1. Scope and responsibility
We determine the purposes and means of processing for our own account administration, verification, security, legal compliance and business communications. For those activities, LaConnet is a data controller. Where we process customer data solely on a merchant’s documented instructions, we act as a processor under the applicable data processing agreement. A payment transaction may involve both roles for different purposes.
Merchants, banks, payment networks and other providers may independently control data for their own services. Their notices also apply. This notice does not replace a merchant’s privacy notice or the terms of an executed data processing agreement. Contact info@laconnet.com with the subject “Privacy” for questions about the responsible entity or processing role.
2. Personal data and its sources
Information you or your organisation provide may include names, business contact details, account identifiers, correspondence, identification documents, business registration records, ownership and control information, settlement account or wallet details, and information needed to investigate a complaint.
Payment information may include transaction references, amounts, currencies, timestamps, payment status, refunds, disputes, billing details and payment instrument information submitted through the relevant payment flow. The information available to LaConnet depends on the integration and the roles of the acquiring bank and payment provider.
Technical information may include IP addresses, browser and device information, session identifiers, access logs, approximate location derived from an IP address, and interactions with the service. We may receive verification results, fraud indicators, transaction outcomes and dispute evidence from merchants, financial institutions, verification providers and lawful public sources. Do not send passwords, PINs, security codes or full card details in email or support attachments.
3. Purposes and lawful grounds
We use information to establish and administer accounts, provide requested services, route payments, reconcile transactions, support settlements and handle refunds and disputes. Where you are a party to the relevant contract, processing necessary to perform it or take requested steps before entering it may be the legal basis. For business representatives and other individuals, the basis may instead be a legitimate interest or legal obligation.
We use identity and transaction information for verification, sanctions screening, fraud prevention, recordkeeping, lawful reporting and responding to binding requests where applicable obligations require it. We also process information for our legitimate interests in securing services, preventing abuse, managing operational risk, responding to enquiries and defending legal claims, after considering the impact on individuals.
Where consent is required, including for applicable optional tracking or marketing, we seek it separately. You may withdraw consent without affecting earlier lawful processing. Refusal to provide information necessary for verification or payment processing may prevent the relevant service. We do not treat acceptance of service terms as blanket consent to unrelated processing.
4. Recipients and disclosures
We disclose information as necessary for the stated purposes to the merchant involved in a payment; banks, acquirers, payment networks and settlement providers; identity, fraud and security providers; hosting, communications and support suppliers; and professional advisers. A supplier acting as our processor must act under appropriate contractual instructions and confidentiality and security obligations.
We may disclose information where lawfully required by courts, regulators or law enforcement, or where necessary and lawful to investigate abuse, protect rights or pursue a claim. In a proposed business transfer, relevant information may be disclosed subject to confidentiality and applicable legal safeguards. We limit disclosures to what is appropriate for the purpose.
Personal data is not made available for others’ unrelated marketing merely because you make a payment or contact us. Any separate advertising or marketing disclosure requiring notice, consent or an opt-out must follow those requirements. You can request information about the recipients relevant to your data.
5. International processing
A cross-border payment or service provider arrangement may require access to data from another country. The applicable destination depends on the payment route and suppliers used; access from abroad can itself be a transfer.
Where transfer restrictions apply, we must use a permitted transfer ground and safeguards, such as an applicable adequacy decision or recognised contractual safeguards with supplementary measures where necessary. A service contract alone does not remove transfer requirements. Contact us for the destinations and safeguards relevant to your data or a copy of applicable safeguards, subject to lawful confidentiality redactions.
6. Retention and deletion
Retention depends on the purpose, applicable recordkeeping rules and outstanding liabilities. Account and verification records may need to remain after closure; transaction, reconciliation and dispute records may remain for statutory retention periods and the time needed to resolve claims; technical and support records are kept according to their security and operational purpose.
We do not apply a single indefinite retention period to all personal data. Relevant factors include the account relationship, transaction date, legal retention requirements, dispute and limitation periods, and documented legal holds. After the applicable purpose and retention period end, data should be securely deleted or irreversibly anonymised. Backup copies may remain until their scheduled replacement and must remain protected. Ask us for the period or criteria applicable to a particular record.
7. Security and incidents
We apply technical and organisational measures appropriate to the processing risks, including access restrictions and safeguards for data in transit and storage. No service can promise absolute security. Merchants remain responsible for their own systems, authorised users and integration obligations.
If a personal data breach occurs, we will assess it and make notifications to authorities, affected individuals or relevant controllers where required, within the applicable legal or contractual time limits. Report suspected compromise promptly to info@laconnet.com with the subject “Security incident”, without including sensitive payment credentials.
8. Your rights and requests
Depending on the law applicable to you, you may request access and a copy of your data, correction, erasure, restriction, portability, information about processing or transfers, and object to certain processing. You may withdraw consent and object to direct marketing. Rights are subject to their legal conditions; for example, erasure may not apply to records we must retain.
Send requests to info@laconnet.com with the subject “Privacy request”. Identify your relationship to the service and the request, using a transaction reference where helpful. We may seek proportionate verification, but you should not email full card details or identity documents unless a secure method has been arranged. We respond within the time required by applicable law and explain any lawful refusal or extension.
If we act only on a merchant’s instructions, we may refer the request to that merchant and assist it as required. You may complain directly to the Nigeria Data Protection Commission or the competent authority where you live or work, where applicable. You do not have to complete our complaint process before exercising a statutory remedy.
9. Risk screening and automated decisions
Electronic tools may help identify suspicious activity and assess transaction or onboarding risk. Relevant information may include verification results, transaction patterns, device information and sanctions indicators. A flag may lead to additional verification, a delayed transaction or review; it does not by itself establish wrongdoing.
Where applicable law gives you rights concerning a solely automated decision with legal or similarly significant effects, you may request human intervention, explain your position and challenge the decision. Contact us for information about an applicable decision, subject to lawful restrictions protecting investigations and security.
10. Cookies, communications and children
Our Cookie Policy explains browser storage and third-party form protection. Service and security notices are distinct from optional promotional messages. Use the unsubscribe option in marketing communications or contact us to change marketing preferences.
Merchant accounts are intended for adults with authority to represent their organisation. The service is not directed to children. If a transaction or enquiry involves a child’s data, applicable protections still apply; contact us about suspected inappropriate collection so that we can assess and address it.
11. Regional protections and changes
The Nigeria Data Protection Act 2023 and applicable implementing requirements govern processing within their scope. Other laws, including EEA or UK data protection requirements, apply where their territorial conditions are met. Availability of a website internationally is not a statement that all regional laws apply identically or that we have a local establishment everywhere.
We update this notice when processing or legal requirements change and provide additional notice where required. A notice update does not retrospectively authorise incompatible uses or replace consent where consent is required. The revision date appears above.