GET PAID. PROFESSIONALLY. INSTANTLY.
Privacy
Your data
belongs
to you.
We collect only what we need to run the platform. We never sell your data. You can request deletion at any time.
✓ We never sell your data
✓ Invoice data is yours to export
✓ WhatsApp messages used only for invoicing
✓ Encrypted in transit and at rest
✓ Delete your account any time
40+
Businesses
<15min
Settlement
₦0
Monthly fee
Privacy
Privacy Policy
Grymey Technologies Limited · RC No. 8749776 · Last updated: July 2026
Grymey Technologies Limited ("Grymey", "we", "our", or "us") operates grymey.com and the Grymey invoicing, payment, and wallet platform. This Privacy Policy explains how we collect, use, and protect your personal information when you use our services.
1. Information We Collect
| Category | Examples |
|---|---|
| Account Information | Name, email address, phone number, date of birth, business name, hashed password and security credentials |
| Identity Documents | Government-issued ID, BVN or NIN, liveness photograph, biometric verification data |
| Address Verification | Proof of address documents, GPS-based location verification |
| Next of Kin Details | Name, phone number, and relationship of nominated next of kin |
| Business Information | Business address, CAC registration documents, tax identification number, bank account details for settlement, business logo, brand preferences, and invoice template settings |
| Wallet and Ledger Data | Wallet balances, ledger journal entries, payout history, and settlement records |
| Transaction Data | Invoices you create, invoice line items and descriptions, PNR and travel details where applicable, payment amounts, payment references, and receipt records |
| Client Data | Names, email addresses, phone numbers, and company names of clients you invoice through Grymey. These individuals are third-party data subjects whose data you provide to us for the purpose of invoice delivery and payment collection. |
| Collaborator Data | Names and bank account details of collaborators nominated to receive split payouts |
| WhatsApp Messages | Messages sent to our bot solely for the purpose of invoice creation. Message content is not stored permanently beyond what is necessary to complete invoice creation. |
| Usage Data | How you interact with the platform, device information, browser type, IP address, and session activity |
| Cookies | Session cookies for login and security; non-essential cookies only with your explicit consent |
2. How We Use Your Information
- To provide and operate the Grymey invoicing, payment, and wallet platform
- To process payments and settle funds to your designated bank account
- To send invoice notifications, payment confirmations, and reminders to your clients
- To verify your identity and business through our KYC process
- To comply with Nigerian financial regulations and legal obligations
- To detect and prevent fraud and unauthorised account activity
- To improve our platform based on usage patterns
- To communicate with you about service updates and important notices
3. Data Protection Principles
Grymey is committed to the following data protection principles as required by the NDPA 2023:
| Principle | How Grymey Applies It |
|---|---|
| Lawfulness, Fairness, and Transparency | We process personal data only on valid lawful bases and with clear privacy notices. |
| Purpose Limitation | We collect data only for specified, explicit, and legitimate purposes. |
| Data Minimisation | We collect only the data strictly necessary for our services. |
| Accuracy | We take reasonable steps to keep data accurate and up to date. |
| Storage Limitation | We retain data only as long as necessary for the purposes collected. |
| Integrity and Confidentiality | We implement appropriate security measures to protect data. |
4. Lawful Basis for Processing Personal Data
Under the NDPA 2023 and GAID 2025, Grymey relies on the following five lawful bases:
| Lawful Basis | When We Rely On It |
|---|---|
| Consent | When you voluntarily agree to specific processing activities, such as receiving marketing communications. You can withdraw your consent at any time. |
| Contract | When processing is necessary to perform our contract with you, including creating your account, processing invoices, and settling payments. |
| Legal Obligation | When we are required to process your data to comply with Nigerian laws, including CBN AML/CFT requirements, tax laws, and KYC obligations. |
| Vital Interests | When processing is necessary to protect someone's life in emergency situations. |
| Public Interest | When processing is necessary for tasks carried out in the public interest or in the exercise of official authority. |
Grymey does not rely on "Legitimate Interest" as a lawful basis for processing your personal data.
Questions about the lawful basis for a specific processing activity? Contact us at privacy@grymey.com.
5. Data Sharing
We do not sell your personal data. We share data only with trusted service providers necessary to operate our platform:
| Category | Purpose |
|---|---|
| Banking, Financial, and Payment Partners | For payment collection, wallet operations, treasury services, settlement, and fund transfers |
| Identity Verification Providers | For BVN and NIN verification, biometric liveness checks, and KYC processing |
| Address Verification Providers | For physical or GPS-based and document-based proof of address verification |
| Cloud Infrastructure Providers | For database hosting, file storage, and secure data processing |
| Communication Services | For email delivery, SMS notifications, and WhatsApp messaging |
| AI Services | For invoice processing, natural language extraction, fraud detection, and automated support |
| Compliance and Fraud Prevention Services | For sanctions screening, AML monitoring, and regulatory reporting |
We engage third-party data processors under written contracts that ensure compliance with the NDPA 2023 and GAID 2025. A full list of our current data processors is available upon request.
We may disclose your information if required to do so by Nigerian law or regulatory authorities.
6. Cross-Border Data Transfers
We use cloud infrastructure and service providers that may process your data outside Nigeria. Grymey ensures that:
- Transfers are made only to countries with adequate data protection laws, or
- We implement appropriate safeguards such as standard contractual clauses as required by the GAID 2025
- We comply with all NDPC requirements for cross-border data transfers
7. Data Retention
| Data Category | Retention Period | Reason |
|---|---|---|
| KYC Documents | 5 years from account closure | CBN AML/CFT regulatory requirements |
| Transaction Records | 5 years from account closure | CBN and NFIU record-keeping requirements |
| Account Information | Until account closure or 5 years of inactivity | Service delivery and regulatory compliance |
| Marketing Data | Until consent is withdrawn | User preference management |
| WhatsApp Messages | Immediately after invoice creation | Purpose fulfilled; not permanently stored |
8. Your Rights Under the NDPA 2023
| Right | What It Means |
|---|---|
| Right to be Informed | You have the right to know what personal data we collect, why, how we use it, who we share it with, and how long we keep it. |
| Right of Access | You have the right to request a copy of the personal data we hold about you within 30 days of your request. |
| Right to Rectification | You have the right to correct any inaccurate or incomplete personal data we hold about you. |
| Right to Erasure | You have the right to request deletion of your personal data, subject to our regulatory retention obligations. |
| Right to Restrict Processing | You have the right to request that we limit how we use your personal data while we verify accuracy or lawful basis. |
| Right to Object | You have the right to object to processing for direct marketing or where we rely on public interest as a lawful basis. |
| Right to Data Portability | You have the right to request transfer of your personal data to another organisation where technically feasible. |
| Right to Lodge a Complaint | You have the right to lodge a complaint with the NDPC via the SNAG process introduced under GAID 2025. |
How to exercise your rights:
- Email: privacy@grymey.com with subject line "Data Subject Request"
- In-App: Use the "Request My Data" feature in your account settings
We acknowledge within 5 business days and respond substantively within 30 days.
9. Data Protection Impact Assessments (DPIA)
Grymey conducts DPIAs for high-risk processing activities including KYC verification, fraud detection, automated decision-making, and processing of sensitive personal data (biometrics, BVN, NIN). Where a DPIA identifies an unmitigable risk, we consult the NDPC before proceeding.
10. Data Protection Officer
Grymey has designated a Data Protection Officer (DPO) responsible for overseeing data protection compliance.
DPO Email: dpo@grymey.com
11. Data Breach Notification
In the event of a personal data breach likely to result in high risk to data subjects, Grymey will:
- Notify the NDPC within 72 hours of becoming aware of the breach
- Notify affected data subjects directly without undue delay
- Document all breaches including nature, categories of data affected, and remedial actions taken
All breach records are retained for a minimum of five years.
12. Cookies and Tracking
| Cookie Type | Purpose | Consent Required |
|---|---|---|
| Strictly Necessary | Session management, login state, security, and basic functionality | No |
| Non-Essential | Analytics, usage tracking, and performance improvement | Yes, explicit consent required |
You can change your cookie preferences or withdraw consent at any time via your browser settings or our cookie banner.
13. Data Security
- Encryption of data in transit (TLS 1.3)
- Encryption of data at rest (AES-256)
- Access controls limiting who can access your data
- Regular security reviews of our platform and infrastructure
- Employee training on data protection
No system is completely secure. In the event of a data breach affecting your personal information, we will notify you as required by applicable law.
14. Children's Privacy
Grymey does not knowingly collect personal data from individuals under the age of 18. If we become aware that we have collected personal data from a child under 18 without parental consent, we will take steps to delete that information.
15. Updates to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of any material changes by posting the updated policy on our website and, where appropriate, sending you an email notification.
The "Last updated" date at the top of this policy indicates when it was last revised.
16. Contact Us
Grymey Technologies Limited
RC No. 8749776 · Lagos, Nigeria
Privacy: privacy@grymey.com
DPO: dpo@grymey.com
© 2026 Grymey Technologies Ltd