Privacy policy

Controller: Spenda Africa Limited

Contact email: company@spenda.africa

Spenda acts as a data controller in respect of personal data processed through the Services, unless stated otherwise in this Privacy Policy.

This Privacy Policy applies to the Services provided via the Spenda website, mobile application, or widget integration (the "Application"), including USD card issuance, crypto deposit, crypto transfer and swap, and Naira virtual account features.

Our Services are not directed to children under 18. We do not knowingly collect information from children under 18. If, as a parent or guardian, you become aware that your child has provided us with information without your consent, please contact us using the details in Section 13 (Contact Us).

Depending on how you interact with Spenda, we may collect the following categories of personal data:

• Identity Data: name, date of birth, gender, nationality, government-issued identification documents;
• Contact Data: email address, phone number, residential address;
• Account Data: usernames, preferences, settings, wallet identifiers;

Verification Data

The specific verification data we collect depends on the KYC level you complete (see Section 6, Identity Verification and Verification Tiers):

• Level 1 (Biometric Verification): Bank Verification Number (BVN) and/or National Identification Number (NIN), and a live selfie photo used for liveness and facial-match checks;
• Level 2 (Document-Based Verification): an image of a valid government-issued identification document (international passport, driver's licence, or voter's card), and a live selfie photo used for liveness and facial-match checks.

Card Data

In connection with our USD card feature, provided in partnership with our card issuing partner, we may collect and process:

• Card application and issuance data, including your card token and card reference number;
• Card transaction data, including authorisation, spend, and merchant data associated with your card;
• Digital wallet provisioning data where you add your card to Apple Pay or Google Pay, including device account numbers and tokenisation identifiers issued by the relevant wallet provider;
• Card status and limit information.

We do not offer Naira-denominated cards. All cards issued through the Application are denominated in US Dollars.

Crypto Data

In connection with our crypto deposit, transfer, and swap features, we may collect and process:

• On-demand deposit wallet addresses generated for you within the Application;
• Blockchain transaction data associated with crypto sent to or from your Spenda wallet address, including transaction hashes and amounts;
• External wallet addresses you transfer crypto to when using our crypto transfer (stablecoin transfer) feature;
• Conversion data where deposited crypto is automatically converted to Naira, or used to fund your USD card;
• Data shared with or received from our crypto liquidity, custody, or exchange infrastructure partner(s).

Virtual Account Data

In connection with our Naira virtual account feature, we may collect and process:

• Your dedicated Naira virtual account number and the issuing bank's details;
• Naira deposit and funding transaction records;
• Records of how your Naira balance is used, including crypto purchases, USD card funding, and bill payments made through the Application.

• Transaction Data: payment references, contribution records, and transaction history across card, crypto, and Naira virtual account features;
• Technical Data: IP address, device identifiers, browser type, mobile network information, location derived from GPS-enabled services, logs;
• Communications: messages, support requests, and correspondence with us.

We do not knowingly collect personal data from children unless permitted by applicable law.

We use personal data to:

• Provide, operate, and improve the Services, including our USD card, crypto deposit, crypto transfer and swap, Naira virtual account features and any other service feature we may add from time to time;
• Verify your identity at the applicable KYC level and comply with legal and regulatory obligations, including AML/CFT requirements;
• Issue and administer your USD card through our partner(s), process card transactions, and enable Apple Pay and Google Pay provisioning;
• Generate deposit wallet addresses, process crypto deposits, transfers, and swaps, and convert crypto to Naira where applicable;
• Open and administer your Naira virtual account and process Naira funding, crypto purchases, card funding, and bill payments;
• Prevent fraud, abuse, and security incidents;
• Communicate with users regarding accounts, services, or support;
• Comply with applicable laws and enforce our terms.

We process personal data only where permitted by law. Our legal bases may include:

• Consent, where you have given clear permission;
• Performance of a contract, where processing is necessary to provide requested services, including your card, crypto, or virtual account features;
• Legal obligations, including identity verification and financial compliance requirements under Nigerian and other applicable law;
• Legitimate interests, such as platform security, fraud prevention, and service improvement, where such interests are not overridden by your rights.

Spenda operates a two-tier Know Your Customer (KYC) framework. The tier you complete determines which features of the Application, including card issuance, crypto deposit, crypto transfer and swap, and Naira virtual account features, are available to you.

Level 1 KYC: Biometric Verification

Level 1 is our basic, entry-level onboarding tier, currently directed at users in the Nigerian market. To complete Level 1, you must submit:

• At least one government-linked biometric identifier: your Bank Verification Number (BVN) or your National Identification Number (NIN); and
• A live selfie photo, used to run a liveness check confirming you are physically present and that you match the biometric records associated with your BVN or NIN.

At Level 1, you can access stablecoin (crypto) transfers and Naira bank transfers, subject to the daily limits set out below.

Level 2 KYC: Document-Based Proof of Identity

Level 2 is our advanced verification tier for Nigerian users who require a higher account status. As Spenda expands into markets outside Nigeria, where BVN and NIN are not available, Level 2 will become the default entry-level verification standard for users in those regions. To complete Level 2, you must submit:

• A clear photo or image of a valid, government-issued physical identification document, such as an international or national passport, a driver's licence, or a voter's card; and
• A live selfie photo, used to run a liveness check confirming you are the legitimate owner of the submitted document.

Level 2 is required to fund your Naira virtual account and to create a USD card. Level 2 also unlocks higher daily limits on stablecoin transfers and Naira bank transfers, as set out below.

Feature Access and Transaction Limits

• Crypto deposits: available at Level 1 and Level 2, with no daily limit.
• Naira virtual account funding and USD card creation: require Level 2.
• USD card spend: limited to $10,000 per day, regardless of KYC level.
• Naira bank transfers: limited to ₦10,000,000 per day at Level 1, and ₦20,000,000 per day at Level 2.
• Stablecoin (crypto) transfers: limited to $10,000 per day at Level 1, and $20,000 per day at Level 2.

Spenda may amend these limits from time to time for risk, compliance, or product reasons, and will notify you of material changes in accordance with Section 14 (Changes to This Privacy Policy).

Verification data may be processed directly by Spenda or by an identity verification service provider acting on our instructions. We do not guarantee the completeness, accuracy, or suitability of identity data received from third parties and may require additional verification.

We may share personal data with:

• Identity verification and compliance service providers;
• Our USD card issuing and processing partner, in connection with card application, issuance, and transaction processing;
• Apple and Google, where you choose to add your Spenda card to Apple Pay or Google Pay, for the purpose of digital wallet provisioning;
• Our crypto liquidity, custody, or exchange infrastructure partner(s), in connection with crypto deposit, transfer, and swap processing;
• Our Naira virtual account banking partners, in connection with virtual account issuance and Naira funding;
• Payment and financial service providers;
• Technology and infrastructure providers;
• Regulatory authorities or law enforcement where required by law;
• Third parties where you have requested or authorised such sharing.

We do not sell personal data.

Personal data may be transferred and processed outside your country of residence, including where our USD card issuing and processing partner, our crypto infrastructure partners, or our virtual account banking partners operate servers or systems abroad. Where this occurs, we implement appropriate safeguards, such as contractual protections, and will endeavour to ensure that such jurisdictions maintain data protection standards no less protective than those in force in Nigeria.

We retain personal data only for as long as necessary to provide the Services and to comply with legal and regulatory obligations. Retention periods may vary depending on the type of data and legal requirements, including:

• Transaction information, including card, crypto, and virtual account transaction records, will be retained for a minimum period of 5 years following the date of the transaction, in line with applicable AML/CFT recordkeeping requirements;
• Account information will be retained until you delete your account on the Application;
• Verification data (Level 1 or Level 2) will be retained for as long as required under applicable KYC/AML regulation;
• Information used for product and marketing communication will be retained as long as you have given consent for its use.

We do not sell personal data.

Depending on your jurisdiction, you may have the right to:

• Access your personal data;
• Request correction or deletion;
• Object to or restrict processing;
• Withdraw consent (where applicable);
• Request data portability.

Requests can be made by contacting us using the details in Section 13 (Contact Us).

We may process your personal data to contact you or send you marketing content about our products, services, or surveys. You may object to such contact or opt out at any time. If you opt out of marketing content, we may still send you messages relating to transactions and other communications necessary for our ongoing service relationship.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including for card, crypto, and virtual account data. However, no system is completely secure.

If you have questions or concerns about this Privacy Policy or our data practices, please contact:

Email: company@spenda.africa

Website: https://spenda.africa/

By using Spenda's Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

We may update this Privacy Policy from time to time. If a change is material, we will notify you before it takes effect. Updates will be posted on this page with a revised "Last Modified" date.

Last Modified: 4th September 2026