This Privacy Policy describes how Skurel Limited (“Skurel”, “we”, “us”, or “our”), a company incorporated under the laws of the Federal Republic of Nigeria, collects, uses, discloses, and protects personal data when you register for, access, or use the Skurel Platform — our websites, applications, APIs, account and organization workspace services, and the shared wallet used for payments and balance management (together, the “Platform”).
Skurel is the data controller for the personal data described in this Policy. This Policy applies to all users of the Platform, including individual users, members of organization workspaces, and administrative users. It does not apply to personal data processed by third parties under their own privacy policies (for example, payment processors acting in respect of your payment transactions), although those parties may also process personal data as independent controllers.
1. Personal data we collect
We collect the following categories of personal data depending on how you use the Platform:
Account and profile data
- your full name, email address, and country of residence or registration, collected at signup;
- a unique Google account identifier and the name and email address from your Google profile, where you choose to sign in with Google;
- your password, which is stored only in irreversible hashed form and never in plain text;
- profile details you later update, where the Platform allows;
- your account status, including email verification status, super-admin or administrative flags, and member role within your organization workspace.
Organization data
- the name and country of your organization workspace, which is set at registration and used to determine applicable currency, payment methods, and compliance requirements;
- the names, email addresses, and roles of members invited to your organization workspace, provided by an administrative user of that workspace.
Transaction and wallet data
- wallet balances, top-ups, deductions, holds, refunds, and reversals recorded against your organization's wallet;
- transaction references, provider references, amounts, currencies, statuses, and timestamps generated in connection with payments;
- limited metadata about your payment methods, such as a masked display of the payment channel, where a Payment Processor shares it with us.
Authentication and session data
- authentication tokens (JSON Web Tokens) issued to you on login, used to keep you signed in across the Platform;
- security and audit records relating to your account and organization, such as membership changes and administrative actions.
Communications and support
- information you provide when you contact our support or legal channels, including the content of your message and your contact details.
2. How we use personal data
We use personal data to:
- create and administer your account and organization workspace, verify your email address, and authenticate you when you sign in, including through third-party sign-in providers;
- process wallet top-ups, record transactions, issue refunds, and maintain an accurate ledger of your organization's financial activity;
- deduct fees for billable features and provide you with statements and transaction histories;
- detect, investigate, and prevent fraud, unauthorized access, chargebacks, identity misuse, and unlawful activity, and to comply with our legal, regulatory, tax, and sanctions obligations;
- operate, secure, maintain, and improve the Platform, including troubleshooting, capacity planning, and protecting the rights and safety of users and the public;
- communicate with you about your account, security notices, service changes, and, where required by law or with your consent, marketing updates.
3. Lawful bases for processing
Where the Nigeria Data Protection Act 2023 (“NDPA”) or similar laws apply, we process personal data on the following lawful bases:
- Performance of a contract — to provide the account, workspace, wallets, and payment services you have requested by registering for and using the Platform;
- Legal obligation — to comply with applicable laws, including financial record-keeping, tax, regulatory, and sanctions requirements;
- Legitimate interests — to secure the Platform, prevent fraud and abuse, and improve our services, provided those interests are not overridden by your rights;
- Consent — where you have opted in, for example to receive marketing communications, which you may withdraw at any time.
4. Cookies and local storage
The Platform uses a small number of strictly necessary cookies and browser storage technologies to keep you signed in and secure:
- an authentication cookie containing your signed-in session token. This cookie is marked httpOnly, meaning it is not readable by scripts running in your browser, and is used to authenticate your requests to the Platform;
- local storage in your browser, where the portal may retain a copy of your session token and non-sensitive interface preferences to work correctly;
- no advertising, profiling, or cross-site tracking cookies are used by the Platform.
- Because the cookies we use are strictly necessary for the Platform to function, they cannot be switched off. You may still block or delete them through your browser settings, but doing so will sign you out and may prevent the Platform from working.
5. Payments and payment processors
Wallet top-ups and certain refunds are processed by independent Payment Processors we engage, such as licensed payment service providers for card, bank transfer, and mobile payment methods, and international card processors for card payments. We do not collect or store your card number, card verification value, or other full payment credentials.
When you make a payment, the Payment Processor collects your payment details directly under its own terms and privacy policy. It shares with us only the minimum data needed to identify and reconcile the transaction, such as a reference, the amount and currency, the transaction status, and metadata about the payment channel used. Where we provision a dedicated virtual account for your organization to enable bank transfers, the account-opening data shared with the underlying financial institution is limited to what those institutions require by law.
You can find more information about how a particular processor handles your data in its own published privacy policy.
6. Third-party sign-in
Where you sign in with Google, we receive your Google account identifier, name, and email address upon verification of the sign-in token, and use them to create or match your Skurel account. We do not receive your Google password. Your use of Google sign-in is also subject to Google’s own terms and privacy policy.
7. How we share personal data
We do not sell your personal data. We share personal data only in the following circumstances:
- Payment Processors and financial institutions — to process payments, provision virtual accounts, and reconcile transactions;
- Service providers — companies that help us operate the Platform, such as cloud hosting, messaging, and email delivery providers, bound by contractual confidentiality and data protection terms;
- Corporate and administrative users — members and administrators within your organization workspace can see organization-level information, such as the transaction ledger and wallet balance, as permitted by their role;
- Legal and regulatory — regulators, tax authorities, law enforcement, or courts, where disclosure is required by law, court order, or to protect our rights, safety, or property, or the rights and safety of users;
- Corporate transactions — in connection with a merger, acquisition, reorganization, or sale of assets, subject to this Policy continuing to apply to the transferred data.
8. Data retention
We retain personal data only as long as necessary for the purposes described in this Policy, including to meet legal, accounting, tax, and regulatory requirements. In general: account and organization data are retained for the life of the account and for up to six (6) years after account closure where required for legal, tax, and audit purposes; transaction and wallet records are retained for the period required by applicable financial record-keeping laws; authentication and security records are retained for a period necessary to detect and prevent abuse; and support communications are retained for up to twenty-four (24) months.
Where retention is no longer required, we delete or irreversibly de-identify the data. Data subject to an open dispute, chargeback, investigation, or legal hold may be retained until the matter is resolved.
9. Security
We apply technical and organizational measures designed to protect personal data, including encryption of data in transit, password hashing, httpOnly session cookies, role-based access controls, and separation of services. No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials safe and for the security of your account.
10. International data transfers
Personal data may be processed in, and transferred to, countries other than Nigeria, including by our cloud hosting and payment partners. Where personal data is transferred outside Nigeria, we take steps to ensure an adequate level of protection consistent with applicable data protection laws, including contractual safeguards and transfers to jurisdictions recognized as providing adequate protection.
11. Your rights
Subject to applicable law, and in accordance with the NDPA where you are in Nigeria, you have the following rights in relation to your personal data:
- the right to be informed about how your personal data is used, through this Policy;
- the right to access the personal data we hold about you and to request a copy of it;
- the right to request the correction or updating of inaccurate or incomplete personal data;
- the right to request the deletion or erasure of your personal data where it is no longer necessary for the purposes for which it was collected, or where processing is unlawful;
- the right to object to, or request restriction of, certain processing, including processing based on legitimate interests;
- the right to data portability, where technically feasible, in a commonly used, machine-readable format;
- the right to withdraw consent for consent-based processing at any time, without affecting the lawfulness of processing before withdrawal; and
- the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), or with the data protection authority in your jurisdiction, if you believe our processing of your personal data violates applicable law.
- If you are a resident of another jurisdiction, such as a state with a comprehensive consumer privacy law in the United States, you may also have rights under the laws of that jurisdiction, including the right to know what personal data is collected and shared, to delete personal data, and not to be discriminated against for exercising your rights. We will honour requests made under applicable local law.
- To exercise any of these rights, contact us using the details below. We may need to verify your identity before actioning a request, and we will respond within the timeframes required by applicable law. We will not charge a fee for a reasonable request, although we may charge a reasonable fee where a request is manifestly unfounded, excessive, or repetitive.
12. Children
The Platform is not directed at children under the age of 16, and we do not knowingly collect personal data from anyone under 16. If we learn that we have collected personal data from a person under 16, we will delete it promptly. If you believe a child under 16 has provided us with personal data, please contact us.
13. Changes to this Policy
We may update this Policy from time to time to reflect changes in the Platform, the law, or our practices. Where a change materially affects your rights, we will notify you through the Platform or by email before the change takes effect, and will indicate the date of the latest revision at the top of this page. Your continued use of the Platform after the effective date of an updated Policy constitutes acceptance of the updated Policy.