Draft — not yet reviewed by counsel
This document is a working draft prepared to describe how the service actually operates. It has not been reviewed or approved by a qualified legal practitioner, it is not yet in force, and it should not be relied on. Sections marked [FOR COUNSEL] are deliberately unwritten.
Legal
Privacy notice
How Appiawave handles personal data, under the Nigeria Data Protection Act.
1. Controller
Appiawave (RC 1787250), 16B Adeniyi Jones, Ikeja, Lagos, Nigeria. Contact: info@appiawave.co.za. [FOR COUNSEL] — whether a Data Protection Officer must be appointed and named here.
2. This website
This website does not use cookies and does not carry a contact form. We use Vercel Analytics and Vercel Speed Insights, which are cookieless: they record aggregate page views and performance measurements and do not build a profile of you or track you across sites. The site is hosted by Vercel, which processes your IP address in order to serve the page.
Fonts are served by Google Fonts, which means your browser makes a request to Google when the page loads. [FOR COUNSEL] — whether this requires disclosure as an international transfer, and whether fonts should be self-hosted to avoid it.
3. If you contact us
If you email us, message us on WhatsApp, or book a demo through our scheduling provider, we receive whatever you choose to send: typically your name, business name, email address, phone number and the substance of your enquiry. We use it to respond and to assess whether to onboard you.
4. If you become a merchant
We process your business registration details, the identity details of authorised representatives, your bank account details, and transaction records. Where you configure a split, we process your beneficiaries' account numbers and the account names returned by their banks.
5. If you use AppiaPay
We process the identity data you supply at each verification tier — email and phone at Tier 1, BVN at Tier 2, NIN and address at Tier 3 — together with your transaction history, and the meter, smartcard or phone numbers you pay bills against.
6. Lawful basis, retention, sharing, transfers, your rights
[FOR COUNSEL] — deliberately unwritten. The lawful basis for each processing purpose, retention periods (including any statutory minimum applicable to payment records), the named processors and partner institutions with whom data is shared, any transfers outside Nigeria, and the mechanism by which a data subject exercises their rights, all require drafting and verification against actual system behaviour.
Named parties we already disclose elsewhere on this site and which are likely to belong in that section: Providus Bank, Globus Bank, licensed card processors, and Picckr for the fulfilment pilot.
7. Complaints
See our complaints procedure. [FOR COUNSEL] — the route of escalation to the Nigeria Data Protection Commission.