Privacy Policy

FrontierTech Projects Limited, trading as NuoCash
Effective date: 1 July 2026 | Version 1.0

Privacy at a glance

This page summarises our Privacy Policy. It is not a substitute for the full text that follows.

Question	Short answer
Who is responsible for my data?	FrontierTech Projects Limited, trading as NuoCash, is the data controller of the personal data we collect through our website and mobile application.
What do you collect?	Identity details, contact details, verification data (including your face image for identity checks), account and transaction data, wallet addresses and blockchain information linked to you, device and usage data, and your communications with us.
Why?	To open and run your account, to verify who you are, to move your money and virtual assets, to protect you and us from fraud, and to meet Nigerian law, including anti-money laundering and sanctions rules.
Do you sell my data?	No. We do not sell or rent your personal data, and we do not share it with advertisers.
Who sees it?	Only people and organisations that need it: our verification, screening and technology providers, our banking, payout and card Partners, and authorities where the law requires.
How long do you keep it?	Compliance records are kept for at least seven years after your relationship ends, as the law requires. Other data is kept only as long as needed.
Can I ask you to delete it?	Yes, where the law allows. We cannot delete records we are legally required to keep, and we cannot erase information already written on a public blockchain.
What are my rights?	To be informed, to access, correct, delete, restrict or object to our use of your data, to move your data, to withdraw consent and to complain to the Nigeria Data Protection Commission.
How do I contact you?	Write to our Data Protection Officer at Compliance@nuocash.com (see Section 21).

1. Who we are and about this policy

FrontierTech Projects Limited, trading as NuoCash (“NuoCash”, “we”, “us” or “our”), is a company registered in Nigeria that provides a virtual-asset and cross-border money transfer service through the NuoCash mobile application and website at www.nuocash.com. With a NuoCash account you can hold naira and US dollar balances, receive eligible virtual assets and stablecoins that are converted to dollars, send money to other NuoCash users and to recipients in other countries, use a card and, where available, earn yield on eligible balances.

This Privacy Policy explains how we handle your personal data when you visit our website, download or use our application, apply for or use an account, contact us, or are named as a recipient or beneficiary of a payment. We are the data controller for that data under the Nigeria Data Protection Act 2023 (the “NDPA”). Where we act as a processor for someone else, we say so in our agreements.

This policy covers NuoCash’s own services. It does not cover websites, apps or services run by others that we link to, or the independent privacy practices of our banking, payout and card Partners, which are separate controllers of the data they hold for their own legal purposes. By using our services you acknowledge that you have read this policy. Where the law requires your consent for something, we ask for it separately and you can withdraw it.

Words such as “personal data” and “processing” have the meaning given in the NDPA. In short, personal data is any information about you that identifies you or can be used to identify you.

2. The personal data we collect

What	Examples
Identity and verification data	Full name, date of birth, gender where captured in an ID, nationality, address, Bank Verification Number (BVN), National Identification Number (NIN), identity document details and images, a photograph or selfie, and the results of identity and liveness checks. For higher verification levels we also collect proof of address and, where required, information about the source of your funds or wealth
Biometric data	A face image or template and liveness result created when you complete a selfie or video check to prove you are the person on your ID. Biometric data is sensitive data and is handled as set out in Section 5
Contact and account data	Phone number, email address, username, passcode or PIN (stored in protected form), security settings and preferences, referral information
Financial and transaction data	Deposits, conversions, balances, transfers, payouts, card transactions, fees, transaction purposes and descriptions, details of recipients (name, bank or wallet details, relationship and country), and documents you give us to show the source of funds
Virtual-asset and wallet data	The blockchain wallet addresses you use or deposit from, transaction hashes, the assets and networks used, ownership proofs you provide, and information from blockchain analytics about the history and risk of those addresses and transactions
Risk and compliance data	Your risk rating, results of sanctions, politically exposed person and adverse-media screening, alerts and internal case notes, and information about reports we are required to make. We have restrictions on what we can tell you about some of this (Section 5)
Device, usage and location data	Device type and identifiers, operating system, app version, IP address, approximate location, SIM-change and security signals, log-in and behaviour patterns, crash reports, and cookie and similar-technology data (Section 16)
Communications	Messages, emails, chat transcripts, call recordings and complaints you send us, and our replies
Marketing and survey data	Your marketing preferences, responses to surveys and promotions
Recipient and counterparty data	If someone sends you money through NuoCash, or you are named as a recipient, we receive your name, contact and payment details from the sender or our Partners

2.1 Information You Are Required to Give Us

Some data is necessary for us to provide the service and to comply with Nigerian law. If you do not give it, or we cannot verify it, we cannot open or continue your account, and we may need to limit or close it. Which documents we need depends on the Verification Level you want, as set out in our Verification Levels and Limits schedule.

2.2 Sensitive Data

The only sensitive data we ask for is biometric data used to verify your identity. We do not ask for information about your religion, ethnicity, health, sexual life or trade-union membership. If a document you provide contains such information, we use it only to verify the document. Being a politically exposed person is a regulatory classification and is not treated as a political opinion.

3. How we collect your data

From you: when you register, verify your identity, make or receive transactions, contact support, enter promotions or surveys, or use the application;
Automatically: from your device and your use of the app and website, through logs, cookies, software development kits and similar technologies;
From third parties: identity registries and verification providers (for example for BVN and NIN checks), sanctions, politically exposed person and adverse-media screening providers, blockchain analytics providers, banking, payout and card Partners, fraud-prevention and device-intelligence services, credit or reference agencies where applicable, and the sender of a payment to you;
From public sources: public registers, published sanctions lists, news sources and the public blockchain;
From authorities: where we are lawfully told of matters relevant to your account, for example an order to freeze funds.

4. Why we use your data and our legal bases

The NDPA allows us to process personal data only where we have a lawful basis. We rely on the bases below. We do not rely on consent where another basis applies, and we do not make our service conditional on you agreeing to uses that are not necessary for it.

What we do	Legal basis
Open, run and support your account; process deposits, conversions, transfers, payouts and card payments; apply fees and limits	Contract: necessary to provide the services you asked for
Verify your identity; carry out customer due diligence; screen against sanctions and watch-lists; monitor transactions and wallet exposure; keep records; report to the Nigerian Financial Intelligence Unit and other authorities; comply with Central Bank of Nigeria and other regulatory requirements; respond to lawful orders	Legal obligation: we are required by Nigerian law and our regulators
Detect and prevent fraud, scams, account takeover and abuse; keep our systems and your account secure; manage risk; enforce our terms; establish or defend legal claims; protect our business	Legitimate interests: which we balance against your rights and interests, and legal obligation where it applies
Use your face image to check that you are the person on your identity document	Consent, or legal obligation where verification is mandatory. Alternative methods are offered where the law permits
Send service messages: security alerts, transaction confirmations, changes to terms and this policy	Contract and legitimate interests
Send you news, offers and promotions	Consent (you can withdraw it at any time)
Improve our products, test new features and understand how the app is used, using aggregated or de-identified data where possible	Legitimate interests; consent for non-essential cookies
Internal audits, accounting, tax and corporate transactions such as a merger, acquisition or financing	Legal obligation and legitimate interests
Protect someone’s life in an emergency	Vital interests (rare)

You can ask us for an explanation of the legitimate interests we rely on, and you have the right to object (Section 12).

5. Verification, screening and our legal duties

NuoCash is subject to Nigerian laws and regulations against money laundering, terrorist financing, proliferation financing and sanctions evasion. These rules affect how we handle your data and what we can tell you.

Identity checks. We check your details against official registries and verification providers and may ask for more documents, particularly as you move to higher Verification Levels or larger limits.
Screening. We screen customers, recipients and wallet addresses against sanctions lists, politically exposed person lists and adverse-media sources, at onboarding and on an ongoing basis.
Monitoring. We monitor transactions, wallet exposure and account behaviour for unusual or suspicious activity. We may hold, delay, reject or return a transaction or restrict an account while we review it.
Reporting. The law may require us to report suspicious activity and certain transactions to the Nigerian Financial Intelligence Unit and other competent authorities. We are prohibited from telling you if a report has been or may be made, and we may refuse to answer access requests that would reveal it.
Record-keeping. We must keep identification, verification and transaction records for at least seven years, even after you close your account, so we cannot delete them on request during that period.
Biometric data. We use your face image only to verify identity and prevent impersonation and fraud. We store it securely and separately where practicable, restrict access to it, and delete the biometric template and raw capture once the verification and any related dispute or investigation period has ended, keeping only the result and the identity record we must retain by law. We never use it for advertising or sell it.

6. Automated decisions and profiling

We use automated tools to assess risk, screen for sanctions, monitor transactions, detect fraud and score wallet exposure. These help us keep the service safe and meet our legal duties. A person reviews significant decisions, such as restricting an account, declining a deposit or ending a relationship, before they are finalised, except where an immediate automated hold is needed to stop a loss or comply with a sanctions requirement, in which case we review it promptly afterwards. You can ask for a human to review such a decision and tell us your point of view. We do not use sensitive data to build profiles, and we regularly test our tools for accuracy and fairness. Your rights may be limited where a decision is part of a legal reporting duty (Section 5).

7. Who we share your data with

We do not sell or rent your personal data. We share it only as described below, and only to the extent necessary.

Who	Why
Identity, verification and screening providers	To verify your identity and documents, screen against sanctions and similar lists, and detect fraud and impersonation
Blockchain analytics providers	To assess the history and risk of wallet addresses and transactions, and to meet sanctions and anti-money laundering duties
Banking, payment, payout, mobile-money and card Partners	To receive, convert, send and pay out money, issue and run cards, and meet their own legal requirements, which may include sharing your and the recipient’s details with the receiving institution
Other virtual-asset service providers	To meet the Travel Rule, which requires sender and recipient information to travel with virtual-asset transfers
Technology and service providers	Cloud hosting, security, messaging (SMS, email, push notifications), customer support tools, analytics and similar services, acting on our instructions under contract
Professional advisers, auditors and insurers	Legal, accounting, audit, regulatory and insurance purposes, under duties of confidentiality
Group companies and successors	If we reorganise, merge, sell part of the business or raise finance, data may be shared with the parties involved and their advisers, who must protect it under equivalent terms
Regulators, authorities and courts	Where required or permitted by law (Section 8)
Other people, with your instruction or consent	For example the recipient of a payment you send, or a person you ask us to share with

Our providers may access your data only to do their work for us, must keep it confidential and secure, and may not use it for their own purposes. Our Partners that are independent controllers use your data under their own privacy notices.

8. Disclosures to authorities

We disclose personal data to the Nigerian Financial Intelligence Unit, law-enforcement and security agencies, the Central Bank of Nigeria, the Securities and Exchange Commission, the Nigeria Data Protection Commission, courts and other competent authorities where the law requires or permits it. We do not respond to informal requests. We expect requests to be in writing, from an official source, to identify the legal power relied on, and to identify the account or transaction concerned. We review each request and disclose only what we are legally required or permitted to, and we may be prohibited from telling you about it. Requests from foreign authorities must normally come through the proper international channels.

9. Transfers outside Nigeria

Some of our providers, Partners and counterparties are outside Nigeria, and money transfers necessarily send sender and recipient details to the destination country. Where we transfer personal data outside Nigeria we do so only where the destination country or recipient provides an adequate level of protection, or another lawful mechanism applies: appropriate safeguards such as binding contractual clauses, your informed consent, or an exception the NDPA permits, for example where the transfer is necessary to carry out your instruction or for legal claims. We limit what we send to what is needed. You can ask us for details of the safeguards we use.

10. Blockchain and wallet information

Blockchain transactions are public and permanent. Anyone can see the wallet addresses, amounts and dates of transactions, and the information cannot be edited or deleted by us or anyone else. We do not write your personal data to a blockchain.
When you link or use a wallet with NuoCash, we link the address to your account and treat it as your personal data. Others may be able to connect an address to you using public information.
We use blockchain analytics to review the history of addresses that send you funds. Where exposure to illicit activity is found, we may hold, reject or return a deposit and may be required to report it.
Your right to erasure applies to the records we hold about you, subject to our legal retention duties. It cannot extend to information on a public blockchain.

11. How long we keep your data

We keep personal data only as long as necessary for the purposes described in this policy and to meet our legal obligations. When the period ends, we delete or irreversibly anonymise the data. We may keep anonymous or aggregated information, which is no longer personal data, for longer. The periods below are the standards we apply.

Data	How long we keep it
Identification and verification records; transaction records; screening results; and records of reports	At least seven years after your relationship with us ends or the transaction takes place, or longer if the law, a regulator or an investigation or legal proceeding requires
Face image, selfie and liveness capture	Deleted when verification and any related dispute or investigation is complete, as in Section 5, and in any case not retained beyond the identity-record period
Incomplete or abandoned applications	Up to 12 months, then deleted unless needed for fraud prevention or a legal duty
Customer support messages and call recordings	Up to five years from the end of the matter, to meet complaint, dispute and regulatory requirements
Device, security and log data	Up to 24 months, longer where needed as evidence of a security incident or investigation
Marketing preferences and consents	While the preference or consent is active, and a record of withdrawal afterwards
Recipient data of people who are not our customers	Seven years from the transaction, as part of the transaction record
Job applications	Up to 12 months for unsuccessful candidates, unless they ask us to keep their details for longer

Where we cannot delete data because of a legal duty or a legal hold, we restrict access to it and use it only for that purpose.

12. Your rights

Under the NDPA you have the following rights. Some are subject to conditions and to the legal duties described in this policy.

Right	What it means
To be informed	To know how we use your data. This policy and our notices in the app give you that information
Access	To confirm whether we process your data and to receive a copy of it and information about how we use it. We may withhold data about other people, and information that would reveal a suspicious activity report or prejudice an investigation
Correction	To have inaccurate or incomplete data corrected
Erasure	To ask us to delete your data where it is no longer needed, you withdraw consent, you object successfully, or we are using it unlawfully. We cannot delete data we must keep by law (for example for seven years) or need to establish, exercise or defend legal claims
Restriction	To ask us to pause using your data while we check its accuracy or our right to use it
Data portability	To receive the data you gave us, where we process it by consent or contract, in a structured, commonly used, machine-readable format, and to ask us to send it to another provider where technically feasible
Objection	To object to processing based on legitimate interests, and to object to direct marketing at any time. We will stop unless we show compelling legitimate grounds or the law requires us to continue
Automated decisions	Not to be subject to a decision based solely on automated processing that significantly affects you, and to ask for human review (Section 6)
Withdraw consent	To withdraw consent at any time, without affecting what we did before. If you withdraw consent to biometric verification, we may be unable to offer you some services, and we will tell you what alternatives exist
Complain	To us and to the Nigeria Data Protection Commission (Section 21)

13. How to use your rights

Send your request through the app (Settings, Privacy) or to our Data Protection Officer using the details in Section 21. Tell us what you want and which right you are using.
We may ask you to confirm your identity, using information we already hold where possible, so that we do not give your data to someone else.
We acknowledge requests promptly and respond without undue delay and within one month. If a request is complex or we receive many, the law may allow more time, and we will tell you why.
We do not charge a fee, unless a request is clearly unfounded or excessive, in which case we may charge a reasonable fee or decline and explain why.
If we refuse all or part of a request, we will tell you in writing the reason (unless telling you would itself prejudice an investigation or breach the law) and that you may complain to the Nigeria Data Protection Commission or go to court.
If we have shared your data with others and you ask us to correct, delete or restrict it, we will tell those recipients where we can.
You can also change your marketing choices and many account details directly in the app.

14. How we protect your data

We use technical and organisational measures that are appropriate to the risk, including:

encryption of personal data in transit and, where appropriate, at rest, and careful management of encryption keys;
access controls based on need-to-know, multi-factor authentication for staff, logging and review of access to sensitive data;
secure development practices, vulnerability management, independent security testing and monitoring for suspicious access;
fraud, device and behavioural controls to protect your account, including step-up checks on sensitive actions;
data minimisation, pseudonymisation or masking where practical, and separation of highly sensitive data such as biometrics;
vetting, confidentiality duties and regular data protection training for staff;
contracts and due diligence for providers that handle personal data;
resilience measures, backups and an incident response plan that is tested.

14.1 Your Part

Please keep your passcode, PIN, one-time codes and device secure, do not share them with anyone (we will never ask for them), keep your phone number and email current, and tell us at once if you lose your phone, change your SIM unexpectedly or suspect unauthorised access. Be careful of messages or calls pretending to be NuoCash. No system can be completely secure, so we cannot promise absolute security, but we take our duty to protect your data seriously.

15. Data breaches

We have procedures to detect, contain and investigate personal data breaches. If a breach is likely to put your rights and freedoms at risk, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware, as the law requires. If it is likely to cause you a high risk of harm, we will also tell you without undue delay, explaining in clear language what happened, what data was affected, the likely consequences, what we are doing, and what you can do to protect yourself. We will also inform our regulators and Partners where required. We keep a record of every breach.

16. Cookies and similar technologies

Our website and application use cookies, software development kits and similar technologies. Essential technologies are always on because the service cannot work securely without them. Others need your consent, and you can change your choice at any time through the cookie settings or your device settings.

Type	Purpose	Consent needed
Strictly necessary	Log-in, session security, fraud and bot protection, load balancing, remembering consent choices	No
Functional	Remember language and display settings and preferences	Where not strictly necessary, yes
Analytics and performance	Understand how the app and website are used, find errors and improve the service, using aggregated or de-identified data where possible	Yes
Marketing	Measure the effectiveness of our own campaigns. We do not sell data to advertisers	Yes

If you block some technologies, parts of the service may not work properly.

17. Marketing

We send promotional messages by email, SMS, push notification or in-app message only if you have agreed or the law otherwise allows, for services similar to those you already use. Every message has a simple way to opt out, and you can change your preferences in the app. You will still receive essential service and security messages. We do not share your data with third parties for their own marketing.

18. Children

Our services are for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you are a parent or guardian and believe a child has given us personal data, please contact us and we will delete it unless the law requires us to keep it. If we ever offer a service for minors, we will obtain verifiable parental or guardian consent first and update this policy.

19. Other websites and services

Our website and application may link to sites and services we do not control, such as Partners, blockchain explorers or social media. We are not responsible for their content or privacy practices. Please read their policies before giving them your data.

20. Changes to this policy

We may update this policy when our services, our practices or the law change. We will post the updated version in the application and on our website with a new effective date, and, for material changes, notify you in advance by email, in-app message or both. Where the law requires your consent to a change, we will ask for it. Please check this page from time to time.

21. Contact us and complaints

21.1 Our Data Protection Officer

Company	FrontierTech Projects Limited, trading as NuoCash
Contact	Data Protection Officer, NuoCash
Email	Compliance@nuocash.com
Website	www.nuocash.com

If you have a question, a concern or a request about your personal data, please contact our Data Protection Officer first. We will acknowledge your message promptly and aim to resolve it within one month.

21.2 Complaining to the Regulator

You have the right to complain to the Nigeria Data Protection Commission if you think we have not handled your personal data lawfully, and to seek a remedy in court. We encourage you to contact us first so that we can try to put things right.

21.3 Other Complaints About Our Service

Complaints that are not about personal data, for example about a transaction or a fee, can be raised through the app or customer support under our complaints procedure, and may be escalated to the relevant regulator if not resolved.