1.1. Skye provides digital wallet services, crypto on/off‑ramp and P2P escrow trading. We act as a data controller for personal data we collect and as a processor in limited cases for enterprise partners.

1.2. This Policy explains our processing in line with the Nigeria Data Protection Act, 2023 (NDPA).

2.1. Directly from you:

2.1.1. Identity & KYC: name, DOB, gender, nationality, NIN/BVN, government ID, photo/selfie, liveness/video, address, occupation, source‑of‑funds/wealth.

2.1.2. Contact: phone, email, mailing address.

2.1.3. Financial & transaction: bank account identifiers (where used), wallet addresses, on‑chain metadata, transaction history, device data, IP/geo approximations.

2.1.4. P2P: trade listings, counterparties, dispute artifacts (e.g., proof of payment), communications.

2.1.5. Collected data is limited to what is necessary for onboarding, service delivery and AML/CFT compliance.

2.2. Automatically via Platform Use:

2.2.1. Device identifiers, IP address, browser metadata, login times and duration

2.2.2. Cookies and similar technologies for security, preferences, and user behavior

2.3. Derived Data:

2.3.1. Risk scores, transaction profiles, business or location trends

3.1. We process personal data to:

3.2. Deliver and manage services, verify identity (KYC), and maintain secure operations

3.3. Conduct AML/CFT checks and comply with regulatory mandates

3.4. Investigate and resolve escalations, disputes, fraud, or suspicious activities

3.5. Enhance platform functionality, detect misuse, and manage user experience preferences

3.6. Deliver optional marketing or promotional content—always subject to consent

4.1. We process personal data under these Nigerian Data Protection Act, 2023(NDPA) recognized bases:

• i. Contract: to create your account, provide wallet and P2P escrow services.
• ii. Legal obligation: to perform CDD, monitoring, and STR/CTR reporting to NFIU under ML(PPA) 2022.
• iii. Legitimate interests: to secure our platforms, prevent fraud, improve services (balanced against your rights).
• iv. Consent: for optional features (e.g., marketing)

5.1. You acknowledge that by opening an account with us and opening or closing Transactions, you will be providing us with personal information within the meaning of the extant Data Protection Act.

5.2. You consent to us processing all such information for the purposes of performing the contract and administering the relationship between you and us.

5.3. You consent to our disclosing such information:

5.4. where we are required to by law;

• 5.4.1. to Associated Companies;
• 5.4.2. to service providers and business partners with whom we have a mutual relationship;
• 5.4.3. to such third parties as we deem reasonable;
• 5.4.4. where it is necessary in order to prevent crime; and
• 5.4.5. to such third parties as we see fit to assist us in enforcing our legal or contractual rights against you including but not limited to debt collection agencies and legal advisors.

5.5. You authorise us, or our agents acting on our behalf, to carry out such credit and identity checks as we may deem necessary or desirable, including requesting a reference from your bank from time to time and you agree to assist us, where necessary, in obtaining such a reference.

5.6. You authorise us or our Associated Companies to telephone or otherwise contact you at any reasonable time in order to discuss any aspect of our business or of our Associated Companies' business or of our Partner's business.

5.7. If you do not wish us or our Associated Companies or our Trading Partners to so contact you for any direct marketing activities, you must inform us in writing.

6.1. Subject to legal exceptions, you can access, rectify, erase, restrict, object, and obtain portability of your personal data; and you can lodge a complaint with the Nigeria Data Protection Commission (NDPC). We will respond without undue delay.

7.1. We use automated tools for fraud and risk scoring (e.g., liveness, anomaly detection). You may request human review of decisions that significantly affect you.

8.1. We share data with:

8.1.1. identity/KYC vendors, sanctions/PEP screening providers, analytics/security vendors, cloud hosting, payment partners, VASPs for Travel Rule compliance,

8.1.2. regulators/law enforcement where legally required. Processors are bound by contracts requiring NDPA‑level safeguards.

8.1.3. Legal Authorities when compelled or permitted by law

8.2. International (cross‑border) transfers

8.2.1. When we transfer personal data outside Nigeria, we ensure:

• i. the recipient jurisdiction or mechanism provides an adequate level of protection (law, BCRs, contractual clauses, certifications), or another condition in section 43 applies; and
• ii. we record the legal basis and adequacy assessment.

8.3. Additional restrictions may apply to categories designated by the NDPC.

9.1. We implement layered security: encryption in transit/at rest, key management, access controls, network segregation, secure SDLC, vulnerability management and incident response. Processors must implement comparable measures.

10.1. KYC and transaction records are retained at least 5 years after relationship termination or the transaction date (longer where investigations or legal holds apply) to satisfy ML(PPA) 2022. Other data follows documented schedules tied to purpose and legal needs.

10.2. Retire or anonymize data that is no longer necessary, subject to legal obligations.

11.1. Skye Wallet maintains high‑tier technical and organizational safeguards, including:

11.2. Encryption in transit and at rest;

11.3. Strict role‑based access control;

11.4. Regular security audits, penetration testing, and vulnerability response;

11.5. A structured incident response plan with breach detection, response, and NDPC notification protocols.

12.1. If a personal data breach occurs that may risk your rights and freedoms, we will notify the NDPC without undue delay and, where feasible, within 72 hours, and will inform affected users where there is a high risk. We document all incidents and our response.

13.1. Our services are not directed to persons under 18. We do not knowingly process children's data without appropriate authorization and safeguards.

14.1. We use cookies/SDKs for core functionality, security, and (with consent) analytics/marketing. You can change preferences in‑app or via browser/device settings. Consent can be withdrawn at any time.

15.1. To exercise rights or contact our email [insert email]. You may also complain to the NDPC if unresolved.

16.1. We may update this Policy from time to time. Changes will be posted with a new effective date. For material changes, users will be notified via in‑app or email alerts.