Privacy Policy

This Privacy Policy explains how NexaPay (operated by Elicate Technologies Limited, a company registered in the Republic of Zambia) collects, uses, stores, shares, and protects personal information through our mobile money payment gateway platform ("Platform").

NexaPay provides a unified mobile money payment gateway enabling businesses and developers to accept digital payments across Zambia, Botswana, Zimbabwe, and Namibia. All payment processing is facilitated through direct integrations with licensed mobile money network operators in each supported country, including MTN Mobile Money, Airtel Money, Zamtel, EcoCash, OneMoney, Telecash, Orange Money, MyZaka, BTC Mobile, MTC MobiPay, and TN Mobile. NexaPay does not rely on third-party payment aggregators — we interface directly with these networks on your behalf.

This Policy covers all data handling by NexaPay across our Platform, APIs, merchant dashboard, payment links, and all associated services. By using NexaPay, you consent to the collection and use of your information as described in this Policy. If you do not agree with this Policy, please do not use the Platform.

This Policy applies to:

• Merchants: Businesses and individuals who register for a Merchant Account to accept payments through NexaPay across Zambia, Botswana, Zimbabwe, or Namibia.
• Customers (Payers): Individuals who make payments to Merchants through the NexaPay Platform, including through Payment Links, checkout pages, or merchant-integrated payment forms.
• Website Visitors: Anyone who visits the NexaPay website, documentation pages, or any other publicly accessible page on the Platform.
• API Users: Developers and technical teams who access and integrate the NexaPay API on behalf of Merchant businesses.

Different types of users may have different data collected about them. Sections 3 through 7 describe in detail what data is collected and how it is used for each category.

3.1 Merchant Registration Data

When you create a Merchant Account (via email/password or Google authentication), we collect:

• Full legal name
• Business name and registration number (where applicable)
• Email address
• Phone number (mandatory for account verification and OTP)
• Password — stored as a secure hash using industry-standard bcrypt hashing; we never store plain-text passwords
• Google account information (if signing up with Google): name, email, profile picture
• Business address and country of operation (Zambia, Botswana, Zimbabwe, or Namibia)
• KYC documents submitted for account verification (e.g. National ID, business registration certificate)
• Designated settlement bank account or mobile money wallet details

3.2 Customer (Payer) Transaction Data

When a Customer makes a payment through NexaPay, we collect:

• Customer name (as provided by the Merchant or entered by the Customer)
• Mobile phone number
• Mobile money network (e.g. MTN, Airtel, Zamtel, EcoCash, Orange Money, MTC MobiPay)
• Transaction amount and currency (ZMW, BWP, ZWL, USD, or NAD)
• Transaction reference number
• Transaction status and timestamps
• Country of transaction

3.3 API Usage Data

We automatically collect data about your use of our API, including:

• API endpoints accessed
• Request timestamps and response times
• API key identifiers (hashed, not the actual key values)
• Response status codes
• Error messages (for debugging and monitoring)
• IP addresses of API requests (for fraud detection and rate limiting)

3.4 Dashboard & Website Usage Data

When you visit our website or use the merchant dashboard, we may collect:

• Browser type and version
• Device type and operating system
• IP address
• Pages visited and time spent on pages
• Referral source

This data is collected through NexaPay's privacy-friendly analytics tools. We collect only aggregated and anonymised usage data to improve the Platform. No personal identifiers are attached to analytics data.

3.5 Webhook Delivery Data

When we deliver webhooks to your server, we record:

• Webhook endpoint URL
• Delivery status (success/failure)
• HTTP response codes from your server
• Delivery timestamps and retry attempts

We use the information we collect for the following purposes:

4.1 Core Service Delivery

• Processing mobile money payments on your behalf across supported countries and networks.
• Authenticating your API requests and dashboard access.
• Managing your Merchant Account, including account verification and status management.
• Issuing and managing API keys (pk_live_, sk_live_, pk_test_, sk_test_).
• Delivering webhook notifications about transaction status changes.
• Generating transaction reports and analytics visible in your dashboard.
• Processing settlements and payouts to your designated account.

4.2 Security & Fraud Prevention

• Detecting and preventing fraudulent transactions and suspicious payment patterns.
• Monitoring for unauthorised access to accounts or the API.
• Investigating suspicious activity and potential Terms of Service violations.
• Complying with Anti-Money Laundering (AML) and Know Your Customer (KYC) requirements as mandated by financial regulators in each supported country.

4.3 Communication

• Sending important account notifications (verification status, security alerts, policy changes).
• Providing customer support when you contact us.
• Sending service updates and technical notices about the Platform.
• Notifying you of settlement completions and transaction summaries.

4.4 Platform Improvement

• Analysing usage patterns to improve the Platform's performance, reliability, and features.
• Debugging and fixing technical issues.
• Developing new features and services based on aggregated usage data.

4.5 Legal Compliance

• Complying with applicable laws, regulations, and legal processes in Zambia, Botswana, Zimbabwe, Namibia, and other relevant jurisdictions.
• Responding to lawful requests from government authorities, financial regulators, and law enforcement agencies.
• Enforcing our Terms of Service and protecting our legal rights.
• Maintaining financial records as required by applicable tax and financial regulations.

We do not sell your personal information. We share your information only in the following limited circumstances:

5.1 Mobile Money Network Operators (Payment Processing)

To process mobile money payments on your behalf, NexaPay shares the minimum necessary transaction data directly with the relevant mobile money network operator (e.g. MTN, Airtel, Zamtel, EcoCash, Orange Money, MTC MobiPay). The data shared includes:

• Customer phone number
• Customer name
• Payment amount and currency
• Mobile money network identifier
• Transaction reference
• Merchant identifier (for receipts and reconciliation)

Each mobile money operator processes this data in accordance with their own privacy policy and applicable regulatory requirements. NexaPay does not share your API keys, passwords, or any data beyond what is strictly necessary for payment processing with any mobile money operator.

5.2 Secure Cloud Infrastructure

Your account data and transaction records are stored on NexaPay's secure cloud infrastructure. Data is stored with enterprise-grade encryption, access controls, and audit logging. Our infrastructure providers process data in accordance with applicable data processing agreements and international data protection standards.

5.3 Hosting & CDN Provider

The NexaPay Platform is hosted on a global enterprise hosting infrastructure. Basic request metadata (IP addresses, request headers) may be processed by our hosting provider for purposes including DDoS protection, performance optimisation, and edge security. Our hosting provider does not have access to your account credentials or transaction data.

5.4 Webhook Queue System

We use a reliable webhook queue system for guaranteed webhook delivery. Webhook payloads (containing transaction data) are temporarily queued for delivery to your webhook endpoint. This data is encrypted in transit and at rest and is not retained beyond the delivery window.

5.5 Legal & Regulatory Disclosures

We may disclose your information if required to:

• Comply with a legal obligation, court order, or government request.
• Protect the rights, safety, or property of NexaPay, our Merchants, or the public.
• Enforce our Terms of Service.
• Respond to requests from the Bank of Zambia, Financial Intelligence Centre (FIC), Bank of Botswana, Reserve Bank of Zimbabwe, Bank of Namibia, or other relevant regulatory bodies.

5.6 Business Transfers

If Elicate Technologies Limited is involved in a merger, acquisition, restructuring, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control via email and Dashboard notification, and your data will continue to be governed by this Privacy Policy or its successor.

We take the security of your data seriously and implement multiple layers of protection across all NexaPay systems.

6.1 Encryption

• In Transit: All data transmitted to and from NexaPay is encrypted using TLS 1.2+ (HTTPS). This includes API calls, dashboard access, webhook deliveries, and all mobile network operator communications.
• At Rest: All data stored in NexaPay's databases is encrypted at rest using AES-256 encryption. Webhook queue data is also encrypted at rest.

6.2 Credential Security

• Passwords: Merchant passwords are never stored in plain text. We use industry-standard bcrypt hashing with per-user salts.
• API Secret Keys: Secret keys are hashed using SHA-256 before storage. We store only the cryptographic hash — the original key cannot be recovered from our database. If you lose your secret key, you must rotate to a new one.
• Internal Credentials: NexaPay's internal API credentials for connecting to mobile money operators are stored as encrypted environment variables and are never exposed to Merchants or in any client-side code.

6.3 Security Standards & Certifications

NexaPay's payment processing infrastructure adheres to the following security standards:

• PCI-DSS Level 1: The highest level of payment security certification, requiring annual audits by a Qualified Security Assessor.
• ISO 27001: International standard for information security management systems.
• SOC 2 Type II: Independent verification of security, availability, and confidentiality controls.
• Real-Time Fraud Monitoring: Machine learning-based fraud detection systems that analyse transaction patterns in real time across all four countries.
• Multi-Factor Authentication: For all administrative access to NexaPay's internal systems.

6.4 Infrastructure Security

• Hosting: NexaPay is hosted on enterprise cloud infrastructure that provides automatic DDoS protection, a global CDN, and edge network security.
• Database: All databases use automatic encryption, fine-grained access controls, and full audit logging of all data operations.
• Access Controls: Strict role-based access controls (RBAC) are enforced for all internal systems. Administrative access requires multi-factor authentication. All internal access is logged and regularly audited.

6.5 Incident Response

In the event of a data breach or security incident that affects your personal information, we will:

• Investigate and contain the breach promptly.
• Notify affected users without undue delay and within the timeframes required by applicable data protection law.
• Report the breach to relevant regulatory authorities as required by law (within 72 hours where mandated).
• Take corrective action to prevent recurrence and document the incident and response.

We retain your data for the following periods, after which we will securely delete or irreversibly anonymise the data so that it can no longer be associated with you:

After the applicable retention period expires, we will securely delete or anonymise the data so that it can no longer be associated with you. Note that certain data may need to be retained longer if required by an ongoing legal proceeding, regulatory investigation, or dispute resolution process.

Depending on your location and applicable law, you may have the following rights regarding your personal information. These rights apply to both Merchants and Customers (Payers):

To exercise any of these rights, please contact us at support@nexapay.com. We will respond to your request within 30 days. Please note that some requests may be limited by our legal obligations — for example, we cannot delete transaction records required for financial compliance (see Section 7).

NexaPay uses minimal cookies and tracking technologies. We do not use advertising cookies or third-party tracking.

9.1 Essential Cookies

These are required for the Platform to function and cannot be disabled:

• Authentication Tokens: Secure, HTTP-only tokens stored in your browser to keep you signed in to the merchant dashboard. These expire automatically and are invalidated on sign-out.
• Session Data: Temporary data needed to maintain your session state (e.g. CSRF protection tokens, current tab state).

9.2 Analytics

We use privacy-friendly, anonymised analytics to understand how our website and dashboard are used. Our analytics system does not use cookies for tracking and does not collect personally identifiable information. It collects only anonymised page view data and basic performance metrics. Analytics data is aggregated and cannot be used to identify individual users.

9.3 No Third-Party Advertising

We do NOT use any advertising cookies, tracking pixels, retargeting scripts, or third-party ad networks on our Platform. We do not sell or share your browsing behaviour with advertisers under any circumstances.

NexaPay is not intended for use by individuals under the age of 18. Our services are designed for business Merchants and adult consumers conducting financial transactions.

We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected information from a person under 18, we will take immediate steps to delete that information promptly from our systems.

If you believe that a child under 18 has provided personal information to us, please contact us immediately at support@nexapay.com and we will act accordingly.

Your data may be processed in countries outside your country of residence due to the nature of our service infrastructure and mobile money network operations. NexaPay operates across Zambia, Botswana, Zimbabwe, and Namibia, and our service providers may have infrastructure in multiple regions.

Our key service providers and the data flows involved are:

• Mobile Money Network Operators: Each operator (MTN, Airtel, Zamtel, EcoCash, Orange Money, MTC MobiPay, etc.) processes transaction data within their own national and regional infrastructure in accordance with local regulatory requirements.
• Cloud Infrastructure Provider: Merchant account data and transaction records are stored in secure data centres. Data may be replicated across regions for redundancy and disaster recovery.
• Hosting & CDN Infrastructure: NexaPay's Platform is served through a global hosting network with edge locations to ensure fast access from all four supported countries.
• Webhook Queue System: Webhook queue processing may occur in data centre locations within or outside the Southern African region.

All our service providers are required to maintain appropriate data protection standards consistent with applicable law. Where data is transferred internationally, it is protected by encryption in transit and contractual data processing agreements that impose equivalent data protection obligations. NexaPay does not transfer personal data to countries that do not provide an adequate level of data protection without implementing appropriate safeguards.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or the expansion of our Services to new countries. When we make material changes:

• We will update the "Last updated" date at the top of this page.
• We will notify you via email to your registered email address or through a notification in the merchant dashboard.
• We will provide at least 30 days' notice before material changes take effect, giving you time to review the updated Policy.
• For significant changes affecting how we process sensitive data, we may request your explicit re-consent.

Your continued use of the Platform after the effective date of the updated Policy constitutes your acceptance of the changes. If you do not agree with the revised Policy, you must cease using the Platform and may request account closure.

NexaPay operates in compliance with applicable data protection legislation in each supported country. Below are the primary regulatory frameworks that govern our data handling practices:

🇿🇲 Zambia

NexaPay complies with the Data Protection Act No. 3 of 2021 of the Republic of Zambia and any regulations issued thereunder. We are committed to upholding the data protection principles established by the Zambia Information and Communications Technology Authority (ZICTA) and the Office of the Data Protection Commissioner. If you believe your data protection rights under Zambian law have been violated, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Zambia.

🇧🇼 Botswana

NexaPay's operations in Botswana comply with the Data Protection Act of 2018 and the oversight of the Information and Data Privacy Commission (IDPC) of Botswana. Botswana-based Merchants and Payers may lodge data protection complaints with the IDPC.

🇿🇼 Zimbabwe

NexaPay complies with Zimbabwe's Cyber and Data Protection Act (Chapter 12:07) and relevant provisions under the oversight of the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ). Zimbabwe-based users may seek regulatory recourse through POTRAZ.

🇳🇦 Namibia

NexaPay's operations in Namibia are conducted in compliance with Namibia's applicable data protection provisions and the oversight of the Communications Regulatory Authority of Namibia (CRAN). Namibia-based users may address data protection concerns with CRAN or through Namibian courts.

General Data Protection Principles

Across all jurisdictions, NexaPay adheres to the following core data protection principles:

• Lawfulness, Fairness & Transparency: We process personal data lawfully and transparently.
• Purpose Limitation: Data is collected for specified, explicit purposes and not further processed in incompatible ways.
• Data Minimisation: We collect only the data that is necessary for the stated purpose.
• Accuracy: We take reasonable steps to ensure data is accurate and kept up to date.
• Storage Limitation: Data is kept only as long as necessary (see Section 7).
• Integrity & Confidentiality: Data is processed securely and protected against unauthorised access or loss (see Section 6).
• Accountability: NexaPay is responsible for and can demonstrate compliance with these principles.

If you have any questions about this Privacy Policy, our data practices, or wish to exercise your data subject rights, please contact our Data Protection Officer: