Privacy Policy

Vestup Financial Services ("we", "us", or "our") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and share your data when you use the Vestup platform.

We comply with the Nigeria Data Protection Act 2023 (NDPA) and its implementing regulations. By using Vestup, you consent to the practices described in this policy.

Identity information: Full name, date of birth, BVN, NIN, government-issued ID details.

Contact information: Email address, phone number, residential address.

Financial information: Bank account details, transaction history, wallet balance, investment records.

Technical information: IP address, browser type, device identifiers, usage logs, and cookies.

Communications: Support messages and any other information you provide when contacting us.

• To verify your identity and comply with KYC/AML requirements
• To create and manage your account and process transactions
• To provide investment services and communicate account activity
• To send transactional emails (deposit confirmations, OTPs, investment updates)
• To detect and prevent fraud and unauthorised access
• To comply with legal and regulatory obligations
• To improve our platform and user experience

We process your data on the following legal bases under the NDPA:

• Contract: processing necessary to provide you with our services
• Legal obligation: KYC, AML, and regulatory reporting requirements
• Legitimate interests: fraud prevention, platform security, product improvement
• Consent: marketing communications (you may withdraw at any time)

We do not sell your personal data. We share information only with:

• Prembly (Identitypass): for BVN and NIN verification
• Paystack: for bank account verification
• Resend: for transactional email delivery
• Supabase: for secure cloud data storage (EU-West region)
• Regulatory authorities: when required by law (CBN, EFCC, SEC Nigeria)

All third-party processors are bound by data processing agreements and required to maintain adequate security standards.

We retain your personal data for as long as your account is active. Upon account closure, we retain data for a minimum of 7 years as required by Nigerian financial regulations. KYC records are retained for the period mandated by the CBN AML/CFT regulations.

We implement industry-standard security measures including:

• TLS encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Row-level security on all database tables
• Hashed storage of transaction PINs (never stored in plaintext)
• Multi-factor authentication for sensitive actions

We use essential cookies necessary for authentication and session management. We do not use advertising or tracking cookies. You may disable non-essential cookies in your browser settings without affecting core functionality.

Under the NDPA, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Object to or restrict certain processing
• Withdraw consent for marketing communications at any time
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC)

To exercise any of these rights, email privacy@vestup.ng.

Vestup does not knowingly collect data from persons under 18 years of age. If we become aware that a minor has registered, we will promptly close the account and delete associated data.

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or an in-app notification at least 14 days before the changes take effect.

For privacy-related enquiries, contact our Data Protection Officer at privacy@vestup.ng.