ZUKA · LEGAL
Zuka Product Privacy Notice
1. About this notice
This Privacy Notice explains how Zuka Solutions Limited ("Zuka Solutions", "we", "us" or "our") processes personal data when you register for, access, communicate with or use Zuka, including through WhatsApp, getzuka.co and related customer-support channels (together, the "Service").
Zuka is a product operated by Zuka Solutions Limited. Zuka uses infrastructure supplied by Anchor Software Limited and works with licensed financial institutions and other service providers to make regulated financial services available. Those organisations may process personal data under their own legal obligations and privacy notices, as further described below.
This notice does not cover the separate Zuka Solutions corporate website at zuka-solutions.com, which has its own Website Privacy Notice.
2. Who is responsible for your personal data
Zuka Solutions Limited is responsible for the purposes and means of processing described in this notice, except where a licensed financial institution, Anchor, Meta/WhatsApp or another provider independently determines how and why it processes personal data under applicable law or its own service terms.
Privacy and support email: hello@getzuka.co
3. Eligibility and children
Zuka is intended only for individuals aged 18 or older who meet the eligibility requirements communicated during onboarding. We do not knowingly open accounts for or provide the Service to children. If you believe a person under 18 has provided personal data to us, contact hello@getzuka.co.
4. Personal data we collect
4.1 Registration and identity data
We may collect your name, date of birth, telephone number, email address where provided, country and residency information, Bank Verification Number (BVN), the result of BVN verification, and identity attributes returned or confirmed through the verification process. The initial public-beta onboarding is designed to use BVN and does not request NIN or a selfie as a separate onboarding credential.
4.2 Account and financial data
We may process account identifiers, assigned account details, balances, transaction amounts, dates, timestamps, counterparties, destination and originating institutions, payment references, narrations, beneficiary information, status, reversals, refunds, disputes, limits and other records required to provide and reconcile the Service.
4.3 WhatsApp and communications data
When you use Zuka through WhatsApp, we may process your telephone number, WhatsApp profile name and information you make visible, messages, commands, media or documents you send, message identifiers, timestamps, delivery and read status, language, consent preferences, support history and the responses provided by Zuka. Meta/WhatsApp also processes account, device, usage and technical data under the terms applicable to its services.
4.4 Technical, device and security data
We and our providers may process Internet Protocol address, browser and device information, operating system, session and request data, approximate location inferred from technical information, authentication events, device or telephone-number changes, security alerts, fraud indicators, logs and diagnostic information.
4.5 Compliance, risk and support data
We may process sanctions or watchlist results, risk and fraud assessments, source-of-funds or transaction explanations where required, complaint and dispute records, call or support notes, evidence submitted for recovery or investigation, and information required by a partner financial institution, regulator, court or law-enforcement authority.
5. How we obtain personal data
We obtain personal data directly from you; from your interaction with Zuka and WhatsApp; from Anchor, licensed financial institutions, identity-verification sources and payment networks; from transaction counterparties; from service providers; and from public, regulatory or law-enforcement sources where permitted by law.
6. Why we process personal data
| Purpose | Typical data | Proposed lawful basis |
|---|---|---|
| Register and verify an eligible user | Identity, BVN, contact and verification results | Steps before contract; contract; legal obligation |
| Provide, authenticate and administer the Service | Account, instruction, WhatsApp and device data | Contract; legitimate interests |
| Process, reconcile and support financial activity | Account, transaction, counterparty and status data | Contract; legal obligation; legitimate interests |
| Prevent fraud, misuse and security incidents | Identity, technical, behavioural, risk and transaction data | Legal obligation; legitimate interests |
| Meet KYC, AML, sanctions and regulatory duties | Identity, BVN, transaction and compliance data | Legal obligation; substantial public interest where applicable |
| Provide support and resolve complaints | Identity, contact, message, account and dispute data | Contract; legal obligation; legitimate interests |
| Improve reliability and public-beta performance | De-identified or limited usage, diagnostic and support data | Legitimate interests; consent where required |
| Send marketing or optional product messages | Contact details, preferences and engagement | Consent where required, or another lawful basis permitted by law |
| Establish, exercise or defend legal rights | Relevant account, communication and transaction records | Legal obligation; legitimate interests |
Where processing is based on consent, you may withdraw consent without affecting earlier lawful processing. Some data is necessary to enter into or perform the service agreement or satisfy legal and partner requirements. If you do not provide it, we may be unable to register you or continue providing the Service.
7. BVN verification
We use your BVN to verify identity, reduce duplicate or fraudulent registrations, satisfy onboarding and compliance requirements, and support account security. We will request your affirmative authorisation before submitting your BVN for verification. Your BVN is not a password and should not be shared in an ordinary WhatsApp message; use only the secure process presented by Zuka.
BVN verification may be performed through Anchor, a licensed financial institution or an authorised identity-verification source. The verification result and relevant identity attributes may be returned to us and our regulated partners. We do not use BVN for unrelated advertising or sell it to third parties.
8. Automated tools and decision-making
Zuka may use rules, risk models and automated tools to authenticate requests, detect fraud, screen activity, apply limits, route support and determine whether a transaction or account requires review. This may result in a request being delayed, declined or referred for investigation. Where a decision based solely on automated processing has a legal or similarly significant effect, you may request information, express your view and ask for human review by contacting hello@getzuka.co, subject to lawful restrictions.
9. Who receives personal data
- Anchor Software Limited and its authorised infrastructure providers;
- licensed banks, payment-service providers, payment networks and other regulated financial institutions involved in providing or settling the Service;
- Meta/WhatsApp and approved business-messaging or customer-support providers;
- identity-verification, fraud-prevention, sanctions-screening and compliance providers;
- hosting, database, security, monitoring, analytics, communications and professional service providers acting under appropriate obligations;
- transaction counterparties and their financial institutions where necessary to execute, trace, reverse or resolve a transaction;
- regulators, courts, law-enforcement bodies and public authorities where disclosure is required or permitted by law; and
- a genuine prospective investor, buyer or transaction adviser under appropriate confidentiality safeguards.
We do not sell personal data. Providers acting as our processors must follow documented instructions, protect personal data and use it only for authorised purposes. Some recipients, particularly regulated institutions and Meta/WhatsApp, may also act independently for specific processing activities.
10. International transfers
Some providers, including communications and cloud providers, may process personal data outside Nigeria. We will use a transfer basis permitted by the Nigeria Data Protection Act 2023, such as an adequate jurisdiction, appropriate contractual and organisational safeguards, or another lawful exception. You may request information about applicable safeguards by contacting hello@getzuka.co.
11. Retention
We keep personal data only for as long as necessary for the Service, security, disputes and legal, accounting, AML, regulatory and partner obligations. The proposed public-beta schedule is:
| Record | Proposed retention period or criterion |
|---|---|
| Incomplete onboarding information | Up to 90 days after the last onboarding activity, unless required for fraud prevention or law |
| Account, BVN/KYC and transaction records | For the account relationship and provisionally at least five years after closure or the relevant transaction, or longer where law or a regulated partner requires |
| WhatsApp and support records | Up to 24 months after the last substantive interaction, unless part of the regulated account, complaint, fraud or transaction record |
| Routine security and diagnostic logs | Up to 12 months, unless required for an active investigation |
| Consent and opt-out records | While permission is active and for as long as reasonably needed afterward to demonstrate and honour the preference |
| Complaints, disputes and legal matters | Until final resolution and expiry of applicable regulatory or limitation periods |
We may securely delete or anonymise data earlier where it is no longer needed. Anonymised information that can no longer identify you may be retained for security, statistical and service-improvement purposes.
12. Security and account protection
We use administrative, technical and organisational safeguards designed to protect personal data, including access controls, encryption where appropriate, secure configurations, monitoring, provider due diligence, authentication controls and incident-response procedures. No system can be guaranteed completely secure.
Protect your telephone, SIM, WhatsApp account, PINs and one-time passcodes. Zuka will not ask you to disclose a password, PIN or one-time passcode in an ordinary chat. Contact hello@getzuka.co promptly if your device or SIM is lost, your telephone number changes, you suspect unauthorised access, or you receive a suspicious message claiming to be Zuka.
13. Marketing and WhatsApp preferences
We may send service, security, account and transaction communications necessary to provide or protect the Service. We will send optional marketing messages only where permitted by law and WhatsApp policies. You may opt out of marketing by replying "STOP" or contacting hello@getzuka.co. Opting out of marketing does not stop essential service or security communications while your account remains open.
14. Your rights
Subject to applicable law and lawful limitations, you may request information about processing; access to personal data; correction; deletion; restriction; objection; withdrawal of consent; portability of eligible data; and human review of a qualifying automated decision. You may also complain to the Nigeria Data Protection Commission.
Send a request to hello@getzuka.cowith the subject "Privacy Request". We may ask for proportionate proof of identity or authority. We will respond within the legally required period and explain any lawful reason a request cannot be fulfilled in full. Deleting personal data does not necessarily require deletion of regulated KYC, transaction, fraud, complaint or legal records that must be retained.
15. Account closure and data deletion
You may request account closure at hello@getzuka.co. Closure may require identity verification, settlement of pending activity, withdrawal or transfer of remaining funds, resolution of restrictions, and completion of required steps with Anchor or the relevant licensed institution. After closure, we will delete or anonymise data that is no longer required and retain records that must be kept for legal, regulatory, security, dispute or partner purposes.
17. Complaints
Send privacy complaints to hello@getzuka.co. We will investigate and may coordinate with Anchor or the relevant licensed institution. You may also complain to the Nigeria Data Protection Commission through ndpc.gov.ng. This does not limit any other right or financial-services complaint route available under law.
18. Changes to this notice
We may update this notice as the public beta, providers, legal requirements or processing practices change. We will publish the revised notice with a new last-updated date and provide additional notice where a material change requires it. Where consent is legally required for a new purpose, we will request it.