PrivacyPolicy

Who we are

Xtopay is run by Sendexa Limited, which decides how the personal details in this policy are used. We're registered with Ghana's Data Protection Commission as a data controller (number DPC registration number), and we follow the Data Protection Act, 2012 (Act 843).

This policy covers this website, the Xtopay dashboard, the pay pages at xtopay.me, the checkout, our API and the emails we send.

Whose details we keep

• Businesses and their teams: the people who sign up for Xtopay and the people they invite.
• Customers: people who pay a business through Xtopay. The business decides what its form asks, and it gets those details with the payment. For what the business does with them, read its own privacy policy; for what we do, read on.
• Visitors to this website and to pay pages.

What we keep about businesses and their teams

• Your account: your name, email and photo, and your password, which we keep only as a one-way hash we can't turn back into it.
• Your business: its name, username and type, its email and phone number, its registered name, registration number and Tax Identification Number, what it does, its address and digital address, its website and social pages, and its logo.
• Identity checks: the owner's Ghana Card and a selfie, taken by Sendexa Verify and matched against the National Identification Authority's records. Sendexa Verify keeps the pictures; we keep the result.
• Payout accounts: the Mobile Money numbers and bank accounts you add, and the name each is registered in, which we ask the network or bank for.
• Sign-in and security: your two-step sign-in secret (sealed, so it can't be read from our database), your signed-in sessions, with the device's internet address and browser, and a log of what your team does in the dashboard.
• Your API use: each request to the API, with the address it came from and what it asked for.
• Your money: your payments, balance, payouts, transfers and fees.
• Talking to us: what you tell us when you contact support, and whether our emails to you were delivered.

What we keep about customers

• Your name and phone number, which every payment needs (Mobile Money prompts go to that number).
• Your email, if the business asks for it, so we can send your receipt.
• Anything else the business's form asks, such as a note or your answers to its questions.
• The payment: its amount, what it was for, when, how you paid (your network, or that it was a card) and its result.

If you pay by card, you type your card's details on our payment partner's page, not ours. We never see or keep your card number.

What we keep about visits

When you open a pay page, we count the visit for the business, so it can see how many people came and where from (a QR code, a WhatsApp message, or the website that sent you). To count each visitor once, we keep a random number in your browser. It isn't linked to your name or number.

We don't use outside analytics, advertising or tracking on pay pages or the checkout. Our Cookie Policy lists everything we keep in your browser.

Why we use these details

We use personal details only to:

• run your account and take, settle and pay out payments (because it's needed for our agreement with you);
• check who businesses are, prevent fraud and money laundering, and keep records, as Ghana's laws require of us;
• keep Xtopay and its users safe, for example by spotting sign-ins or payments that don't look right (our legitimate interest);
• send receipts, invoices and the emails your account needs, such as alerts when your payout accounts change;
• answer you when you contact us; and
• send you news about Xtopay, only if you've agreed. You can stop it at any time.

We don't sell personal details, and we don't use customers' details to market to them.

Who we share them with

• The business you pay, if you're a customer: it gets what you entered on its form, with the payment.
• appsNmobile, our payment partner, and the mobile money networks, banks and card schemes they work with, to take payments, pay out and check account names.
• Sendexa's other products, also run by Sendexa Limited: Examail, which sends our emails; Sendexa Verify, which checks owners' identities; and the Identity API, which can check account names.
• Our hosting providers, which run our servers and database: hosting providers and where.
• The authorities, such as the Bank of Ghana, the Financial Intelligence Centre, the police or a court, when the law requires it.
• Our professional advisers, such as lawyers and auditors, who must keep them confidential.
• A company that takes over Xtopay, if that ever happens, which must keep to this policy.

Everyone we share details with for our work may use them only to do that work for us, and must keep them safe.

Details kept outside Ghana

Our servers and database are run by our hosting providers in [the country]. Where personal details leave Ghana, we make sure they're protected as Act 843 requires.

How long we keep them

We keep details only as long as we need them, and then delete them or make them anonymous.

How we keep them safe

Owners must use two-step sign-in, secrets are sealed in our database, card numbers never reach us, and our staff see only what their work needs, behind a code every time they sign in. Our Security page says more. If a breach puts your details at risk, we'll tell you and the Data Protection Commission as the law requires.

Your rights

Under the Data Protection Act, you can ask us to:

• tell you what we keep about you, and give you a copy;
• correct details that are wrong or out of date;
• delete details we no longer need, unless the law makes us keep them (payment records, for example);
• stop using your details for a purpose you object to; and
• stop sending you marketing.

Write to privacy@xtopay.co. We may need to check it's you before we answer, and we'll answer within 21 days. If you're a customer and your question is about what a business does with your details, ask the business too.

If you're unhappy with our answer, you can complain to the Data Protection Commission (dataprotection.org.gh).

Children

Xtopay accounts are for adults: you must be 18 or over to sign up. We don't knowingly keep details about children, except what a business or a parent enters when paying.

Changes to this policy

When we change this policy, we change the date at the top of this page. If a change matters to how we use your details, we'll email businesses before it takes effect.

Contact us

Questions about your details: privacy@xtopay.co, or write to Sendexa Limited, VX-0117-5279, AKATSI BYPASS NEAR MIGHTY GAS STATION, AKATSI, GHANA.