Last updated 5 October 2026
Privacy Policy
This Privacy Policy explains how EriPay ("EriPay", "we", "us" or "our") collects, uses, shares and protects personal data when you visit eripays.com, open an EriPay account, use the EriPay web and mobile applications, act as an EriPay merchant or agent, or contact us (together, the "Services").
We process personal data in line with the Data Protection and Privacy Act, 2019 of Uganda and the Data Protection and Privacy Regulations, 2021, together with other laws that apply to financial services, including the Anti-Money Laundering Act, 2013 (as amended) and the National Payment Systems Act, 2020. Where you use EriPay from another country, we also respect the privacy laws that apply to you there.
The short version
- We collect what we need to open and secure your wallet, verify your identity, move your money and meet our legal duties.
- We never sell your personal data.
- We share data only with the partners who help deliver the Services (such as mobile money networks, card issuers and identity checkers), and with authorities when the law requires it.
- Financial and identity records are kept for the period anti-money laundering law requires, even after you close your account.
- You can ask to see, correct or object to the use of your data at any time by writing to info@eripays.com.
1. Who is responsible for your data
EriPay is the data controller for the personal data described in this policy. You can reach us at:
- Address: Onapa Rd, Barogole - weigweng, City West Division, Lira, Uganda
- Email: info@eripays.com (please use the subject line "Data Protection")
- Phone: +256 702 430 400
When a merchant uses EriPay to collect payments from its own customers, the merchant is responsible for its customer relationship and its own privacy notice. EriPay processes the payment data needed to complete the payment, prevent fraud and meet its legal obligations.
2. The personal data we collect
2.1 Data you give us
- Account details: name, username, email address, phone number, country, password (stored only in hashed form) and Wallet PIN (also hashed).
- Identity verification (KYC) data: date of birth, nationality, residential address, national ID number (NIN), passport or other government ID, photographs or "selfie" images taken for liveness checks, and, for businesses, registration documents, ownership and director details, and the nature of the business.
- Payment details: mobile money numbers, bank account details, card details entered for deposits (handled by our card processing partners), crypto wallet addresses, and the names and details of people you pay or request money from.
- Merchant and agent data: business name, business email, website, operating location, settlement details, API usage and agent operating notes.
- Communications: support tickets, chat messages, emails, call notes, survey answers and feedback.
2.2 Data we collect when you use the Services
- Transaction data: deposits, withdrawals, transfers, currency exchanges, payments, refunds, subscriptions, virtual card activity, gift cards, vouchers, airtime top-ups, Wallet Earn stakes, rewards and the fees charged on each.
- Device and log data: IP address, device type, operating system, browser, app version, time zone, language, pages viewed, and the date and time of sign-ins and activity.
- Approximate location: the country and city derived from your IP address, used to detect unusual sign-ins and to apply the right currencies and limits. We do not collect precise GPS location.
- Cookies and similar technologies: see our Cookie Policy.
2.3 Data we receive from others
- Mobile network operators, payment aggregators, banks, card issuers and blockchain networks that confirm whether a payment succeeded.
- Identity verification and fraud prevention providers that check your documents against official databases, sanctions lists and politically exposed person (PEP) lists.
- Merchants you pay, and other EriPay users who send money to you or request money from you.
- Public sources, such as company registries and government notices.
3. How and why we use your data
We only use personal data where the law allows it. The table below sets out our purposes and the lawful basis for each.
| Purpose | Lawful basis |
|---|---|
| Opening and running your account, processing transactions, applying fees and keeping your balance and statements accurate. | Performance of our contract with you. |
| Verifying your identity, screening against sanctions and PEP lists, monitoring transactions, and reporting suspicious activity to the Financial Intelligence Authority. | Compliance with legal obligations (anti-money laundering and counter-terrorist financing law). |
| Detecting and preventing fraud, account takeover and abuse, including new-device and unusual sign-in alerts. | Legal obligations and our legitimate interest in keeping customers and EriPay safe. |
| Sending service messages by email, push notification and SMS: receipts, security alerts, one-time codes and changes to our terms. | Performance of our contract and legal obligations. |
| Customer support and handling complaints and disputes. | Performance of our contract and legitimate interests. |
| Improving the Services, analysing usage and fixing problems (using aggregated or pseudonymised data where possible). | Legitimate interests. |
| Sending news, offers and promotions about EriPay. | Your consent, which you can withdraw at any time. |
| Keeping records, responding to lawful requests from courts, regulators and law enforcement, and defending legal claims. | Legal obligations and legitimate interests. |
Automated decisions
We use automated tools to flag transactions that may be fraudulent, to apply account limits and to check identity documents. When an automated check blocks or limits your account, a member of our team reviews the case on request, and you can ask us to explain the decision and give your point of view.
4. Who we share your data with
We do not sell or rent your personal data. We share it only where needed, and only with:
- Payment partners: mobile network operators, payment aggregators, banks, card issuers and processors, crypto networks and liquidity providers that carry out the payments you ask for.
- The other party to a transaction: for example, the person you send money to sees your name and the amount, and a merchant sees the details needed to fulfil your order.
- Service providers working for us: cloud hosting, identity verification, sanctions screening, SMS and email delivery, real-time notifications, airtime top-up providers, IP geolocation, analytics and customer support tools. They may use the data only to provide their service to us, under written confidentiality and security obligations.
- Authorities: the Financial Intelligence Authority, the Bank of Uganda, the Personal Data Protection Office, the Uganda Revenue Authority, the Uganda Police Force, courts and other public bodies, when the law requires or permits it.
- Professional advisers: auditors, lawyers and insurers, under duties of confidentiality.
- A successor business: if EriPay is reorganised, merged or sold, data may pass to the new owner, who must keep protecting it under this policy.
5. International transfers
EriPay is a global service, so some of our partners and servers are located outside Uganda. We transfer personal data abroad only where the receiving country or organisation provides a level of protection at least equivalent to Ugandan law, or where the transfer is otherwise permitted by the Data Protection and Privacy Act, 2019 (for example, with your consent or where it is necessary to complete a transaction you asked for). We use contractual safeguards with our providers to protect transferred data.
6. How long we keep your data
- Identity, transaction and account records: for as long as your account is open and then for the period required by anti-money laundering law, which is at least ten years after the end of the business relationship or the date of the transaction.
- Support communications: up to three years after the issue is closed, unless they form part of a transaction record.
- Marketing preferences: until you withdraw consent or close your account.
- Device and security logs: generally up to two years, unless needed to investigate fraud or a security incident.
When the retention period ends, we securely delete or anonymise the data.
7. How we protect your data
We use technical and organisational measures that match the sensitivity of financial data, including encryption in transit (HTTPS/TLS), hashed passwords and PINs, two-factor authentication, role-based staff access, activity logging, ledger audits and regular reviews of our systems and suppliers. No system is completely secure, so please protect your password, Wallet PIN and one-time codes. EriPay staff will never ask you for your password, PIN or one-time codes.
If a personal data breach occurs that puts your rights at risk, we will notify the Personal Data Protection Office as the law requires and tell affected users without undue delay, with advice on how to protect themselves.
8. Your rights
Under the Data Protection and Privacy Act, 2019 you have the right to:
- Be informed about how your data is used (this policy).
- Access the personal data we hold about you and receive a copy.
- Correct data that is inaccurate, out of date or incomplete.
- Request deletion of data we no longer have a lawful reason to keep. Records we must keep under anti-money laundering law cannot be deleted before the retention period ends.
- Object to processing that causes you unwarranted damage or distress, and stop direct marketing at any time.
- Ask for human review of decisions made solely by automated means.
- Withdraw consent where we rely on consent, without affecting processing that took place before.
To use any of these rights, email info@eripays.com from the address registered on your account. We may ask you to confirm your identity first. We respond within the time limits set by law and normally within 30 days. If you are not satisfied with our response, you may complain to the Personal Data Protection Office of Uganda.
9. Marketing
We send promotional messages only where you have agreed to receive them. Every marketing email includes an unsubscribe link, and you can change your preferences in your account settings. Service messages such as receipts, security alerts and legal notices are not marketing, and you will keep receiving them while your account is open.
10. Children
The Services are for people aged 18 and over. We do not knowingly open accounts for, or collect data from, children. If you believe a child has given us personal data, please contact us and we will delete it, subject to our legal obligations.
11. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. If we make a significant change, we will tell you by email or in-app notification before it takes effect.
12. Contact us
For questions about this policy or your personal data, write to info@eripays.com or to EriPay, Onapa Rd, Barogole - weigweng, City West Division, Lira, Uganda.