their data. Especially not in this age. We understand. Web3 and Crypto promises greater privacy so this may also seem like a contradiction. So, here’s the why.  

We are a regulated exchange. Our regulators have expectations of us including the duty to know our customers. Sometimes, we also need this data to determine when a fraud event or suspicious incident is happening on your account. All of these and many more of our duties require us to collect and process your data.  

In some cases, we also collect your data to promptly notify you about changes to our services, new service offerings, promotional offers etc.  

However, rest assured we do not just collect for nothing’s sake or blindly. We ensure we collect only the minimum required to provide our services to you. We also apply best industry practices to protect your data.  

 
The Bits and Pieces We Collect Category Why? Lawful basis
Bio-data  Name  Email Address Residential Address Age/Date of Birth  To complete our Know Your Customer and customer due diligence requirements  Compliance with applicable laws Identification Information Bank Verification Number  National Identification Number  Tax identification Number To confirm the true identity of whoever is accessing our services or participating in our recruitment process;  To complete KYC requirements Compliance with applicable laws Bank and Financial Information Transaction history and ancillary transaction information  Beneficiary bank accounts  Beneficiary addresses To comply with applicable laws, process your transactions and flag potentially unauthorized transactions. Performance of our contract with you; Compliance with KYC/AML Laws Cookies and tracking technologies (optional)  To enable us to provide the best service to you, remember your preferences and personalize our service delivery. Performance of our contract with you; Legitimate business interests    







‍
‍

‍What We Actually Do With Your Data
‍
‍To verify your account
‍We do not just collect your data at onboarding, we confirm its accuracy before storing it. This is what the law requires of us. It also helps us to flag unauthorised access, in some cases.
‍
Service delivery
Think about it. If we do not have your account information collected or stored, we will not be able to process your transactions.  
‍
‍For marketing update and communications
To inform you of our latest updates, asset listing/delisting, changes to your account, requests for information etc.  
‍
‍Compliance with lawful requests
We may receive lawful requests initiated by yourself or in your respect, where we have reasonably validated this request and confirmed compliance with applicable laws, we may share your data with the requester. For further information, please review our data subject access request section or contact us at privacy@ydpay.io.  

‍How Long We Hang on to Your Info
The length of time is determined by the law. For your KYC information, we retain it for at least five (5) years after the completion of our business with you. For marketing information, we retain the data for at least three (3) years after the completion of our business.   If you have any further questions around our data retention and other ways we comply with data retention laws, please reach out to us via privacy@ydpay.io.    

‍Your Rights as our Data Subject (and How to Use Them)
You have rights under Nigerian laws as our data subject. Some of your rights under the law are outlined below.
a. Access/know which bits of your personal data we process.  
b. Move your data – You may request that we move your data to a third party, with your consent.
c. Request deletion or erasure of your data. Please note that we can only delete your KYC information at least five (5) years after closure of your account.
d. Edit or rectify your data with us e.g. change of name, updated KYC information etc.
e. Withdraw your consent to the processing of your personal data, where applicable.
f. Object to the processing of your personal data.
g. File a complaint with the Nigerian Data Protection Commission (NDPC). If you have any issues, you may reach us first on privacy@ydpay.io. We hope it doesn’t escalate but if you must report, you can reach the NDPC.
To exercise any of your rights in this notice, you may complete our Data Subjects Access Request form.  

‍Blockchain Analytics and Automated Processing
a. We utilize some advanced compliance tools for functions such as onboarding, blockchain analytics and risk management that automate data processing at scale. However, we ensure that those tools are tuned frequently to ensure that there is no disproportionate impact on our customers.  
b. We also ensure that the tool is assisted by humans in the decision-making process to manage potential risk of error, misdiagnosis or false positives.  
c. Please keep your addresses and passwords safe. Although it’s just a hash, if you’re doxed, it could reveal your personal or financial information. YDpay will take organizational and technical measures to protect your data. Please assist us by adopting safe practices with your otherwise private information.  

‍With Whom may we Share your Data?
a. Third parties authorized by yourself
b. Internally with other YDpay staff
c. Verification and screening service providers  
d. Sub-processors who provide services to us.  
e. Professional advisors and external consultants with whom we have signed relevant non-disclosure agreements or have a professional duty of confidentiality.  

‍Qualification Age and Child Rights
a. We reserve our services for adults (age 18 and above). If you are below 18, we are currently unable to provide our services to you. Please come around when you meet our age qualification requirement. We’ll be happy to have you with us.  
b. If you believe we have incorrectly accessed your age, kindly reach out to our DPO via privacy@ydpay.io. However, by using our services, you represent to us that you are an adult and fulfil all qualification requirements in our terms of service.  

‍Account Deletion/Erasure
We value all our customers, and we hate to see anyone go. However, if you must, we have allowance for that. We hope you come around later in future but in the meantime, we have outlined some key information you should know about our deletion process below.  

a. Deletion is Permanent
We have a closing window after you initiate your request within which you may change your mind. Once the window is closed, your deleted data is closed and no longer accessible.  
‍
b. We may Reject your Deletion Request  In some cases, we may reject your request to delete your account including;
i. To follow a legal rule or requirement.
ii. Where there is a pending court order or lawful request in respect of your account
iii. Where we have a reasonable suspicion in relation to your request or account
iv. In pursuit of public or legitimate interest.  

‍We still Retain some Data While we may close your account, some categories of personal data may be retained in some instances including;
i. Where we are required under the law to retain the personal data;
ii. Where we have a lawful or law enforcement request in relation to the personal data;
iii. Where there is a court order requiring a preservation of personal data
iv. Such other instances which we may communicate to you on a case-by-case basis.  

‍Contact Us If you have any questions about this notice, our privacy compliance program or need to exercise your rights as a data subject, please reach us via any of the following means;  
‍Privacy@ydpay.io  
‍Data Protection Officer – Theophilus Oladipo
‍5th Floor, FF Millenium Towers Victoria Island, Lagos, Nigeria.  

‍