Privacy Policy
1. Who we are
DukaChat is a product of DukaBills LTD ("DukaBills", "we", "us"). We are the data controller for the personal information described here. For any privacy question or request, email help@dukabills.com.
2. What we collect
Account information: your first and last name, email, phone number, password, one-time verification codes, and the referral code (if any) that brought you in.
Identity (KYC) information, depending on the verification flow:
- BVN or NIN, verified by OTP, for standard verification, or
- date of birth, residential address, BVN (and the phone number tied to your BVN where required), and a photograph for higher-tier verification.
KYC information is collected because the Central Bank of Nigeria's AML/CFT regulations require it of any provider of financial services.
Financial information: bank account details linked to your DukaChat account, transaction history (amounts, recipients, timestamps, descriptions), and saved recipients you build up over time. We never store your transaction PIN in clear text.
Conversation data: the WhatsApp messages you send to DukaChat, our replies, and the conversational context the assistant keeps so it can understand references like "send to Mom" or "what did I spend last week."
Device and usage data: IP address, device identifiers, and basic technical information about the requests you make, used for fraud detection and reliability.
Referral data: who you invited and the points you've earned.
3. How we use your data
- To create your account and verify your identity, based on our legal obligations under the NDPA and CBN AML/CFT rules.
- To process the transactions you ask for (sending money, receiving funds, paying bills, buying airtime), based on contract performance.
- To operate the AI assistant (see Section 4).
- To detect and prevent fraud, based on legitimate interest and legal obligation.
- To send you service messages (receipts, security alerts, account notices), based on contract performance.
- To improve DukaChat, using aggregated or de-identified data where possible.
- To send marketing where you have opted in. You can withdraw consent at any time.
4. The AI assistant
DukaChat is built around a conversational assistant inside WhatsApp. To understand what you type, we process your message content using trusted third-party AI providers. This is essential to how DukaChat works. Without it, the assistant cannot interpret requests like "send 10k to mom" or "what's my spend on food this week."
In practice:
- Your messages are sent to our AI providers for processing. We send the minimum context needed to answer the request.
- We never send your PIN, OTPs, passwords, or any other authentication credentials to AI providers. These are handled separately within our own systems.
- We retain conversation context only for as long as needed to operate the assistant and answer your follow-up questions.
- Transaction-derived data is kept as required by financial law and regulation.
- You can ask us to delete your conversation history at any time by emailing help@dukabills.com. This will not delete transaction records we are required to keep by law.
6. International transfers
Some of our service providers may process data outside Nigeria. Where this happens, we rely on safeguards permitted under the NDPA, such as standard contractual clauses or other NDPC-approved mechanisms, to keep your data protected at the same standard.
7. Your rights
Under the Nigeria Data Protection Act 2023, you have the right to:
- access the personal data we hold about you,
- ask us to correct it,
- ask us to delete it, subject to records we are legally required to keep,
- restrict or object to specific processing,
- receive a copy in a portable format,
- withdraw consent where processing was based on consent.
Email help@dukabills.com to exercise any of these. If you believe we have mishandled your data, you can lodge a complaint with the Nigeria Data Protection Commission (NDPC).
8. Security
We protect your data with encryption in transit and at rest, PIN and biometric checks for transactions, role-based access controls inside DukaBills, and continuous monitoring for unauthorised access. If a breach occurs that is likely to affect you, we will notify you and the NDPC within the timelines set out in the NDPA.
9. Children
DukaChat is for adults (18 and over). We do not knowingly collect personal data from anyone under 18. If you believe a child has used DukaChat, contact us and we will delete the data.
10. Changes to this policy
We may update this policy from time to time. Material changes will be communicated in DukaChat or by email. Your continued use after changes take effect means you accept the updated policy.
11. Contact
For any privacy question or request, including data access, correction, or deletion, email help@dukabills.com.