Last updated 27 October 2026 · Effective 27 October 2026
How Scripe collects, uses and protects personal data, for business owners and their staff, and for the customers they sell to. Written to meet the Nigeria Data Protection Act 2023.
In short
This policy explains how Scripe collects and uses personal data on our website, apps and services. It applies to business owners, their staff, their customers and visitors to our site.
Scripe is a commerce and banking platform for businesses. Scripe is a product of Hilaq Technology Limited, a company registered in Nigeria (RC 8698053), with its registered office at C2, Adeleke Street, Osogbo, Osun State. In this policy, "Scripe", "we" and "us" mean Hilaq Technology Limited.
This policy covers:
Some words we use:
Scripe is not a bank. Business accounts, account numbers, transfers and payouts are provided through licensed partner banks. Those partners also handle personal data under their own privacy policies.
In short
We are responsible for the data we need to run Scripe and meet our legal duties. For a business's own customer records, the business is responsible, and we act on its instructions.
When Scripe is the data controller. We decide why and how this data is used:
When Scripe is a data processor. A business decides why and how this data is used, and we process it only to provide Scripe to that business:
If you are a customer of a business and have a question about your data, contact the business first. It controls that data. We will help the business respond, and you can contact us if you cannot reach it.
The terms that govern our processing for businesses are in Section 22 of our Terms of Service.
In short
We collect what you give us, what is created when you use Scripe, and some data from partners such as banks and identity checkers.
Data you give us
Data created when you use Scripe
Data about customers of businesses
When a customer buys, books or pays through Scripe, we collect what the business's checkout or booking page asks for. This is usually name, email address, phone number and delivery address, plus what was bought and how it was paid for. A business may also import its own customer list or add notes about customers.
Data from others
In short
We use data only where the NDPA gives us a lawful basis. For each purpose, the table shows the basis we rely on.
The NDPA allows processing on a set of lawful bases, including consent, performing a contract, a legal obligation and legitimate interests. This table covers processing where Scripe is the controller.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Creating and running your account, and signing you in | Account, device and security data | Contract |
| Providing commerce features: store, checkout, payment links, invoices, till, bookings, stock and orders | Business, transaction and customer data | Contract (for processor activities, the business's instructions) |
| Opening and running a business account through a partner bank | KYC, KYB and banking data | Legal obligation (CBN KYC and anti-money laundering rules) and contract |
| Liveness check with your selfie | Selfie and ID photo | Legal obligation, and your explicit consent where the law requires it for biometric data |
| Moving money: collections, payouts, transfers and bill payments | Transaction and banking data | Contract |
| Setting and enforcing payout limits, and screening for sanctions and politically exposed persons | KYC, KYB and transaction data | Legal obligation |
| Detecting fraud, money mules and account takeover | Transaction, device and security data | Legal obligation and legitimate interests (keeping Scripe and its users safe) |
| Keeping financial and audit records | Transaction and audit data | Legal obligation |
| Sending service messages: receipts, sign-in codes, security alerts, payout notices | Contact details | Contract |
| Charging the platform fee and billing for message credits | Account, transaction and payment data | Contract |
| Answering support requests | Support messages and account data | Contract and legitimate interests |
| Product analytics and site improvement | Usage and device data | Consent (through our cookie banner) |
| Marketing about Scripe | Contact details | Consent, which you can withdraw at any time |
| Meeting requests from regulators, courts and law enforcement | Any relevant data | Legal obligation |
| Defending or bringing legal claims | Any relevant data | Legitimate interests |
Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for details, and you can object (see Section 9).
Automated checks. Some checks run automatically. For example, we match your BVN details and run a liveness check, and our systems raise risk flags on unusual activity. A flag can lead to a review, a hold or a lower limit. If an automated decision significantly affects you, you can ask for a person to review it.
In short
Each business is responsible for the data of its own customers. It must have a lawful basis, tell customers how it uses their data, and get consent before sending them marketing.
A business that uses Scripe must:
In short
Some providers store or process data outside Nigeria. When that happens, we use the safeguards the NDPA and GAID require.
Several of our providers are based outside Nigeria, mostly in the United States (see Section 6). We transfer personal data outside Nigeria only where the NDPA allows it, for example where:
We keep a record of these transfers and their safeguards. You can ask us for a copy of the safeguards that apply to your data.
In short
We keep data only as long as we need it. Banking and transaction records must be kept for years after an account closes, because anti-money laundering and CBN rules require it.
| Data | How long we keep it |
|---|---|
| Account details | While your account is open, then up to 2 years after closure, unless a longer period below applies |
| KYC and KYB records, including verification documents | At least 5 years after the business relationship ends, as required by the Money Laundering (Prevention and Prohibition) Act 2022 and CBN AML/CFT rules |
| Transaction records: payments, payouts, transfers, bills, refunds | At least 5 years after the transaction, and up to 6 years for accounting and tax records |
| Audit logs and fraud and risk records | 5 years, or longer if they relate to an open case |
| Business customer data (processor role) | While the business keeps its account, then deleted within 90 days of the business closing its account, unless the law requires us to keep it |
| Support messages | 2 years after the request is closed |
| Analytics data | 14 months |
| Marketing consent records | While you are subscribed, and for 3 years after you withdraw consent, as proof |
If the law, a regulator or an open dispute requires us to keep data for longer, we will. When the period ends, we delete the data or make it anonymous.
In short
You can ask to see, correct, delete or move your data, limit or object to how we use it, and withdraw consent. Email [email protected] and we will reply within 30 days.
Under the NDPA, you have the right to:
How to make a request. Email [email protected] from the email address on your account, or contact our Data Protection Officer (see Section 15). We may ask you to confirm your identity first. We will respond within 30 days. If a request is complex, we will tell you if we need more time and why.
Limits. We may not be able to delete some data, such as KYC and transaction records, while the law requires us to keep it. If we cannot meet a request, we will explain why.
Customers of businesses. For data a business holds about you, such as your order history with that business, send your request to the business. We will help the business respond.
Marketing. You can unsubscribe from marketing using the link in any marketing email, or by contacting us.
In short
When the internet drops, the till saves sales on the device and sends them to Scripe when it reconnects. The business is responsible for keeping its devices secure.
Scripe's till can keep selling without an internet connection. While offline, it stores the catalogue, the current shift and any sales made on the device itself. These sales can include what was bought, the amount, the payment method, the staff member and any customer details entered. They are sent to Scripe and removed from the queue once the device reconnects.
Because this data sits on the device until it syncs, businesses should:
Staff sign in to the till with a personal PIN. We store PINs as hashed values only.
In short
We use technical and organisational measures to protect data, including encryption, access controls and audit logs. No system is perfectly secure, so we also plan for incidents.
Our measures include:
Keep your password and PINs private. Tell us at once at [email protected] if you think someone has accessed your account.
In short
If a breach puts people's rights at risk, we will tell the NDPC within 72 hours. If the risk is high, we will also tell the people affected.
A personal data breach is any security incident that leads to personal data being lost, destroyed, changed, disclosed or accessed without permission.
If a breach happens:
In short
Scripe accounts are for adults running businesses. We do not knowingly collect children's data for our own purposes.
You must be 18 or older to create a Scripe account. Under the NDPA, a child is a person under 18.
Scripe is not aimed at children. If we learn that we have collected a child's personal data as controller without the consent of a parent or guardian, we will delete it, unless the law requires us to keep it. Contact [email protected] if you think this has happened.
Some businesses, such as schools, may record data about children through Scripe. In that case, the business is the controller and must get a parent's or guardian's consent (see Section 5).
In short
Our Data Protection Officer handles privacy questions and requests. You can reach them by email or post.
Data Protection Officer: Head of Compliance, Hilaq Technology Limited Email: [email protected] Post: Data Protection Officer, Hilaq Technology Limited, C2, Adeleke Street, Osogbo, Osun State General support: [email protected]
In short
If you are unhappy with how we handle your data, tell us first. You can also complain to the Nigeria Data Protection Commission.
Please contact our Data Protection Officer first, so we can try to put things right.
You also have the right to complain to the Nigeria Data Protection Commission (NDPC), the regulator for data protection in Nigeria:
In short
We will update this policy when our services or the law change. We will tell you before important changes take effect.
When we make a material change, we will tell you by email or in the Scripe dashboard before it takes effect. We will also update the "Last updated" date at the top. If a change needs your consent, we will ask for it.
We keep a record of which version of this policy and our Terms of Service you accepted.
Contact our Data Protection Officer. If you're not satisfied with our answer, you can complain to the Nigeria Data Protection Commission.
[email protected]