Privacy Policy

We handle two broad groups of data. The first comes from the website: business contact details and what you submit in an application or enquiry. The second comes from using the gateway: operation records, access logs and the documents we review when we check a business.

How long we keep data depends on why we hold it. We do not apply one fixed number of days or years to everything.

We share data only when an operation needs it or when the law requires it.

You can ask to see, correct, restrict or delete your data. We first confirm who you are, then assess the request under the law that applies.

For questions about this policy, use our contact form for privacy questions.

This policy applies to people who interact with Payment Gateway Africa in a business context. That includes visitors to our website, people who send us an enquiry or merchant application, and the staff of merchants and platforms who use our payment gateway.

Our gateway handles pay-ins, payouts and merchant settlement in Kenya, Egypt, Ethiopia, Senegal, Tunisia, Mali and Guinea. Payment operations can involve data about the people who pay or receive funds. Where that happens, this policy describes how such data is treated as part of operation records.

Other documents also govern your use of our services. These include our terms of service and our cookie notice, which explains how cookies and similar technologies work on this website.

Website and enquiry data. When you use our contact or application forms, we receive the business contact details you enter. These can include your name, business email, company name and company website. We also receive any project details you add, such as target countries, payment methods, expected volume range, preferred integration type and your message.

Operation records. When a merchant processes payments through the gateway, we keep records of each pay-in, payout and settlement. These records can include details of the people involved in an operation, to the extent the payment method and the operation require them.

Access logs. When merchant users sign in or connect to our systems, we log access events. This lets us keep a trace of who reached which part of the service.

Business verification materials. Before onboarding a merchant, we review information about the business and the people connected to it. Our merchant review and KYB process explains what this review involves.

We use enquiry and application data to reply to you, assess whether we can support your project, and move you through onboarding if you go ahead.

We use operation records to carry out pay-ins, payouts and settlements, report operation statuses to merchants, and handle questions or disputes about specific operations.

We use access logs to understand activity on merchant accounts and to investigate problems that users report.

We use business verification materials to decide whether we can onboard a merchant and to meet our obligations when we review businesses. The overview of our security practices describes how we approach protecting accounts and integrations.

We keep personal data for as long as the purpose behind it requires. For example, an enquiry that never turns into a merchant relationship serves a different purpose from the records of a completed payment operation, so the two are not kept for the same length of time.

We have not set a single numeric retention period that applies to every category. When a purpose ends, the data linked to it is reviewed for deletion, unless the law requires us to keep it longer.

We pass personal data to others in two situations only.

The first is when processing an operation requires it. A pay-in or payout cannot be completed without the details the chosen payment method needs.

The second is when the law requires us to disclose data, such as in response to a valid request from an authority.

We do not sell personal data, and we do not share it for advertising purposes.

You can ask us to give you access to your personal data, correct it, restrict how we use it or delete it.

Before we act on a request, we need to confirm your identity. This protects you from someone else obtaining or changing your data.

We then assess the request under the data protection law that applies to it. Applicable law depends on the circumstances. Kenya, for instance, has its own Data Protection Act 2019, and other markets we serve have their own national rules. Sometimes the law allows or requires us to keep data even after a deletion request, such as when operation records must be retained. If we cannot meet a request in full, we will explain why.

To make a request, use our privacy request form and say which right the request concerns.

Merchants and platforms that integrate with Payment Gateway Africa send us data about their customers so that operations can be processed. Merchants are responsible for telling their own customers how their data is used. They should also make sure they have a proper basis for passing that data to us.

Status updates about operations go to the merchant through postbacks and webhooks. We do not run a separate notification service that contacts merchants' customers directly.

We may revise this policy when our services, our data handling or the applicable rules change. The date at the top of the page shows when it was last updated. If a change materially affects merchants, we will let them know through the usual account communication channels.

If something in this policy is unclear, or you want to make a request about your personal data, send us a message through our contact page. Please mention that your message concerns privacy so it reaches the right people faster.