Privacy Policy

1. Introduction

Stonebridge Technologies Limited (“Stonebridge”, “PayOak”, “we”, “us” or “our”) operates PayOak, a digital escrow and transaction platform designed to help parties transact with greater confidence.

This Privacy Notice explains how we collect, use, disclose, protect and retain personal data when you use PayOak, including when you create or use an account, participate in an escrow transaction, undergo identity or verification checks, contact us for support, use our website, or otherwise interact with PayOak.

This Privacy Notice applies to personal data processed through our website, platform, transaction and escrow services, verification processes, communications and support channels. It should be read together with our Cookie Policy and any other privacy information we provide at the point of collection.

We process personal data in accordance with the Nigeria Data Protection Act 2023 (“NDPA”) and applicable regulations, directives and guidance.

2. Who Is Responsible for Your Personal Data

The data controller responsible for personal data processed through PayOak is Stonebridge Technologies Limited, trading as PayOak. The DPO is responsible for privacy governance, data-subject requests, privacy complaints, privacy reviews, breach and incident coordination, privacy training and liaison with the relevant data protection authority. You can contact the DPO through the contact details in Section 16.

3. Personal Data We Collect

Depending on how you interact with PayOak, we may collect the following categories of personal data:

Account and registration data: email address, account credentials and authentication information, referral code and account type.

Contact data: telephone number and email address.

Personal and business information: residential or business address, name obtained through verification, business name, business mobile number and business profile picture.

Financial and transaction data: bank account information, transaction amounts, payment and escrow information, virtual account details, transaction identifiers, payment status, release or refund information and transaction timelines.

Identity and verification data: BVN, NIN, government-issued identification documents, selfie or facial verification information, information associated with identity verification, proof of address and verification results.

Location data: precise device location where required as part of higher-tier address verification.

Dispute and support data: refund requests, dispute reasons, evidence, counter-disputes, communications, adjudication records, support enquiries and related correspondence. The sensitivity of information contained in evidence or communications may vary depending on their content.

Marketing and website interaction data: information relating to marketing preferences and where applicable, information collected through cookies and similar technologies on our public website.

Employment and applicant data: information provided by employees, contractors and job applicants in connection with employment, engagement or recruitment.

Security and authentication data: passwords, one-time passwords and other authentication or security credentials. Passwords and comparable credentials are handled as security-sensitive information and should not be shared with us outside the intended authentication process.

4. How We Collect Personal Data

We collect personal data from a number of sources, including:

• directly from you when you register, complete your profile, provide verification information, create or participate in transactions, request refunds, raise or respond to disputes, contact support, or communicate with us;

• from verification and service providers when they return information required to provide identity, banking or other services;

• from other transaction participants, for example where a buyer provides a seller’s name, email address or telephone number in order to create or share a transaction;

• from your interaction with our public website, including cookies and similar technologies where applicable; and

• from activities generated by your use of PayOak, such as transaction identifiers, transaction status and timelines, escrow funding and release events, refunds, disputes, verification status and service communications.

5. Why We Use Personal Data

We use personal data for purposes including:

• creating and managing PayOak accounts;

• providing escrow, payment-related and transaction services;

• identity verification, KYC and account-tier requirements;

• fraud prevention, AML/KYC controls and security;

• processing refunds, disputes and related adjudication;

• communicating with you and providing customer support;

• sending marketing communications where permitted and in accordance with your choices;

• understanding and improving our public website and services, including through permitted analytics;

• complying with legal, regulatory, accounting and audit requirements; and

• protecting PayOak, our users and other persons from security incidents, misuse or unlawful activity.

6. Legal Bases for Processing

Depending on the purpose and circumstances, we may rely on one or more lawful bases recognised under applicable data protection law, including:

• performance of a contract or steps taken at your request before entering into a contract;

• compliance with a legal or regulatory obligation;

• our legitimate interests, where permitted and where those interests are not overridden by your rights and freedoms;

• your consent, where consent is required or where we choose to rely on consent; and

• any other lawful basis available to us under applicable law.

Where the law requires consent for a particular processing activity, we will obtain consent in the manner required by law. You may withdraw consent where processing is based on consent, although withdrawal does not affect processing that was lawfully carried out before withdrawal and may not stop processing that has another lawful basis.

7. Who We Share Personal Data With

We may disclose personal data where necessary to provide PayOak, meet legal obligations, protect users and our services, or carry out the purposes described in this Privacy Notice.

Recipients may include:

• banking and payment service providers;

• identity and verification providers;

• cloud, infrastructure and technology providers;

• communications and marketing service providers;

• professional advisers and other service providers acting on our behalf;

• other participants in a transaction where sharing is necessary to facilitate the transaction;

• regulators, law-enforcement bodies, courts or other authorities where required or permitted by law; and

• parties involved in a corporate transaction, restructuring, merger, acquisition or transfer of relevant business assets, subject to applicable legal requirements.

Where a third party processes personal data on our behalf, we take appropriate steps to require appropriate privacy, confidentiality and security protections.

8. International Data Transfers

Some of the service providers we use may process or store personal data outside Nigeria. Where personal data is transferred internationally, we will apply the safeguards and requirements applicable under Nigerian data protection law.

Depending on the circumstances, this may include assessing the destination and transfer conditions, using appropriate contractual or other safeguards, and applying technical and organisational measures designed to protect personal data.

We do not use this section to represent that all personal data is stored in one particular country; the location and transfer arrangements may vary by service provider and processing activity.

9. How We Protect Personal Data

We use technical and organisational measures designed to protect personal data against unauthorised access, unlawful processing, loss, destruction, damage and other security risks.

These measures include access controls and role-based permissions, need-to-know access, authentication and security controls, controls around KYC and verification information, safeguards for our technical infrastructure, controls relating to third-party service providers, and incident response processes.

Access to personal data is intended to be limited according to a person’s responsibilities and operational need. Not all PayOak personnel are authorised to access all categories of personal data.

No method of transmission, storage or security can be guaranteed to be completely secure. We therefore continually review and improve our safeguards as our services and risks develop.

10. Data Retention

We retain personal data for as long as reasonably necessary for the purposes for which it was collected or processed, including to provide the service, comply with legal or regulatory obligations, resolve disputes, establish or defend claims, maintain security, and satisfy accounting or audit requirements.

When determining a retention period, we consider factors such as the purpose of processing, the nature of the data, the operational need to retain it, applicable legal and regulatory requirements, AML/KYC obligations, disputes and potential claims, security needs, and whether information can be securely deleted or anonymised.

Closing or deactivating a PayOak account does not necessarily result in immediate deletion of all associated information. Certain personal and transaction information may need to be retained where required or permitted by law or where reasonably necessary for legitimate operational, security or legal purposes.

When personal data is no longer required, we will take appropriate steps to securely delete, destroy or anonymise it in accordance with our internal retention and deletion procedures.

11. Your Data Protection Rights

Subject to applicable law and any lawful limitations, you may have rights including the right to:

• be informed about how your personal data is processed;

• request access to personal data we hold about you;

• request correction or rectification of inaccurate or incomplete personal data;

• request erasure of personal data in circumstances where the law permits or requires it;

• request restriction of processing in applicable circumstances;

• object to certain processing;

• request data portability where the relevant legal requirements are met;

• withdraw consent where processing is based on consent;

• exercise rights relating to certain forms of solely automated decision-making; and

• lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise a privacy right, contact our DPO at nifemi@payoak.net. We may need to verify your identity before responding to a request. We will handle requests in accordance with applicable law and will explain where a request cannot be fulfilled or is subject to a lawful limitation.

12. Automated Processing

PayOak uses automated processes as part of operating the service. These may include verification and validation processes, determining whether account information satisfies applicable tier requirements, processing transaction status information, and applying predetermined rules such as automatic release or refund events.

These processes are primarily designed to operate the service and apply predetermined transaction or verification rules. For example, where bank account and BVN information do not match, the user is informed and can correct the information and retry the verification process.

Where applicable law provides rights or safeguards in relation to solely automated processing that produces legal or similarly significant effects, we will apply those safeguards. If you have a concern about an automated process affecting you, you may contact our DPO or support team.

13. Cookies and Similar Technologies

Our public website uses cookies and similar technologies. We use necessary technologies to support website functionality and may use optional analytics and marketing technologies where permitted.

Where consent is required, optional technologies are presented through our cookie consent mechanism. You may accept or reject optional cookies and, where available, manage your preferences. You can also change your choices through the cookie preference controls made available on the website.

For more information about the categories of cookies and similar technologies we use, their purposes and how to manage your choices, please see our Cookie Policy.

14. Children

PayOak’s services are intended for people and businesses that are legally able to enter into the relevant agreements and use the services. We do not knowingly seek to collect personal data from children where such collection is not permitted.

If you believe that a child has provided personal data to PayOak in circumstances where this was not permitted, please contact us so that we can review the situation and take appropriate action in accordance with applicable law.

15. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes to our products, services, data processing activities, technology, security practices or applicable law.

When we make changes, we will update the Effective Date and/or Last Updated date shown at the beginning of this notice. Where a change is material and applicable law requires additional communication, we will take reasonable steps to bring it to your attention.

We encourage you to review this Privacy Notice periodically so that you remain informed about how PayOak handles personal data.

16. Contact Us and Privacy Complaints

Stonebridge Technologies Limited, trading as PayOak, is responsible for the processing described in this Privacy Notice.

For privacy questions, data-subject requests, complaints or concerns, please contact:

Data Protection Officer: Oluwanifemi Famuyiwa

Email: nifemi@payoak.net

General Support: support@payoak.net

Registered Address: 279 Herbert Macaulay Way, Sabo-Yaba, Lagos, Nigeria

When you contact us about a privacy matter, we may ask for reasonable information to verify your identity and protect against unauthorised disclosure. We will handle privacy requests and complaints in accordance with applicable law.

If you remain dissatisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC), subject to its applicable complaint process.