Legal & policies.

Privacy policy

THUNDER PAY PRIVACY POLICY

Last Updated: June 10, 2026

1. Introduction

Thunder Pay (“Thunder”, “we”, “us”, “our”) is owned and operated by ThunderNetwork Limited.

We are committed to protecting the privacy, confidentiality, and security of personal data collected from individuals who access or use our mobile application, website, APIs, products, payment platforms, customer support channels, and related services (collectively, the “Services”).

This Privacy Policy explains the types of personal data we collect, how we collect it, the purposes for which we use it, the lawful basis for processing it, how we share and protect it, how long we retain it, and the rights available to you as a data subject.

This Policy is designed to comply with applicable data protection, financial services, anti-money laundering, counter-terrorism financing, fraud prevention, virtual asset, payment services, and regulatory requirements in jurisdictions where Thunder operates, including Nigeria and any other countries in which our Services become available.

By registering for, accessing, or using Thunder Pay, you acknowledge that you have read and understood this Privacy Policy. Where we rely on consent as the lawful basis for processing, you may withdraw your consent at any time, subject to legal, regulatory, contractual, and operational limitations.


2. Scope of this Policy

This Policy applies to personal data collected or processed through:

• The Thunder Pay mobile application;

• Thunder Pay websites, portals, dashboards, APIs, and online platforms;

• Account registration, onboarding, verification, and KYC processes;

• Cryptocurrency wallet services;

• Crypto-to-fiat payment services;

• Bill payment services;

• Transfers, withdrawals, deposits, and settlement services;

• Customer support channels, email communications, chat systems, and social media interactions;

• Marketing, promotional, and referral programs; and

• Automated technologies used in connection with our Services, including cookies, device logs, analytics tools, and fraud prevention systems.

This Policy does not apply to third-party websites, applications, wallets, exchanges, payment processors, merchants, banking partners, or services that are not owned or controlled by Thunder.

Where you access third-party services through Thunder, the privacy policy of that third party will govern their processing of your personal data.


3. Personal Data We Collect

We collect personal data reasonably necessary to provide secure, compliant, and reliable financial technology services.

The information collected may vary depending on the products you use, your location, your risk profile, regulatory obligations, and the level of verification completed on your account.

3.1 Information You Provide Directly

When you create an account, verify your identity, complete transactions, contact support, or otherwise use our Services, we may collect:

Identity Data

• Full name

• Date of birth

• Gender

• Nationality

• Username

• Customer identification number

• Profile photograph

• Signature

• Other account registration details

Contact Data

• Phone number

• Email address

• Residential address

• Mailing address

• Authorized contact details where applicable

Verification Data

• Bank Verification Number (BVN)

• National Identification Number (NIN)

• Passport information

• Driver’s licence

• National identity card

• Voter’s card

• Selfie photographs

• Facial verification data

• Liveness verification information

• Other government-issued identification documents

Financial Data

• Bank account information

• Naira account details

• Wallet addresses

• Cryptocurrency wallet information

• Payment information

• Settlement details

• Beneficiary information

• Source of funds information

Transaction Data

• Cryptocurrency deposits

• Cryptocurrency withdrawals

• Bill payment records

• Airtime purchases

• Data purchases

• Electricity bill payments

• Cable television subscriptions

• Transfer records

• Transaction references

• Refunds

• Reversals

• Chargebacks

• Dispute records

Compliance Data

• KYC documentation

• Customer due diligence records

• Enhanced due diligence information

• AML/CFT screening results

• Sanctions screening results

• Politically Exposed Person (PEP) screening results

• Risk assessment information

Communication Data

• Support tickets

• Emails

• Chat conversations

• Complaint records

• Feedback submissions

• Survey responses

Marketing Preference Data

• Communication preferences

• Notification settings

• Opt-in and opt-out records


3.2 Information We Collect Automatically

When you access or use Thunder Pay, we may automatically collect:

Device Data

• Device type

• Device model

• Operating system

• Browser type

• Mobile network information

• Device identifiers

• Advertising identifiers

Log and Usage Data

• IP address

• Login records

• Access timestamps

• Session duration

• Features used

• Clickstream data

• Error logs

• Crash reports

Location Data

• IP-based location information

• Approximate device location

• Precise device location where permission has been granted

Security and Fraud Data

• Device fingerprinting information

• Authentication attempts

• Behavioral analytics

• Transaction velocity monitoring

• Suspicious activity indicators

• Account access patterns

Cookies and Tracking Data

• Cookies

• Pixels

• SDKs

• Analytics technologies

• Tracking technologies


3.3 Information from Third Parties

We may receive information about you from:

• Identity verification providers

• Banking partners

• Payment processors

• Cryptocurrency infrastructure providers

• Blockchain analytics providers

• Fraud prevention databases

• Credit reference agencies

• Compliance screening providers

• Regulatory authorities

• Law enforcement agencies

• Merchants

• Business partners

• Public records

• Persons authorized by you


4. Legal Basis for Processing

We process personal data only where we have a lawful basis to do so.

Depending on the circumstances, we may process your personal data on the basis of:

• Your consent;

• Contractual necessity;

• Compliance with legal and regulatory obligations;

• Legitimate business interests including fraud prevention, platform security, dispute resolution, service improvement, risk management, and business continuity; and

• Protection of vital interests or public interest where permitted by law.

Where processing is based on consent, you may withdraw your consent at any time.


5. How We Use Your Personal Data

We may use your personal data to:

• Create, verify, and manage your Thunder Pay account;

• Perform identity verification and KYC checks;

• Facilitate cryptocurrency deposits and withdrawals;

• Process crypto-to-fiat conversions;

• Enable airtime, data, electricity, cable TV, and bill payment services;

• Process transfers and settlements;

• Monitor transactions for suspicious activity;

• Detect and prevent fraud;

• Comply with AML, CFT, sanctions, and regulatory requirements;

• Communicate with you regarding transactions, security alerts, and service updates;

• Provide customer support;

• Improve products and services;

• Conduct analytics and research;

• Personalize user experiences;

• Resolve complaints and disputes;

• Enforce our legal rights and agreements; and

• Fulfill any purpose disclosed at the time information is collected.

We do not sell your personal data.


6. Alerts, Service Communications and Marketing

By creating or using a Thunder Pay account, you agree that we may send:

• Transaction alerts;

• Security notifications;

• Verification requests;

• Service announcements;

• Compliance notifications;

• Regulatory notices;

• Product updates; and

• Marketing communications where permitted by law.

You may opt out of marketing communications at any time.

However, you cannot opt out of essential service, security, compliance, or transaction-related communications.

Thunder will never ask for your password, PIN, OTP, private keys, seed phrases, or complete authentication credentials through email, SMS, or phone calls.


7. Cookies and Similar Technologies

We may use cookies, pixels, SDKs, device identifiers, and similar technologies to:

• Operate our Services;

• Improve user experience;

• Analyze traffic;

• Prevent fraud;

• Secure accounts;

• Remember preferences;

• Measure platform performance; and

• Support marketing activities where permitted.

Disabling certain cookies may affect functionality or security.


8. How We Share Personal Data

We may share personal data only where necessary, lawful, and proportionate.

Recipients may include:

Regulatory Authorities

Including:

• Central Bank of Nigeria (CBN)

• Nigeria Data Protection Commission (NDPC)

• Nigerian Financial Intelligence Unit (NFIU)

• Economic and Financial Crimes Commission (EFCC)

• Securities and Exchange Commission (SEC)

• Tax authorities

• Courts and law enforcement agencies

Financial Partners

Including:

• Banking partners

• Settlement providers

• Payment processors

• Cryptocurrency infrastructure providers

• Virtual asset service providers

Compliance Providers

Including:

• Identity verification providers

• Fraud prevention providers

• AML monitoring providers

• Sanctions screening providers

Service Providers

Including:

• Cloud hosting providers

• Analytics providers

• Cybersecurity providers

• Customer support providers

• Technology vendors

Professional Advisers

Including:

• Auditors

• Lawyers

• Consultants

• Insurers

Corporate Transactions

Where Thunder undergoes a merger, acquisition, restructuring, financing transaction, or sale of assets.


9. International Data Transfers

Your personal data may be processed, stored, or accessed in jurisdictions outside your country of residence.

Where international transfers occur, Thunder will implement appropriate safeguards including:

• Contractual protections;

• Security measures;

• Regulatory approvals where required; and

• Other legally recognized transfer mechanisms.


10. Data Security

Thunder implements technical and organizational measures designed to protect personal data, including:

• Encryption of data in transit and at rest;

• Multi-factor authentication;

• Role-based access controls;

• Secure infrastructure monitoring;

• Fraud detection systems;

• Security audits and reviews;

• Employee confidentiality obligations;

• Vendor security assessments; and

• Incident response procedures.

No method of transmission or storage is completely secure.

Users are responsible for maintaining the confidentiality of passwords, PINs, OTPs, devices, and authentication credentials.


11. Data Retention

We retain personal data for as long as necessary to:

• Provide our Services;

• Maintain account records;

• Fulfill contractual obligations;

• Comply with AML/CFT requirements;

• Satisfy tax and accounting obligations;

• Resolve disputes;

• Enforce agreements; and

• Protect our legal rights.

Certain records may be retained after account closure where required by law or regulatory obligations.


12. Your Data Protection Rights

Subject to applicable law, you may have the right to:

• Access your personal data;

• Correct inaccurate information;

• Update incomplete information;

• Request deletion of personal data;

• Restrict processing in certain circumstances;

• Object to processing;

• Withdraw consent;

• Request data portability where applicable; and

• Lodge complaints with relevant data protection authorities.

Identity verification may be required before fulfilling requests.


13. Automated Decision-Making and Profiling

Thunder may use automated systems to support:

• Fraud detection;

• Risk scoring;

• Identity verification;

• Transaction monitoring;

• Account security;

• Compliance screening; and

• AML/CFT monitoring.

Where legally required, users may request human review of certain automated decisions.


14. Children’s Privacy

Thunder Pay is not intended for individuals under the age of 18.

We do not knowingly collect personal data from minors.

If we become aware that a minor has provided personal information without appropriate authorization, we may take steps to delete the information.


15. Third-Party Links and Services

Our Services may contain links to third-party websites, applications, exchanges, merchants, payment providers, advertisers, or partners.

Thunder is not responsible for the privacy practices, content, or security of third-party services.

Users should review the privacy policies of such third parties before providing personal information.


16. Account Security and User Responsibilities

You are responsible for safeguarding:

• Passwords;

• PINs;

• One-Time Passwords (OTPs);

• Authentication credentials;

• Devices used to access Thunder.

You must notify Thunder immediately if you suspect unauthorized access, credential compromise, fraud, or security incidents.


17. Nigeria-Specific Terms

For users in Nigeria, this Policy is intended to comply with:

• Nigeria Data Protection Act (NDPA);

• Nigeria Data Protection Regulation (NDPR);

• Applicable Central Bank of Nigeria regulations;

• AML/CFT laws;

• Financial services regulations; and

• Other applicable regulatory requirements.

Users may lodge complaints with the Nigeria Data Protection Commission where appropriate.


18. Changes to this Privacy Policy

Thunder may update this Privacy Policy periodically to reflect changes in:

• Law;

• Regulation;

• Technology;

• Product offerings;

• Security practices; or

• Business operations.

Material changes may be communicated through in-app notifications, email, SMS, website notices, or other appropriate channels.

Continued use of the Services following publication of an updated Policy constitutes acknowledgement of the updated Policy.


19. Contact Us

For privacy-related questions, requests, complaints, or to exercise your rights, please contact:

Company: ThunderNetwork Limited

Product: Thunder Pay

Email: support@paywiththunder.com

Website: https://www.paywiththunder.com

Customer Support: Available through the Thunder Pay application and official support channels.

If you are not satisfied with our response, you may contact the appropriate data protection authority in your jurisdiction.


20. Version Control

Policy Owner: ThunderNetwork Limited

Effective Date: June 10, 2026

Review Cycle: At least annually or whenever required by legal, regulatory, operational, security, or product changes.