One Platform. Every Service.
- [email protected]
Global Privacy Policy
Entity Name: Wavetop Global Solutions Limited
Effective Date: January 1, 2026
Applicability: Global SMS Services, APIs, bills payments, VTU & Mobile Payment Solutions and other digital services
Contact Email: [email protected]
Primary Jurisdiction & Governing Law: Laws of the Federal Republic of Nigeria (NDPA 2023 / NDPC) & International Compliance Standards (GDPR, CCPA)
Executive Notice: This Privacy Policy constitutes a legally binding document governing the collection, processing, storage, transmission, and protection of Personal Data and Transaction Data by Wavetop Global Solutions Limited across all digital touchpoints, including Global SMS Services, APIs, bills payments, VTU & Mobile Payment Solutions and other digital services.
1. Introduction & Operational Scope
Wavetop Global Solutions Limited ("Wavetop Global", "Company", "we", "us", or "our") is a corporate entity registered and operating under the laws of the Federal Republic of Nigeria. Positioned as a provider of Global SMS Services, APIs, bills payments, VTU & Mobile Payment Solutions and other digital services, Wavetop Global is dedicated to protecting personal data and maintaining strict compliance with Nigerian statutory privacy mandates while adhering to global standards where international data interactions occur.
Our digital service ecosystem includes:
- Omnichannel Enterprise Messaging: SMS (A2P/P2A), WhatsApp Business API, Telegram Messaging Integration, and Interactive Voice Response (IVR)/Voice Call solutions.
- Virtual Top-Up (VTU) & Utility Provisioning: Real-time automated Airtime top-up, Mobile Data bundling, and Bulk Distribution APIs across multinational Mobile Network Operators (MNOs).
- Bill Payments & Mobile Payment Solutions: Electricity utility settlements, Cable TV subscriptions, Educational institution fee collection, Internet Service Provider (ISP) billing, and Mobile Payment orchestration.
- Enterprise & Agent Infrastructure: Business-to-Business (B2B) portals, Agent distribution software, Developer API gateways, and Dashboard account management.
2. Data Controller & Primary Regulatory Authority
Under the Nigeria Data Protection Act (NDPA) 2023 and the regulatory directives of the Nigeria Data Protection Commission (NDPC), Wavetop Global Solutions Limited acts as a primary Data Controller for personal data collected directly from registered users, merchants, and platform visitors.
Where Wavetop Global processes transaction metadata, mobile phone numbers, or messaging payloads on behalf of third-party enterprise clients via APIs or corporate portals, Wavetop Global functions in the legal capacity of a Data Processor. For cross-border interactions involving foreign data subjects (e.g., EU/UK residents), Wavetop Global concurrently adheres to applicable extraterritorial regulations such as the General Data Protection Regulation (GDPR).
3. Categories of Data Collected
We collect personal data to deliver seamless, secure, and compliant services. Data categories processed include:
| Data Category | Specific Data Elements Collected | Primary Source |
|---|---|---|
| Identity & Profile Data | Full name, business name, date of birth, government-issued identification (National Identification Number [NIN], Bank Verification Number [BVN] where statutorily mandated, Tax Identification Number, Passport), CAC corporate registration documents. | User Account Registration / KYC Verification |
| Contact & Location Data | Primary email address, mobile phone number, physical address, IP geolocation. | Direct Input & System Telemetry |
| Financial & Transactional Data | Wallet balances, transaction references, payment confirmation receipts, settlement records, billing histories. | Direct Input & Integrated Payment Processors |
| Telecommunication & VAS Data | Recipient phone numbers, SMS payload metadata, messaging logs, VTU top-up records, utility meter numbers, smartcard numbers. | API Activity & Service Execution |
| Technical & Telemetry Data | IP address, browser type, operating system, unique device identifiers, access timestamps, API tokens, log data, and session security metrics. | Automated System Interaction |
4. Lawful Bases and Purposes of Processing
In accordance with Section 25 of the NDPA 2023, we process personal data only under recognized lawful bases:
- Contractual Performance: To establish user accounts, execute VTU requests, route messaging payloads, process bill payments, disperse mobile payments, and fulfill platform requests.
- Legal & Statutory Compliance: To satisfy Anti-Money Laundering (AML), Counter-Financing of Terrorism (CFT), and Know Your Customer (KYC) requirements under Nigerian statutory laws, central banking guidelines, and telecommunications regulations.
- Legitimate Business Interests: To detect and prevent fraud, safeguard network infrastructure, conduct internal audits, and optimize API performance.
- Consent: For direct marketing communications and optional telemetry features, which may be withdrawn by the data subject at any time.
5. Information Sharing & Third-Party Disclosures
Wavetop Global does not sell or lease personal data. Disclosures are restricted strictly to authorized operational partners under legally binding processing agreements:
- Telecommunications & Network Operators: MNOs and aggregators necessary to deliver SMS, voice calls, data bundles, and airtime top-ups.
- Licensed Payment Gateways & Financial Partners: Payment switches and gateway providers regulated by financial authorities processing mobile payments and bill settlements.
- Regulatory & Statutory Bodies: Regulatory agencies, including the Nigeria Data Protection Commission (NDPC), Central Bank of Nigeria (CBN), or Nigerian Communications Commission (NCC), when compelled by statutory reporting duties or court order.
6. Cross-Border Data Transfers
Where international routing of SMS payloads or foreign cloud infrastructure processing is required, cross-border data transfers are executed in strict compliance with Part VI of the NDPA 2023. Wavetop Global ensures that recipient jurisdictions provide an adequate level of data protection or that standard contractual clauses and end-to-end encryption (TLS 1.3 / AES-256) are enforced.
7. Data Retention & Lifecycle Management
Personal data is retained in compliance with statutory requirements:
- Account & KYC Records: Retained for the duration of the account relationship plus 5 to 7 years following closure, in accordance with Nigerian statutory financial recordkeeping laws.
- Transactional & Financial Records: Retained for 7 years to meet tax and legal obligations.
- API Logs & Telemetry: Retained for up to 12 months for security auditing and platform optimization.
8. Technical and Organizational Security Measures
Wavetop Global implements robust organizational security controls in alignment with Nigerian and international cybersecurity frameworks:
- Encryption Standards: AES-256 encryption at rest and TLS 1.3 protocol for data in transit across all APIs and web dashboards.
- Access Management: Strict role-based access control (RBAC), multi-factor authentication (MFA), and secure API key management.
- Infrastructure Integrity: System monitoring, intrusion detection systems (IDS), regular vulnerability assessments, and routine data security audits.
9. Data Subject Rights & Regulatory Recourse
Under the Nigeria Data Protection Act 2023, data subjects hold enforceable statutory rights:
- Right of Access & Portability: Obtain confirmation and copies of personal data undergoing processing.
- Right to Rectification: Request correction of inaccurate or incomplete personal records.
- Right to Erasure: Request deletion of data where processing is no longer required or lacks statutory basis.
- Right to Object & Restrict: Object to processing based on legitimate interests or restrict processing under disputed circumstances.
- Right to Lodge a Complaint: File a legal complaint directly with the Nigeria Data Protection Commission (NDPC) if data rights are believed to have been infringed.
To exercise rights, submit inquiries to [email protected].
10. Data Breach Notification
In the event of a security compromise resulting in a personal data breach, Wavetop Global maintains an incident protocol. We will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, and inform affected data subjects without delay where high risk to their rights is identified.
11. Governing Law & Dispute Resolution
This Privacy Policy, its interpretation, and any legal disputes or claims arising out of or in connection with it shall be governed by, construed, and enforced in accordance with the Laws of the Federal Republic of Nigeria.
Any conflict or dispute shall first be addressed through good-faith executive negotiations. If unresolved within 30 days, disputes shall be submitted to binding arbitration in Lagos, Nigeria, conducted in English under the Arbitration and Mediation Act of Nigeria, or referred to the exclusive jurisdiction of the competent courts of the Federal Republic of Nigeria.
12. Contact Information
For data protection inquiries or statutory compliance matters, contact:
Wavetop Global Solutions Limited
Legal & Regulatory Compliance Directorate
Email: [email protected]
Website: https://wavetopglobal.com
© 2026 Wavetop Global Solutions Limited. Registered in Nigeria. All Rights Reserved.