PayZilla Privacy Policy

PayZilla Ownership

PayZilla^® is e-commerce payment solution  application that provides services to banks and businesses. It is proprietary product owned by KSMART SOLUTIONS INT’L LTD, a multicompetence technology company offering various enterprise solutions to businesses. The company operates as a corporation registered with the Nigerian Corporate Affairs Commission with RC #1282411.

 

What is PayZilla ?

PayZilla^® is a merchant e-commerce application service provider that authorizes direct payment processing for e-businesses and online retailers. It is a financial service provider platform that works in collaboration with Nigeria banks to provide financial services to its customers. It facilitates a payment transaction by mediating the transfer of information between a payment portal (such as a website, mobile phone or interactive voice response service) and the front end processor or acquiring bank.

 

PayZilla  Privacy Policy

The PayZilla privacy policy describes the process we use to obtain our users personal information, what we do with it and who we may disclose it to.  This includes the User’s biodata (such as name, gender, address, date of birth, contact information), financial records, Bank Verification Number, National Identification Number, amongst other data. The confidentiality of our users’ information is of the utmost importance, and we are obligated to protect and secure it. This Privacy Statement explains the Personal Information that we collect, the reason for the collection, and what we will be doing with it.

 

Irrespective of how you access or use PayZilla payment processing platform and other technological tools, we may obtain, utilize, save, disseminate, and safeguard your information in accordance with this Privacy Statement.

 

In this privacy statement, our Website, the applications and payment processing portal provided by PayZilla, its parent company, or affiliated entities are collectively referred to as the PayZilla “services.” This privacy statement does not apply to third-party services offered by PayZilla Merchants, as they are neither owned nor operated by PayZilla or its parent company. However, this privacy policy covers all operational processes used by the PayZilla platform to process personal data.

 

We may occasionally modify, revise, or review this Privacy Policy document to reflect new services or changes in our Privacy Policy. When we do, we will post any updates on this page. All amendments will be posted on this page, and if they have a significant impact on you, we will notify you by posting an online notice or sending you a letter or email. If you continue to use our services, you consent to any modifications to this Privacy Statement.

 

Dispute Resolution and Complaint Filing

If you have any concerns about this Privacy Policy, please email us at privacy@payzilla.co. Complaints and disputes with regards to the use and disclosure of personal information will be investigated and resolved within thirty (30) days in accordance with this Privacy Statement and the Nigerian Data Protection Regulation.

 

By using or accessing our Services, you agree to the gathering, use, and disclosure of your personal information as defined in this Privacy Statement. Additionally, the PayZilla Terms apply to your use of the services provided in its platform.

 

 

General Overview

This Privacy Policy outlines your rights with respect to the personal information we obtain from you which we use in all our operational processes across all our technological systems that includes our website, payment platforms, Application Programming Interface, Software Applications, , email services, and tools, irrespective of how you use or access them.

 

This Privacy Statement applies to all the services offered by PayZilla and its parent companies.

 

What Personal Information will PayZilla obtain about you?

PayZilla may obtain, utilize, store and share personal information such as:

1. Bio Data; this includes user name, gender, physical contact address, government-issued IDs, date of birth, email address, phone number, gadget information, amongst other things.

These information are collected to allow us  verify your identity, contact you when required and to comply with the Federal government regulatory “Know Your Customer” or “KYC” policy.

 

1. Technological Services Access Data; these are information obtained when a user utilizes and of PayZilla or its parent company’s services. When a user accesses PayZilla services, our servers automatically collate information that your browser sends whenever you visit our website. These data includes links you have clicked, duration of visit, unique gadget identifier, log-in data, location, amongst other details.

 

iii. Financial Records: these relates to users information regarding financial transactions which includes bank account details, Bank Verification Number (BVN), financial transaction details, date, amount, total transaction amount, and other information provided by financial institutions or merchants when we act on their behalf; this also entails details about a payment made when users utilize our products or services

 

1. Promotion and Telecommunications Records: we may obtain the record of your subscription to receive promotional materials from PayZilla or its third party partners. This also includes record of your decision to withdraw from receiving advertising materials from us or our third parties. It also entails documentation of your communication with us.

 

This Privacy Statement only applies to PayZilla services and it does not cover then services of third party companies linked to our various services.. These other websites may place their own cookies, plug-ins, or other files on your computer, collect data, or request personal information. These third-party websites are not under PayZilla control, and we are not responsible for their privacy policies. When utilizing the services of a third party, please consult their privacy policies and configure your browser settings accordingly.

 

How does PayZilla obtain your Personal Data and Why?

When you create a PayZilla Account or utilize any of the services we offer your personal data will be made available to us. Additionally, whenever you contact our customer support team either directly or through the completion of our online forms we will obtain your personal information.

 

However, we will not be able to collect your personal details without you giving us the legal permission to do so. We will request for “Your Consent” to do and you will need to legally consent to our collection of your Personal Information by using our Services.

There is a contractual obligation that provides you access to our services and your Personal Data is needed to effect this contract otherwise you will not be able to access PayZilla services. Additionally, we are mandated by law to obtain and store your Personal Details in order to conform with all applicable Financial regulations, such as Anti-Money Laundering and Counter Terrorist Financing Laws. We check fraudulent activities by confirming your identity using your Personal Information.

 

How does PayZilla make use of  your Personal Data?

We usually obtain your personal information to:

1. Offer you PayZilla
2. Enable us reply and process your questions or requests.

• Enhance the features of our product and services, better design and manage our website content, and gather data which we analyze to develop our products and services.

1. Prevent inappropriate and fraudulent use of our website.
2. Utilize internal and third-party screening tools in other to prevent, detect, and manage the risk of fraud and illegal activities on our platform.
3. Send you promotion and advertising content as well as service updates curated by PayZilla. When we do this we usually give you the option to opt-in or opt-out if you do not wish to participate in our promotion activities.

• Use our internal and third-party tools to authenticate your identity and the information you provide to in accordance with PayZilla legal obligations as required by law.
• Allow us Keep accurate records of all Users of our platform and services.

1. Assist us in resolving any disputes that may arise during the course of utilizing our services, including any investigations conducted by law enforcement or regulatory bodies.

 

How does PayZilla disclose your Personal Data?

PayZilla may disclose or share your Personal Data with third parties which may include our service providers, agents, suppliers, affiliates, subcontractors, PayZilla staff, officers amongst others as may be reasonably necessary for the purposes set out in this policy.

 

PayZilla only shares personal information with Third parties in the following limited conditions:

1. Financial and payment processing services: PayZilla may share payment and transactional data with banks and other entities as needed for our operational activities such as payment processing, credit risk reduction, fraud prevention, or other related financial services when you offer payment information.
2. Partners: We will grant access to personal data across our affiliates and related companies in situations where we operate common data systems or where access is necessary to offer our services and carry out our business operations

• Service providers: For the purposes described in this policy document, we may disclose personal information with vendors or agents working on our behalf to manage various aspects of our operational activities. Such third-party vendors working with/or for us shall be governed by a written contract with PayZilla to ensure adequate protection and security measures for the protection of your personal data  in accordance with the terms of this Privacy Policy.

1. Business transactions: Personal information may be divulged as part of PayZilla business operation or legal proceeding, such as business financing, acquisition, merger, bankruptcy filing, dissolution, or the transferal, divestiture, or sale of all or a portion of our business interest or assets.
2. Security and protection of rights: We may share personal information if we deem it required for the : a) safeguard of PayZilla users especially against fraudulent activities;  b) function and maintenance of the security of our business operational activities and service; c) protection of the rights or property of our company or others, such as enforcing our legal contracts, terms, and guidelines.
3. Legal and law enforcement authorities: We may collect, share, and retain personal information in accordance with relevant laws and when we are undoubtedly convinced that doing so is required to comply with relevant law or respond to valid legal process, such as from law enforcement or other government agencies.

 

In addition, Personal information may be  collected by third-party analytics and marketing firms. These third-party firms may combine data from numerous sites to improve analytics for their own and others’ purposes.

 

How does PayZilla Protect your Personal Information?

PayZilla takes data security seriously and has put in place administrative, technical and physical  safeguards to prevent abuse, loss, unauthorized access, unwanted disclosure, duplication, misuse and unauthorized alterations. To ensure that your personal information does not fall into the wrong hands, the PayZilla website employs a reliable SSL certificate.

Other security assurance measures we employ to protect your personal data include the use of secure servers, data encryption, firewall, Two factor authentication (2FA) via use of OTP  and the limitation of authorization access to staff only in order to accomplish job obligations. Furthermore, to ensure that our security infrastructure are in compliance with industry standards, we carry out periodical security updates of  technology infrastructure.

 

Incidence Response Policy

In the event of breach of your personal data, we maintain a data breach or incidence response actionable procedure to mitigate the impact of the breach. We execute a 6-Phased approach that entails Preparation; Identification; Containment; Eradication; Recovery and Lessons Learned. We act quickly to reduce the impact as much as possible, we identify and secure all affected data, machines, devices and systems, as well as isolate and preserve the compromised data. Then we  change encryption keys and passwords immediately to prevent further access. We further report any breach that compromises your data to the Relevant Authorities within 72 hours of discovery.

 

 

We are committed to conducting our business activities in accordance with the outlined ethics and values contained in this privacy document to ensure the protection and maintenance of the confidentiality of your Personal Information.

 

If you have the impression that your data is not secure, that there are signs of data breach, or that you would like more information about the security of your personal data stored by PayZilla, please contact us at privacy@payzilla.co.

 

How does PayZilla Keep your Personal Data?

PayZilla will only hold your personal Data on our servers for as long as is necessary to offer you our Services.

When you close your Account, PayZilla will retain your personal details on our servers to the extent mandated by law to comply with regulatory requirements and for the purposes of fraud monitoring, detection, and prevention. Where we keep your Personal Information, we do so in accordance with the required statute of limitations.

 

What is PayZilla Encryption Policy?

PayZilla Encryption Policy outlines the guidelines and procedures for the use of encryption technologies within PayZilla. Encryption is a critical component of our data security strategy, aimed at protecting sensitive information, maintaining the privacy of our users and stakeholders, and ensuring compliance with relevant data protection regulations.

 

Our Encryption policy aims  to define the requirements and best practices for the encryption of data and communications across all PayZilla systems, applications, and devices used within the organization. This policy ensures that encryption is consistently applied to protect data at rest, in transit, and during processing and PayZilla encryption policy applies to all employees, contractors, vendors, and third parties who have access to our systems, data, or communication channels.

 

PayZilla Encryption Types:

 

1. Data at Rest Encryption: All sensitive data stored on PayZilla servers, databases, workstations, and portable devices shall be encrypted using strong encryption algorithms.

 

1. Data in Transit Encryption: All data transmitted over public networks or untrusted channels will be encrypted using secure transport layer protocols, such as TLS (Transport Layer Security).

 

1. Email Encryption: All email communications containing sensitive or confidential information will be encrypted using secure email encryption solutions.

 

1. Portable Device Encryption: All laptops, smartphones, tablets, and other portable devices used for PayZilla purposes will have full-disk encryption enabled.

 

1. Database Encryption: All databases containing sensitive data will implement encryption for data at rest and in transit, following industry best practices.

 

1. File Encryption: Sensitive files and documents will be encrypted before being transferred or stored on removable media or cloud storage.

 

PayZilla Encryption Key Management:

1. Encryption keys will be generated, stored, and managed securely, following industry best practices and standards.
2. Access to encryption keys will be restricted to authorized personnel only.
3. Procedures for key rotation, recovery, and revocation will be established and documented.

 

Compliance and Regulations:

 

PayZilla is committed to complying with all applicable data protection and privacy regulations. This includes, but is not limited to, the General Data Protection Regulation (GDPR), the Payment Card Industry Data Security Standard (PCI DSS), and any other relevant industry-specific requirements.

In the event of a security incident or breach involving encrypted data, PayZilla shall follow established incident response procedures to investigate and mitigate the incident.

All employees, contractors, and relevant third parties shall receive training on the proper use of encryption technologies and the importance of data security.

 

What is PayZilla Backup and Restore Policy?

PayZilla Backup and Restore Policy aims to outline the procedures, responsibilities, and guidelines for the backup and restoration of critical data and systems at PayZilla. This policy ensures data integrity, availability, and business continuity and it applies to all employees, contractors, and third parties who have access to PayZilla data and systems.

 

PayZilla classifies Data into three categories:

Critical Data: Includes financial transactions, customer information, and proprietary algorithms. These categories of Data are backup daily.

Important Data: Includes non-critical financial records, operational data, and software configurations. These categories of Data are backup weekly.

General Data: Includes non-critical documents, employee data, and public information. These categories of Data are backup monthly.

 

PayZilla uses industry-standard backup solutions to create full and incremental backups and we implement encryption (at rest and in transit) for all backups. To further mitigate disasters, we store backups in geographically diverse locations.

PayZilla has well defined retention periods for each data category, ensuring compliance with legal and regulatory requirements and we regularly review and update retention policies.

 

Restoration Procedures

In the event of data loss, we shall immediately report the incident to the IT department and identify the cause and extent of the data loss.

Data Restoration shall be prioritized based on its criticality. PayZilla shall follow established procedures for restoring data from backups and verify the integrity of the restored data.

 

Regular data restoration tests shall be conducted to ensure the effectiveness of the backup and restore process.

Appropriate IT Department unit shall be tasked with the responsibility for implementing and managing backup and restore procedures.

 

PayZilla shall conduct regular audits and monitoring  to ensure compliance with this policy, document and report any policy violations or security incidents and review our backup and restoration policy annually or as needed to ensure it remains relevant and effective.

 

PayZilla shall provide training to employees regarding backup and restore procedures and their roles in data protection and maintain detailed documentation of backup and restore procedures, configurations, and incident responses.

 

Enforcement :Non-compliance with this policy may result in disciplinary actions, including termination, and may also have legal consequences.

This Backup and Restore Policy will help PayZilla safeguard critical data, ensure business continuity, and comply with data protection regulations. It shall be communicated to all relevant stakeholders and regularly reviewed and updated as needed.

 

What is PayZilla Password Policy?

PayZilla password policy is a set of requirements to ensure sensitive data is protected, privacy is maintained, and networking systems are robust enough to withstand cyber-attacks. It is designed to enhance our infrastructure security by encouraging account users to employ strong passwords and use them properly. PayZilla password policy is part of the organization’s official regulations and is implemented as part of PayZilla security awareness protocol.

PayZilla password policy employs The Payment Card Industry Data Security Standard (PCI DSS) and entails the following:

1. Passwords should have a minimum length of at least seven characters and contain both numeric and alphabetic characters.
2. We encourage users to change passwords regularly.

• Users are not allowed to submit a new password that is the same as any of the last four passwords used.

1. Password is changed if there is any suspicion or knowledge that the password have been compromised.
2. We may set passwords for first-time use and upon reset to a unique value for each user, and change immediately after the first use.
3. If a session has been idle for more than 15 minutes, we require the user to re-authenticate to re-activate the session.

• We set the lockout duration to a minimum of 30 minutes or until the user’s identity is confirmed.
• We limit repeated access attempts by locking out the user ID after not more than six attempts.

1. We always change vendor-supplied defaults (passwords and settings) and remove or disable unnecessary default accounts before installing a system on the network
2. We authenticate user access to assets with password and authentication token and its usually encrypted during transmission and storage.

 

What are cookies and Why does PayZilla use them?

Cookies are small blocks of data created by a web server while a user browses a website and stored by the user’s web browser on the user’s computer or other device or personal gadgets. When a user visits a website again, the cookie enables the site to recognize the user’s browser. Cookies usually collect and  store a user’s preferences and other data.

PayZilla and its affiliates use cookies and other similar technologies to identify you when you access our websites and utilize our Subscription Services. The main purpose of utilizing coolies on a website is to save you time as they have the capability to inform a company’s server that you have returned to their website, and through your previous data that was saved and stored by coolies on your previous visit, your activities on a partially page can be retrieved.

For instance, if you customize pages on our site or register for any of our Services as a user, a cookie assists us in recalling your specific information on subsequent visits. The information you previously provided can be retrieved, so you can easily use the personalized features.

 

PayZilla can set-up cookies directly on its server, but in addition Third-party vendors or affiliates can also place cookies on our website. Third-party cookies allow third-party functionality or features to be provided on or through our website The parties that set these third-party cookies are able to recognize your computer both when it visits the website in question and when it visits PayZilla websites.

 

PayZilla utilize cookies for multiple reasons. Some cookies are essential and  required for our websites to function optimally. Sometime PayZilla may also use cookies to track and target the interests of our platform users in order to improve their experience on the activities their engage in on our websites and with our Subscription Service. PayZilla, for instance, keeps track of the websites and pages you visit in order to determine which portion of the PayZilla website or Subscription Service is the most popular or utilized. This information is utilized to deliver customized content and promotions within the PayZilla website and Subscription Service to users whose activities reveals an interest in a particular subject area. Third-party affiliates and vendors may place cookies for advertising, analytics, and other purposes on our website

 

There various types of cookies (both PayZilla and Third-party) cookies which we deploy on our website, these are:

 

1. Vital website cookies: These cookies are fundamental to the functionalities of our websites and are strictly required to provide you with services available through our Websites, Subscription Service and Mobile Application and to use and access some of its features.
2. Technical Performance cookies: These cookies are needed to improve the performance and functionality of all PayZilla platforms and the services it provides. Though not a critical cookie, however, without these cookies, certain functionality may become unavailable.
3. Analytics and Personalization cookies: These cookies gather intelligence that is used either collectively to assist us in understanding how our PayZilla platform is being used or how effective our advertising campaigns are, or to help us personalize our websites for you.
4. Marketing cookies: These cookies are used to communicate marketing messages and make them more relevant to you. They perform tasks like blocking the same ad from continuously reappearing, ensuring that ads are displayed adequately for advertisers in an effective manner, and in some cases selecting advertisements that are based on your interests and needs.
5. Social media cookies: These are used to help you to share pages and content that you find interesting on our platform through third party social networking and other websites. We can also use this cookies for marketing activities.

 

What can you do to manage cookies?

You can configure your web browser’s settings to “accept” or “decline” cookies. While choosing to reject certain cookies may limit your access to certain features  on our website, it doesn’t stop or prevent you from using our website. Since the means by which you can reject cookies through your web browser’s settings may vary from browser to browser, you will need to visit the help menu of your browser for more information.

Vital website cookies: You cannot decline these cookies because they are needed to deliver the websites functionalities to you. However, you can block or remove them by modifying your browser settings as outlined above.

 

Concerning Minors

PayZilla websites and applications and the cookies it contain are not directed at individuals under the age of eighteen (18), and we do not deliberately or intentionally collect Personal Information from such minors.

 

If you have reason to believe that PayZilla has unintentionally or inadvertently collected information from a minor, please contact us using the information provided in the section labeled “Contact Us” on our website or send us an email at privacy@payzilla.co of  so that we may investigate and delete such information.

 

How does PayZilla Engage in Marketing to you?

PayZilla may utilize your Personal Data to reach out to you or send you promotion content and information about our products and services. You may exercise your right to decline receiving such communications from us or to completely opt out of receiving marketing content from us. However, its important to note that that even if you opt out of receiving promotion content, we may still send you communications about transactions and our services related to our ongoing business relationship.

We may request permission to send you notifications. Our Services will continue to function if you choose not to grant us permission to send you notifications.

 

Furthermore, for marketing purposes, third parties may place cookies on your computer or mobile device via our Websites. These companies may use information about your visits to this and other websites to provide ads about goods and services in which you may have an interest. Additionally, they may employ technology used to evaluate the effectiveness of ads. This can be achieved through the use of cookies to collect information about your visits to this and other websites in order to provide you with advertising contents regarding goods and services that may be of interest to you. If you decide not to offer your personal contact information, neither PayZilla nor they will be able to identify you based on the information collected.

 

What are your Rights Regarding your Data Obtained by PayZilla?

You have legal rights regarding your personal data. Depending on your location and the applicable laws governing your location, the following are the rights you as a user have with respect to your Personal Information:

• The Right to request for and access any of your Personal Information obtained and retained by PayZilla;
• The Right to have full information regarding your Personal Data;
• The Right to request for modification and amendment of your Personal Data with PayZilla;
• The Right to opt-out of direct marketing, and to demand that PayZilla limit the processing of your personal information;
• The Right to opt-out automated decision making and processing of your personal data;
• The Right to make a complaint to the National Information Technology Development Agency (NITDA);

Furthermore, you have the option to deactivate your Account at any time. You may disable your Account at any time by contacting us through the “Contact Us” section of our website at www.payzilla.co or by sending us an email at privacy@payzilla.co.

 

If you wish to exercise any of the aforementioned rights, please contact us using the details listed above. Before processing your request, we may request proof of your identity if we are unsure of your identity for security purposes.

 

 

PayZilla Privacy and Data Protection Administrator

PayZilla has a Data Protection Administrator (DPA) whose sole responsibility is to direct and administer the company’s data protection strategy and its execution to ensure PayZilla is compliance NDPR regulatory requirement. The DPA is an expert on data privacy and protection principles and is well accustomed to NDPR’s provisions.

 

How PayZilla Trains its Employee to Protect your Personal  Data

PayZilla ensures that its employees who obtain and process your personal details receive adequate data privacy and protection training ensuring that they acquire the necessary knowledge, expertise, and proficiency necessary to effectively achieve the compliance framework defined in this Privacy Policy and the Nigerian Data Protection Regulation (NDPR) with regard to the protection of Personal Information. Annually, PayZilla designs a data privacy and protection capacity building plan for its employees in accordance with the NDPR requirement.

 

What is PayZilla Third Party Connection Policy?

The objective of PayZilla Third Party Connection Policy is to maintain the security of information accessed by third parties. These standards are designed to minimize the potential exposure to PayZilla from damages that may result from unauthorized use of company resources. The purpose of this policy is to ensure contracts and Service Level Agreements (SLA) follow best practices for third-party integrations and that PayZilla IT infrastructure remains secure.

1. Third-party applications must integrate with PayZilla authentication services (e.g., CAS, SAML, SSO) for end-user and administrative access.
2. Third-party integrations must connect via an Application Programming Interface (API).

• Third-parties must allow the ability to audit controls.

1. Third-parties must allow logging accessibility (e.g., troubleshooting, security, monitoring, modifying verbosity).
2. Third-parties must provide PayZilla with SLA, disaster recovery, and business continuity plans.
3. The third-party’s disaster recovery plan should match PayZilla service-level expectations.

• Third-parties should attest to or allow PayZilla to validate the disaster recovery and business continuity plans.
• Third-parties must follow the Data in Transit, Data at Rest policies, and Data Classification Guidelines.

1. Third-parties must demonstrate standard security certification to ensure PayZilla data is secure.
2. Third-party services must abide by PayZilla provisioning and de-provisioning policies and procedures.
3. PayZilla Chief Information Security Officer (CISO) must authorize deviations from this policy’s requirements after informing the management .

 

What is PayZilla Physical Security Policy?

PayZilla is committed to maintaining a secure physical environment to protect its employees, assets, and sensitive information. This Physical Security Policy outlines the guidelines and procedures that all employees, contractors, and visitors must adhere to while on PayZilla  premises. PayZilla Physical Security Policy aims to prevent unauthorized access, theft, vandalism, and other physical threats.

 

Access Control: only authorized personnel are allowed access to PayZilla facilities. Access authorization is determined based on job roles and responsibilities. Employees must request access for visitors or contractors in advance, and visitors must sign in at the front desk upon arrival.

PayZilla shall implement access control systems, such as electronic keycards or biometric scanners, to restrict access to specific areas and it shall be regularly maintained and updated to ensure their effectiveness.

 

Perimeter Security: PayZilla shall maintain secure perimeters, including fencing, gates, and access points, to prevent unauthorized entry. Security cameras will monitor perimeter areas for suspicious activity. All entrances to company buildings will be monitored and controlled. Visitors and contractors must be escorted at all times while inside company premises.

Intrusion detection and alarm systems will be in place to alert security personnel in case of unauthorized entry or suspicious activity.

Secure areas, such as data centers and server rooms, will have restricted access and additional security measures in place and sensitive information and assets will be stored in secure cabinets or safes when not in use.

 

Employee Responsibilities: All employees must wear company-issued ID badges prominently at all times while on company property. Lost or stolen ID badges must be reported immediately to the security team.

Employees are responsible for reporting any security breaches, suspicious activity, or security vulnerabilities to their immediate supervisor and the security team.

All employees will receive security awareness training upon hire and regular refresher training to stay informed about physical security policies and procedures. Training records will be maintained, and employees who fail to complete required training may face disciplinary action.

Violation of this Physical Security Policy may result in disciplinary action, up to and including termination of employment.

PayZilla shall cooperate with law enforcement agencies in the event of criminal activity on company premises.

 

 

 

PREPARED BY:

KSMART SOLUTIONS INTERNATIONAL