Privacy Policy

1. Introduction

This Privacy Policy explains how Nexslate Company Limited (“Nexslate,” “we,” “us,” or “our”), the company behind NexumPay, collects, uses, shares, and protects personal data belonging to individuals who use NexumPay's personal wallet, business wallet, merchant APIs, or related services (together, the “Services”).

This Policy applies to customers, business signatories and staff, merchant and API users, and visitors to our website and app. It should be read together with our Terms of Use.

2. Who We Are

Nexslate Company Limited is a company incorporated in Kenya and based in Nairobi. For the purposes of Kenya's Data Protection Act, 2019, Nexslate Company Limited is the data controller for personal data processed through the Services.

You can reach our privacy team at nexslatelimited@gmail.com for any question about this Policy or how we handle your data.

3. Scope of This Policy

This Policy covers personal data we process when you:

• Download the NexumPay app and create a personal or business wallet;
• Complete identity verification (KYC);
• Send, receive, convert, or withdraw money, or make a collection or disbursement via the API;
• Contact our support team or otherwise communicate with us;
• Visit our website or interact with our marketing pages.

4. Information We Collect

4.1 Identity and verification information

Full name, date of birth, national ID or passport number and a copy of the document, a selfie or liveness-check image, nationality, and residential address, collected during KYC onboarding.

4.2 Contact information

Phone number, email address, and — for business wallets — the names and contact details of signatories, directors, or authorized staff.

4.3 Financial and transaction information

Wallet balances, transaction history (amounts, timestamps, counterparties, currency pairs), mobile money account details, linked bank details where applicable, and — for business wallets — payroll and supplier payment records entered by the business.

4.4 Technical and device information

IP address, device identifiers, app version, operating system, and approximate location derived from IP address, collected for fraud prevention and service reliability.

4.5 Information from third parties

We may receive information from mobile money operators, banking partners, and identity-verification providers to confirm a transaction or verify an identity document.

5. How We Use Your Information

• To create and administer your wallet, and to authenticate you when you log in;
• To process collections, disbursements, conversions, and withdrawals you initiate;
• To verify your identity and screen transactions for fraud, money laundering, or terrorist financing;
• To meet regulatory reporting obligations to the Central Bank of Kenya and other applicable regulators;
• To provide customer support and respond to enquiries;
• To maintain the security, integrity, and availability of the Services;
• To improve the Services, including through aggregated, de-identified analytics;
• To communicate service updates, security notices, and — where you have consented — product updates.

6. Legal Bases for Processing

Under the Data Protection Act, 2019 (Kenya), we rely on the following grounds, depending on the activity:

• Performance of a contract — to open and operate your wallet and process transactions you request;
• Compliance with a legal obligation — KYC, AML/CFT screening, and regulatory reporting;
• Legitimate interests — fraud prevention, service security, and improving the Services, balanced against your rights;
• Consent — for optional communications and any processing not covered by the grounds above, which you may withdraw at any time.

7. How We Share Your Information

7.1 Service providers and processors

We share personal data with vetted service providers who process it on our behalf, including cloud infrastructure providers, identity-verification providers, and SMS/one-time-password delivery providers. These providers are contractually bound to protect your data and use it only for the purpose we specify.

7.2 Mobile money and payment partners

To complete a collection, disbursement, or conversion, we share the minimum data necessary (e.g., phone number, amount, reference) with the relevant mobile money operator or banking partner.

7.3 Regulatory and legal disclosures

We disclose personal data where required by law, in response to a valid order from a court or regulator (including the Central Bank of Kenya, the Office of the Data Protection Commissioner, or a Financial Reporting Centre request), or to establish or defend legal claims.

7.4 Business transfers

If Nexslate is party to a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction, subject to this Policy or a successor policy of no less protection.

We do not sell personal data to third parties.

8. Cross-Border Data Transfers

Because NexumPay supports transfers between Uganda and Kenya, and we plan to expand to additional African markets, personal data may be transferred to and processed in countries other than Kenya. Where we transfer personal data outside Kenya, we take the steps required under Section 48 of the Data Protection Act, 2019 — including appropriate contractual safeguards with the recipient — so your data continues to receive an adequate level of protection.

9. Data Retention

We retain personal data for as long as your wallet remains active. After your account is closed, we retain transaction and identity-verification records for the period required under applicable anti-money laundering regulations — typically five to seven years — to meet regulatory recordkeeping obligations, resolve disputes, and enforce our agreements.

10. Your Rights

Under the Data Protection Act, 2019, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate or outdated data;
• Request erasure of data we no longer have a lawful basis to retain;
• Object to or restrict certain processing, including direct marketing;
• Request a portable copy of data you provided to us;
• Withdraw consent at any time, where processing is based on consent;
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe we have mishandled your data.

To exercise any of these rights, contact us at nexslatelimited@gmail.com. We will respond within the timeframe required by law.

11. Security Measures

We protect personal data using encryption in transit (HTTPS/TLS), encryption at rest for sensitive fields, role-based access controls, OTP verification for sensitive actions, continuous audit logging, and regular access reviews, consistent with the security model described in our Security documentation.

No system is completely secure; Section 14 describes what happens if that protection ever fails.

12. Children's Privacy

The Services are not directed at children under 18, and we do not knowingly open wallets for, or collect personal data from, children. If we learn that we have collected a child's data without appropriate consent, we will delete it.

13. Cookies and Similar Technologies

At present, our website does not use tracking or advertising cookies — only what is strictly necessary for the site to function. If this changes, we will update this Policy and, where required by law, ask for your consent first.

14. Data Breach Notification

If a breach of personal data creates a real risk of harm to you, we will notify the ODPC and affected individuals without undue delay, in line with our obligations under the Data Protection Act, 2019, and take immediate steps to contain and remediate the breach.

15. Changes to This Policy

We may update this Policy as our Services evolve or the law changes. We will post the updated Policy with a new effective date, and where changes are material, notify you through the app or by email before they take effect.

16. Contact Us

Questions about this Policy or how we handle your data:

• Email: nexslatelimited@gmail.com
• Post: Nairobi, Kenya