Privacy policy

1. Introduction

1.1 This Privacy Policy explains how Smart Edge Tech Limited, trading as Lyonga, collects, uses, shares, stores and protects personal data, and the rights you have over your personal data under the Data Protection Act No. 3 of 2021 of Zambia (the “Act”).

1.2 It applies to personal data about visitors to our website, businesses that apply to become merchants, the people who use merchant accounts, and the customers of our merchants who make payments through Lyonga.

1.3 In this policy, “personal data”, “processing”, “data controller”, “data processor” and “data subject” have the meanings given to them in the Act.

2. Who is responsible for your data

2.1 Smart Edge Tech Limited is the data controller for the personal data described in this policy, except where clause 2.3 says otherwise.

• Legal name: Smart Edge Tech Limited, trading as Lyonga
• Company registration number: [TBC]
• Registered address: [Registered address TBC], Lusaka, Zambia
• Telephone: [Phone TBC]

2.2 You can contact us about any privacy matter at privacy@lyonga.com.

2.3 When a merchant uses Lyonga to collect payments from its customers, the merchant is responsible for its own relationship with those customers and for its own use of their personal data. For the payment processing we carry out on the merchant's instructions, we act on the merchant's behalf. For the checks we must carry out ourselves, such as fraud prevention, anti-money laundering checks and keeping records required by law, we decide how the data is used and act as a data controller in our own right.

2.4 We operate Lyonga in partnership with Lipila, a licensed payment service provider in Zambia. Lipila processes some personal data for its own legal and regulatory purposes, and its own privacy notice applies to that processing.

3. The personal data we collect

Website visitors

• Technical data such as IP address, browser type, device type, pages visited and the time of a visit.
• Information you send us through our contact or complaints forms: name, email address, phone number, the business you represent and your message.

Merchant applicants

• Business details: legal and trading name, business type, registration number, taxpayer identification number (TPIN), industry, website, description of the business, expected payment volumes and business address.
• Details of the contact person: name, role, email address and phone number.
• Verification information about directors, shareholders, beneficial owners and authorised signatories, such as names, dates of birth, nationality, identity documents (for example a National Registration Card or passport), residential address and photographs.
• Business documents, such as certificates of incorporation, records from the Patents and Companies Registration Agency, bank details and proof of address.
• Records of your consents and acceptance of our terms, with the date, time, IP address and browser used.

Merchant users

• Name, work email address, phone number, role and permissions.
• Sign-in and security data, such as multi-factor authentication settings, session records and an audit trail of actions taken in the dashboard.
• Support requests and other communications with us.

Merchants' customers (payers)

• Payment details needed to process a payment through the payment methods approved for the merchant, such as a name, phone number, email address or account or card reference.
• Transaction data: amount, currency, date and time, merchant, reference, status and the result of the payment.
• Device and network information used to detect and prevent fraud.
• Information provided when you raise a refund request, dispute or complaint.

3.1 We do not intend to collect sensitive personal data as defined in the Act, except where it appears in identity documents we are required to verify, or where the law requires it. Where we do process it, we do so only as the Act allows.

4. How we collect personal data

4.1 We collect personal data:

• directly from you, when you fill in a form, apply for an account, use the dashboard or contact us;
• from merchants, when they send payment requests or customer details to us through the API or dashboard;
• automatically, through our systems and essential cookies when you use the website and the Services; and
• from third parties, including Lipila, payment networks, mobile network operators, banks, identity verification services, public registers and sanctions lists, where this is needed for the purposes described below.

5. Why we use personal data and our lawful bases

5.1 We only process personal data where the Act allows us to. The table below sets out the main purposes and the lawful basis we rely on for each.

5.2 Where we rely on legitimate interests, we balance those interests against your rights and do not rely on them where your rights override them.

5.3 We do not sell personal data, and we do not use payers' payment data for advertising.

6. Identity verification and anti-money laundering checks

6.1 Because Lyonga provides payment services in partnership with a licensed payment service provider, we and Lipila must know who our merchants are and monitor transactions for suspicious activity. This is required by anti-money laundering and counter-terrorist financing law in Zambia, including the Financial Intelligence Centre Act No. 46 of 2010 (as amended).

6.2 To meet these obligations we may:

• verify the identity of a merchant and of its directors, beneficial owners and authorised signatories;
• check names against sanctions lists, lists of politically exposed persons and adverse media;
• monitor transactions and account activity for unusual patterns;
• ask for further information or documents; and
• report suspicious transactions to the Financial Intelligence Centre or other competent authorities where the law requires it.

6.3 The law may prevent us from telling you that a report has been made. If a check suggests a risk, a person will review the result before we take a final decision to decline or close an account. You may ask us to explain a decision that affects you and give us your point of view, unless the law prevents us from doing so.

7. Who we share personal data with

7.1 We share personal data only where we need to, and only with:

• Lipila, our licensed partner, for onboarding and verification, payment processing, settlement, risk management and its own regulatory obligations;
• Payment networks and providers, such as mobile network operators, banks and card networks that operate the payment methods approved for a merchant, so that payments, refunds and reversals can be completed;
• The merchant that a payer is paying, which receives the transaction details it needs to fulfil the order and keep its records;
• Service providers who help us run the Services, such as hosting and cloud infrastructure, identity verification, email and messaging, and customer support tools. They may process personal data only on our instructions and must keep it secure and confidential;
• Professional advisers, such as lawyers, auditors and insurers, under a duty of confidentiality;
• Regulators, courts and law enforcement, including the Bank of Zambia, the Financial Intelligence Centre, the Office of the Data Protection Commissioner and the Zambia Police Service, where we are required or permitted by law to do so; and
• A buyer or successor of all or part of our business, under appropriate confidentiality terms, if the business is reorganised or sold.

8. Transfers outside Zambia

8.1 Some of our service providers, such as hosting or email providers, may store or process personal data outside Zambia. Where personal data leaves Zambia, we do so only as the Act allows, and we put safeguards in place, which may include:

• transferring data to countries or organisations that provide an adequate level of protection;
• written contracts that require the recipient to protect the data to a standard at least equivalent to the Act;
• your consent, where the Act allows consent to be relied on; and
• any authorisation or conditions set by the Data Protection Commissioner.

8.2 Where the Act or any regulation made under it requires certain personal data to be stored or processed in Zambia, we will comply with that requirement. You can ask us for more information about the safeguards we use by contacting privacy@lyonga.com.

9. How long we keep personal data

9.1 We keep personal data only for as long as we need it for the purposes in this policy, or for as long as the law requires.

• Transaction, verification and account records are kept for at least the period required by applicable law, including anti-money laundering law such as the Financial Intelligence Centre Act, and financial and tax record-keeping laws. That period usually runs from the end of the business relationship or the date of the transaction, as the law specifies.
• Declined or withdrawn merchant applications are kept for as long as required by applicable law and to show how we reached our decision.
• Enquiries and complaints are kept for as long as needed to deal with them and to keep a record of how they were handled, as required by applicable law.
• Technical and security logs are kept for a limited period for security and troubleshooting, unless they are needed to investigate an incident.

9.2 When we no longer need personal data, we delete it or anonymise it so that it can no longer identify you.

10. How we protect personal data

10.1 We use technical and organisational measures appropriate to the risk to protect personal data against loss, misuse, unauthorised access, alteration and disclosure. These include encrypted connections (HTTPS), role-based access controls, multi-factor sign-in for merchant accounts, storing secret API keys in hashed form, audit trails of account activity, and monitoring of our systems.

10.2 No system is completely secure. If a personal data breach occurs that is likely to affect your rights, we will notify the Data Protection Commissioner and, where required, you, as the Act requires.

10.3 You can read more on our security and compliance page.

11. Your rights

11.1 Under the Act you have the right to:

• access the personal data we hold about you and receive a copy of it;
• rectification, to have inaccurate or incomplete data corrected;
• erasure, to have your data deleted where we no longer have a lawful reason to keep it;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• restriction, to ask us to limit how we use your data in some circumstances;
• data portability, to receive data you gave us in a structured, commonly used and machine-readable format, or have it sent to another controller where this is technically feasible;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects for you, except where the Act allows it;
• withdraw consent at any time where we rely on consent, without affecting processing that took place before you withdrew it; and
• complain to the Data Protection Commissioner.

11.2 Some rights are limited. For example, we cannot delete transaction or verification records that the law requires us to keep, and we may not be able to disclose information where doing so would breach anti-money laundering law or affect another person's rights. If we cannot meet a request, we will tell you why, unless the law prevents us.

11.3 To exercise your rights, email privacy@lyonga.com. We may need to verify your identity before acting on a request. We will respond within the time required by the Act and will not charge a fee unless the Act allows it.

11.4 If you are a merchant's customer and your request is about the merchant's use of your data, please contact the merchant first. We will help the merchant respond where the data is held on our platform.

12. Complaints to the Data Protection Commissioner

12.1 If you are unhappy with how we have handled your personal data, please contact us first at privacy@lyonga.com so we can try to put it right. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner in Zambia at any time. Our Complaints Procedure explains how we handle complaints.

13. Cookies

13.1 We use essential cookies to run the website and dashboard securely, and we do not use advertising cookies. Our Cookie Policy explains the cookies we use and how to control them.

14. Children

14.1 The website and merchant Services are intended for businesses and adults. We do not knowingly collect personal data from children through the website. Where a child makes a payment to a merchant, the merchant is responsible for making sure that it may lawfully accept the payment and, where needed, for obtaining consent from a parent or guardian. If you believe we hold a child's data that we should not, please contact us.

15. Changes to this policy

15.1 We may update this policy from time to time, for example when our Services or the law change. The date of the latest version is shown at the top of this page. Where a change is significant, we will take reasonable steps to tell merchants and other people we have a relationship with.

16. Contact us

16.1 For any question about this policy or your personal data, contact our privacy team at privacy@lyonga.com, or write to us at Smart Edge Tech Limited, [Registered address TBC], Lusaka, Zambia.