Privacy Policy

This Privacy Policy explains how Nufaa Ltd ("Nufaa," "we," "us") collects, uses, stores, and protects your personal information when you use our platform — including the Nufaa mobile app, website, and local agent services.

We are committed to handling your data responsibly and in accordance with applicable Gambian data protection laws and international best practices. As a Sharia-compliant platform, we view the ethical treatment of your personal data as an extension of our commitment to transparency and fairness.

Information you provide

• Identity data — Full name, date of birth, and government-issued ID (when required for KYC verification).
• Contact data — Gambian phone number, email address, and physical address.
• Account data — Utility account numbers (e.g., Nawec meter number), Africell phone number for airtime top-ups.
• Financial data — Deposit amounts, transaction history, and wallet balances on the Nufaa platform.

Information collected automatically

• Device data — Device type, operating system, browser type, and unique device identifiers.
• Usage data — Pages visited, features used, timestamps, and interaction patterns within the Nufaa platform.
• Location data — Approximate location based on IP address (we do not use GPS tracking).

Information from third parties

• Identity verification results from KYC providers.
• Transaction confirmations from utility providers (Nawec, Africell).
• Blockchain network data related to staking operations (this data does not contain personal information).

We use your personal data exclusively for the following purposes:

• Service delivery — Processing transactions, executing Wakala agreements, managing your wallet, and distributing staking rewards.
• Identity verification — Complying with Gambian KYC/AML regulations and preventing fraud.
• Customer support — Responding to inquiries via WhatsApp, email, or through local agents.
• Platform improvement — Analyzing aggregate, anonymized usage patterns to improve features and user experience.
• Legal compliance — Meeting our obligations under Gambian financial regulations and tax law.
• Security — Detecting, preventing, and investigating fraud, unauthorized access, and platform abuse.

We never use your data for targeted advertising, and we never sell your personal information to third parties for any purpose.

Nufaa uses blockchain technology to generate staking yields. Here is how we protect your privacy in this context:

• Your personal identity is never directly linked to on-chain transactions visible to the public. Blockchain addresses used by Nufaa are pooled and cannot be traced to individual users.
• We maintain a secure off-chain ledger for individual account balances and transaction records. This data is encrypted and stored on private servers — not on any public blockchain.
• Staking operations are conducted through Nufaa-managed wallets. You do not interact directly with blockchain networks, and no personal data is written to any blockchain.

This architecture ensures that the transparency benefits of blockchain (for yield generation) are separated from the privacy requirements of your personal financial data.

We share your personal data only in the following limited circumstances:

• Utility providers — We share the minimum information required to process transactions (e.g., meter numbers with Nawec, phone numbers with Africell).
• KYC/AML partners — Identity verification data is shared with licensed compliance partners who are contractually bound to protect your information.
• Law enforcement — Only when required by valid Gambian court orders or legal processes.
• Service infrastructure — Encrypted data may be processed by cloud infrastructure providers who meet our security standards and are bound by data processing agreements.

We never share your data with advertisers, data brokers, or any third party for marketing purposes.

We implement comprehensive security measures to protect your data:

• Encryption in transit — All data transmitted between your device and Nufaa servers is encrypted using TLS 1.3.
• Encryption at rest — All stored personal data and financial records are encrypted using AES-256.
• Access controls — Internal access to user data is restricted to authorized personnel on a need-to-know basis, with multi-factor authentication and audit logging.
• Regular audits — We conduct periodic security assessments and penetration testing to identify and address vulnerabilities.

While we take every reasonable precaution, no system is perfectly secure. If we discover a data breach that affects your personal information, we will notify you within 72 hours through the app, SMS, or email.

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:

• Active accounts — Data is retained for the duration of your account's active status.
• Closed accounts — Transaction records and identity data are retained for 7 years after account closure, as required by Gambian financial regulations.
• Usage analytics — Anonymized, aggregated usage data may be retained indefinitely for product improvement.

When retention periods expire, your data is securely deleted or anonymized so that it can no longer be associated with you.

You have the following rights regarding your personal data:

• Access — You can request a copy of all personal data we hold about you.
• Correction — You can request correction of inaccurate or incomplete data.
• Deletion — You can request deletion of your data, subject to our legal retention obligations. We will process deletion requests within 30 days.
• Portability — You can request your data in a structured, machine-readable format.
• Objection — You can object to specific uses of your data where processing is based on legitimate interest.
• Withdrawal of consent — Where processing is based on your consent, you can withdraw that consent at any time.

To exercise any of these rights, contact us via WhatsApp at +44 7982 144203 or email nufaa.now@hotmail.com. We will respond to all requests within 30 days.

Our website uses minimal, essential cookies only:

• Session cookies — Required for the platform to function (e.g., maintaining your login session). These expire when you close your browser.
• Preference cookies — To remember your language and display preferences. These expire after 12 months.

We do not use advertising cookies, tracking pixels, or any third-party analytics that track your browsing behavior across other websites. We do not use Google Analytics or similar surveillance-based analytics platforms.

Nufaa is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we discover that we have inadvertently collected data from a minor, we will delete it immediately and suspend the associated account.

If you believe a minor has created a Nufaa account, please contact us immediately so we can take appropriate action.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes:

• We will notify you via the app, SMS, or email at least 14 days before the changes take effect.
• The "Last Updated" date at the top of this page will be revised.
• Continued use of the platform after the effective date constitutes acceptance of the updated policy.

We encourage you to review this page periodically for the latest information on our privacy practices.

If you have questions about this Privacy Policy, want to exercise your data rights, or have concerns about how your data is being handled, reach out:

For formal data protection complaints, you may also contact the relevant Gambian data protection authority.