VurexPrivacy Policy — Vaultr Technologies Ltd
Vaultr Technologies Ltd • Version 1.0 • Effective 4 October 2026
Compliant with the Nigeria Data Protection Act (NDPA) 2023
Table of Contents
1. Introduction & Scope
This Privacy Policy explains how Vaultr Technologies Ltd ("we", "us", or "our") collects, uses, stores, and protects personal data when you use our services and visit our website at https://usevurex.com. This policy is issued in compliance with the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR). It applies to all personal data processed by Vaultr Technologies Ltd, whether collected online or offline.
Effective Date: 2026-10-04.
We are committed to protecting your privacy and ensuring that your personal data is handled responsibly and in accordance with applicable data protection legislation.
2. Data We Collect
Vaultr Technologies Ltd collects the following categories of personal data in the course of providing our services. Data may be collected directly from you (e.g., through forms, account registration, or correspondence) or automatically (e.g., through cookies, server logs, and similar technologies).
Identity & Contact Information:
Full Name: first name, last name, middle name, title.
Contact Details: email address, phone number, postal address.
Government-Issued Identifiers: NIN, passport number, driver's license number, voter's card number.
Account Credentials: username, hashed password, security questions.
Financial Information:
Payment Information: credit/debit card number, bank account number, billing address.
Bank Verification Number (BVN): BVN.
Technical & Behavioral Data:
Device & Browser Information: IP address, browser type, operating system, device identifiers.
Location Data: GPS coordinates, city, country, timezone.
Cookies & Tracking Technologies: cookie identifiers, pixel tags, local storage data.
Sensitive / Special-Category Data:
Biometric Data: fingerprints, facial recognition data, voiceprints.
We only collect personal data that is adequate, relevant, and limited to what is necessary for the purposes described in this policy, in accordance with the NDPA 2023.
3. Legal Basis for Processing
Vaultr Technologies Ltd processes personal data under one or more of the following lawful bases as prescribed by the Nigeria Data Protection Act (NDPA) 2023:
Consent: where you have given clear, informed, and voluntary consent for specific processing activities (NDPA Section 25).
Contract: where processing is necessary for the performance of a contract to which you are a party, or to take pre-contractual steps at your request (NDPA Section 25).
Legal Obligation: where processing is required for compliance with a legal obligation to which we are subject under Nigerian law.
Legitimate Interest: where processing is necessary for our legitimate interests (such as fraud prevention and network security), provided those interests are not overridden by your rights and freedoms (NDPA Section 25).
We will always inform you of the specific legal basis applicable to each processing activity at the time of data collection.
4. How We Use Your Data
We process the personal data we collect for the following purposes:
Service Delivery — to provide, maintain, and improve the services you have requested from us
Analytics — to analyse usage patterns and improve user experience
Legal Compliance — to meet our obligations under Nigerian law, including the NDPA 2023
Fraud Prevention — to detect, prevent, and respond to fraud, security threats, and abuse
Marketing — to send promotional communications where you have opted in to receive them
We will not process your personal data for purposes incompatible with those stated above without providing you with prior notice and, where required by the NDPA, obtaining your consent.
5. Data Sharing & Disclosure
Vaultr Technologies Ltd does not sell personal data under any circumstances.
To facilitate escrow transactions, verify user identities, and ensure regulatory compliance, we share specific personal data with trusted, licensed third-party processors. This includes:
Financial Service Partners: We securely transmit required identity and financial data (including Bank Verification Numbers) to licensed Banking-as-a-Service (BaaS) and payment processing partners to create virtual accounts, execute fiat transactions, and perform mandatory Anti-Money Laundering (AML) checks.
Cloud Infrastructure Providers: We utilize secure, enterprise-grade cloud hosting partners to route, store, and process platform data.
Regulatory Authorities: We may disclose personal data where strictly required by law, regulation, or valid legal process, including requests from Nigerian regulatory and law enforcement agencies.
All third-party partners acting on our behalf are bound by strict data processing agreements and are required to implement appropriate technical safeguards in compliance with the NDPA 2023. We do not permit our third-party service providers to use your personal data for their own independent marketing or commercial purposes.
6. Your Rights as a Data Subject
Under the Nigeria Data Protection Act (NDPA) 2023, you are entitled to the following rights regarding your personal data:
1. Right of Access — You may request confirmation of whether we process your personal data and obtain a copy of that data (NDPA Section 34(1)(a)–(b)).
2. Right to Rectification — You may request correction of inaccurate or incomplete personal data we hold about you (NDPA Section 34(1)(c)).
3. Right to Erasure — You may request deletion of your personal data where there is no compelling legal reason for its continued processing (NDPA Section 34(1)(d), Section 34(2)).
4. Right to Restrict Processing — You may request that we limit the processing of your personal data in certain circumstances (NDPA Section 34(1)(e)).
5. Right to Withdraw Consent — Where processing is based on consent, you may withdraw that consent at any time (NDPA Section 35), without affecting the lawfulness of processing carried out prior to withdrawal.
6. Right to Object — You may object to the processing of your personal data where processing is based on legitimate interest or is carried out for direct marketing purposes (NDPA Section 36).
7. Right Not to Be Subject to Automated Decisions — You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects (NDPA Section 37).
8. Right to Data Portability — You may request to receive your personal data in a structured, commonly used, and machine-readable format (NDPA Section 38).
To exercise any of these rights, please contact us at support@usevurex.com. We will respond to your request within 30 days (extendable in complex cases per NDPC GAID 2025). If you are unsatisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) under NDPA Section 46(1).
7. Data Security Measures
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:
Encryption of personal data in transit (TLS 1.2+) and at rest (AES-256).
Access controls and least-privilege principles for all systems handling personal data.
Regular security assessments, penetration testing, and vulnerability scanning.
Staff training on data protection obligations and information security best practices.
Incident response procedures aligned with NDPA breach notification requirements (72-hour notification to NDPC).
Compliance with Payment Card Industry Data Security Standard (PCI-DSS) for cardholder data protection.
End-to-end encryption of financial transactions.
Multi-factor authentication for account access.
While we employ industry-standard safeguards, no method of electronic transmission or storage is entirely secure. If you become aware of any security incident affecting your data, please contact us immediately at support@usevurex.com.
8. Contact Information
If you have questions, concerns, or requests regarding this privacy policy or our data protection practices, please contact us:
Organisation: Vaultr Technologies Ltd
Email: support@usevurex.com
Address: 14 Opia road kwale Delta state.
Website: https://usevurex.com
Data Protection Officer: Vaultr data protection team
DPO Email: dpo@usevurex.com
You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data protection rights have been infringed.
Nigeria Data Protection Commission
Website: https://ndpc.gov.ng
Email: info@ndpc.gov.ng
9. Cross-Border Data Transfers
Where we transfer personal data outside Nigeria, we do so in strict compliance with Sections 43 and 44 of the NDPA 2023. We ensure that any cross-border transfer of personal data is subject to one or more of the following safeguards:
The receiving country has been assessed by the NDPC as providing an adequate level of data protection.
We have put in place appropriate contractual safeguards, such as Standard Contractual Clauses approved by the NDPC.
You have provided explicit consent to the transfer after being informed of the associated risks.
The transfer is necessary for the performance of a contract between you and us, or for pre-contractual steps taken at your request.
The NDPC has granted an administrative authorisation for the transfer.
10. Automated Decision-Making & Profiling
In accordance with Section 37 of the NDPA 2023, we inform you of any automated decision-making processes, including profiling, that produce legal effects or similarly significant effects on you.
Where we use automated decision-making:
We will inform you that automated processing is being used and provide meaningful information about the logic involved.
You have the right to request human intervention in any automated decision.
You have the right to express your point of view and contest the decision.
We will carry out regular reviews of automated decision-making systems to ensure fairness, accuracy, and absence of bias.
We will not base automated decisions solely on sensitive personal data unless you have given explicit consent or the processing is authorised by Nigerian law.
You may object to automated decision-making at any time by contacting us using the details provided in this policy.
11. Data Retention Schedule
Vaultr Technologies Ltd retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Nigerian law. Our retention periods are determined based on the following criteria:
The nature and sensitivity of the personal data.
The purposes for which the data is processed.
Legal, regulatory, and contractual obligations (including NDPA 2023 requirements).
Legitimate business needs such as maintaining records for audits, dispute resolution, and regulatory examinations.
General retention periods:
Account data: retained for the duration of your relationship with us, plus three (3) years.
Communication records: retained for two (2) years from the date of correspondence.
Analytics and usage data: retained in identifiable form for twelve (12) months, then aggregated or anonymised.
Financial transaction records are retained for a minimum of six (6) years in compliance with the Central Bank of Nigeria (CBN) guidelines and the Money Laundering (Prevention and Prohibition) Act.
When personal data is no longer required, it is securely deleted or irreversibly anonymised in accordance with our internal data retention and disposal policy.