Last Updated: 20/07/2026
At MyChange, we understand that your personal information is important. This Privacy Policy explains how MyChange collects, uses, stores, shares, and protects your personal information when you use the MyChange application, website, wallet, and related services.
This Privacy Policy applies to users of MyChange and describes your rights in relation to your personal data. By using MyChange, you acknowledge that you have read and understood this Privacy Policy. MyChange processes personal data in accordance with applicable Nigerian data protection laws, including the Nigeria Data Protection Act 2023 (NDPA) and applicable regulations and guidance issued by the Nigeria Data Protection Commission (NDPC).
The information we collect depends on how you use MyChange.
When you create or use a MyChange account, we may collect:
To verify your identity and protect your account, MyChange may collect:
Where facial or biometric information is processed, we treat it with appropriate safeguards and process it only for specified and legitimate purposes in accordance with applicable law. We do not use your facial information for unrelated purposes without an appropriate lawful basis.
When you use MyChange, we may collect information about your transactions, including:
When you use the MyChange app or website, we may automatically collect certain technical information, including:
We use this information to operate, secure, maintain, and improve MyChange.
We may use your personal information to:
We will not collect or use personal data for purposes that are incompatible with the purpose for which it was originally collected unless permitted by applicable law or you have been appropriately informed.
Depending on the circumstances, MyChange may process your personal data based on one or more lawful grounds recognised under applicable data protection law. These may include:
We may process information that is necessary to provide the MyChange services you request and to perform our agreement with you. For example, we need certain information to create your account and process transactions.
We may process your information where necessary to comply with applicable laws, regulations, court orders, regulatory requirements, financial-crime prevention obligations, record-keeping requirements, or requests from competent authorities.
Where consent is required, we will ask for your consent before processing your information for the relevant purpose. Where legally permitted, you may withdraw consent at any time. Withdrawal of consent will not affect processing that was lawfully carried out before the withdrawal.
Where permitted by applicable law, we may process information where necessary for legitimate interests such as:
Where we rely on legitimate interests, we will consider the impact of the processing on your rights and interests.
Facial verification is used primarily to help us:
Facial or biometric information will not be used for unrelated purposes without an appropriate lawful basis. Where third-party identity-verification providers are used, relevant information may be processed by those providers on our behalf, subject to appropriate contractual, security, and data protection requirements.
Where you use bank transfer, wallet funding, withdrawal, or other payment services, certain information may need to be shared with the relevant bank, payment processor, financial institution, or payment service provider to complete the transaction.
The information shared may include:
Such third parties may process your information under their own privacy policies and applicable legal obligations.
We take reasonable technical and organisational measures to protect your personal information against:
Security measures may include access controls, authentication mechanisms, encryption where appropriate, monitoring, secure infrastructure, and internal security procedures. However, no digital system can be guaranteed to be completely secure.
You are also responsible for protecting your account credentials, PIN, and device from unauthorised access.
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.
The length of time we retain information depends on factors such as:
When personal information is no longer required, we will take reasonable steps to securely delete, anonymise, or otherwise dispose of it in accordance with applicable requirements.
Subject to applicable law and any lawful limitations, you may have rights including:
You have the right to receive clear information about how your personal data is collected and used.
You may request access to personal information we hold about you.
You may request that inaccurate or incomplete personal information be corrected or updated.
In certain circumstances, you may object to the processing of your personal data.
In certain circumstances, you may request that we restrict the processing of your personal data.
Where applicable, you may request your personal data in a structured, commonly used, and machine-readable format or request that it be transferred to another organisation where technically feasible and legally required.
In certain circumstances, you may request that your personal information be deleted. This right is not absolute. We may need to retain certain information where required by law, regulation, fraud prevention requirements, or for the establishment, exercise, or defence of legal claims.
Where we process your information based on consent, you may withdraw your consent. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
Where applicable, you may have rights concerning decisions made solely through automated processing that produce legal or similarly significant effects. Where required by law, you may request appropriate human intervention or review.
Our website and digital services may use cookies and similar technologies to:
Where required, we will ask for your consent before using non-essential cookies.
You may be able to manage or disable cookies through your browser or device settings. Disabling certain cookies may affect the functionality of some services.
We may send you service-related communications, including:
Where permitted, we may also send promotional communications about products, offers, or services.
You may opt out of promotional communications by using the unsubscribe option provided or by contacting us.
You will continue to receive essential service and security communications even if you opt out of marketing communications.
MyChange is not intended for children who are below the minimum age required to use our services under applicable law.
We do not knowingly collect personal information from children in circumstances where such collection is prohibited by law.
If you believe that a child has provided personal information to us improperly, please contact us so that we can investigate and take appropriate action.
MyChange may contain links to third-party websites, services, or applications.
We are not responsible for the privacy practices of third parties that we do not control.
We recommend that you review the privacy policies of third-party services before providing them with your personal information.
If we become aware of a personal data breach, we will assess and respond to it in accordance with applicable legal and regulatory requirements.
Where notification to affected individuals or a regulatory authority is required, we will make such notification within the applicable timeframe and through an appropriate channel.
We may update this Privacy Policy from time to time to reflect:
When we make material changes, we will provide appropriate notice through the MyChange app, website, email, or another suitable communication channel.
The "Last Updated" date at the top of this Privacy Policy will indicate when the policy was most recently updated.
For questions, requests, or concerns about this Privacy Policy or how we process your personal information, contact: