Your data.
Your control.

Who We Are & This Policy

This Privacy Policy is issued by Pressend Solutions Inc., a Nigerian corporation ("Pressend", "we", "our", "us"). We operate the Pressend payment platform, mobile applications, merchant services, and all associated digital products.

This Policy explains how we collect, use, store, share, and protect personal data when you use our Services. It applies to all users — consumers, merchants, beneficiaries, and job applicants — globally. Where region-specific laws (CBN, NDPR) impose additional obligations, we describe those in dedicated sections.

Our Data Protection Officer (DPO) can be reached at dpo@pressend.xyz. Our national representative address is Pressend Solution., Flat 1, Udeh Philip, Along Tina Nweze Street, Abakaliki

What We Collect

We collect only the data necessary to operate a secure payment service. Here is a full account of the categories we collect and why.

Biometric Data

Pressend handles Biometric Data with exceptional care. This section explains exactly how Face Pay, Palm Pay, and fingerprint data are handled. These practices comply with the Illinois Biometric Information Privacy Act (BIPA), GDPR Article 9, and all applicable biometric data regulations.

• Biometric templates (face geometry maps, palm vein hashes) are generated and stored exclusively on your enrolled device within the hardware-secured enclave (Apple Secure Enclave or Android StrongBox).
• Pressend's servers never receive, store, or process raw biometric data. What is transmitted is a one-time encrypted match confirmation that cannot be reverse-engineered into biometric information.
• Biometric data is automatically purged from your device if you disable the feature, delete the app, or factory-reset your device.
• You can withdraw biometric consent at any time by removing your biometric enrolment in Pressend Settings. This does not affect prior authorised transactions.
• We will never sell, license, profit from, or disclose your biometric data to any third party for any commercial purpose.
• Biometric data is not included in data portability exports because it does not reside on our servers.

How We Use Your Data

We use the data we collect for the following specific purposes. We do not use your data for purposes beyond those listed without obtaining fresh consent or establishing a new legal basis.

Legal Basis for Processing

Under 9PSB and equivalent frameworks, we process personal data only where we have a valid legal basis. The bases we rely upon are:

• Contract Performance: Processing necessary to provide the payment services you've signed up for. Without this, we cannot operate your account.
• Legal Obligation: AML/KYC checks, transaction record-keeping for tax authorities, responding to lawful government requests.
• Legitimate Interests: Fraud detection, security monitoring, product analytics (where your interests do not override ours). We document and regularly review these assessments.
• Consent: Marketing communications, biometric enrolment, Panic Mode location sharing with emergency contacts, and Posthumous Configuration. You may withdraw consent at any time without affecting prior processing.
• Vital Interests: Sharing location data with emergency services during an active Panic Mode alert where life may be at risk.

Sharing Your Data

We do not sell your data. We share it only with the following categories of recipients, and only to the extent necessary:

• Payment processors and banking partners — to complete the financial transactions you initiate (e.g. card network operators, correspondent banks). These entities are bound by PCI-DSS and equivalent standards.
• Identity verification providers — KYC and AML screening partners who verify your identity during onboarding. Data shared is limited to what is legally required.
• Cloud infrastructure providers — AWS and GCP host Pressend's backend infrastructure. Both operate under binding data processing agreements with appropriate security certifications.
• Fraud and security vendors — risk scoring services that help us detect unusual transaction patterns. These vendors process anonymised or pseudonymised data.
• Emergency contacts (Panic Mode) — only the contacts you personally designate, only when Panic Mode is activated by you.
• Law enforcement and regulators — where required by law, valid court order, or where we believe disclosure is necessary to prevent imminent harm.
• Beneficiaries (Posthumous Config) — only after the inactivity threshold is reached and beneficiary identity is verified.

Data Transfers

Pressend operates nationwide. Your personal data may be transferred to and processed in states outside your home jurisdiction, including the United States, the United Kingdom, the European Union, and Singapore. We ensure such transfers comply with applicable law through the following mechanisms:

Data Retention

We retain your data only for as long as necessary for the purpose it was collected, or as required by law. Below are our standard retention periods:

Upon account deletion, we anonymise or delete personal data within 30 days, except where retention is required by law or is necessary for pending dispute resolution.

Security

We apply financial-grade security practices to protect your data. Our measures include:

• AES-256 encryption at rest for all personal data stored on our servers.
• TLS 1.3 for all data in transit between your device and Pressend infrastructure.
• Hardware Security Modules (HSMs) for cryptographic key management.
• Zero-trust network architecture — no internal service trusts another without explicit authentication.
• Annual third-party penetration tests and SOC 2 Type II audit.
• PCI-DSS Level 1 certification for payment card data environments.
• Bug bounty programme at security@Pressend.xyz — responsible disclosure rewarded.

In the event of a personal data breach affecting your rights and freedoms, we will notify you within 72 hours of becoming aware of the breach, as required by GDPR Article 33.

Children's Privacy

Pressend is not directed to or intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child under 18 has created a Pressend account, please contact us immediately at legal@Pressend.xyz and we will investigate and delete the account promptly.

Exercising Your Rights

You have the following rights over your personal data. Most can be exercised directly from the Pressend app under Settings → Privacy. For requests not supported in-app, contact our DPO at dpo@Pressend.xyz. We will respond within 30 days (GDPR) or 45 days (CCPA).

Changes to This Policy

We review this Privacy Policy at least annually and whenever there are material changes to our data practices, applicable law, or our products. When we make material changes, we will notify you by email and in-app at least 30 days before changes take effect. For significant changes to how we handle Biometric Data, we will request fresh explicit consent.

The date at the top of this page reflects when the policy was last updated. Previous versions are available on request from dpo@Pressend.xyz.

Contact Our DPO

For any privacy question, data rights request, or concern about how we handle your personal data, contact our Data Protection Officer: