Privacy Policy

Last updated: 21 May 2026

This policy explains what personal data DataWave collects, why, how we protect it, and your rights over it. It is written to comply with the Nigeria Data Protection Act 2023 (NDPA). “DataWave”, “we” and “us” refer to Orange Atelier Limited (RC 9394216), which operates the DataWave website and mobile app and is the data controller responsible for your personal data.

1. Data We Collect

• Full name and email address (at registration)
• Nigerian phone number
• Your password and transaction PIN — stored only as one-way cryptographic hashes; we never store or see the plain values
• Transaction history — wallet top-ups, data and airtime purchases, and the phone numbers you buy for
• Virtual account number(s) issued to you for wallet funding
• A push-notification token (mobile app) used to send you order updates

2. Your BVN — Collected, Never Stored

To issue you a dedicated PalmPay account for wallet funding, our licensed payment partner requires your Bank Verification Number (BVN). When you choose to activate that account, your BVN is transmitted once, directly to the payment partner, solely to create the account. DataWave does not store your BVN — it is never written to our database and passes through our system in transit only. Providing it is optional and needed only for the PalmPay funding option.

3. How We Use Your Data & Lawful Basis

• To create, secure and authenticate your account — performance of our contract with you
• To process wallet funding and deliver the data and airtime you buy — performance of our contract
• To send order confirmations, receipts and service notices by email or SMS — performance of our contract
• To detect and prevent fraud and keep the service secure — our legitimate interest and legal obligation
• To provide customer support when you contact us

We do not use your data for advertising or profiling, and we do not sell, rent or trade your personal information to anyone, ever.

4. Who We Share Data With

We share the minimum data necessary with the service providers required to run DataWave:

• Payment partners (Paystack, Payscribe) — to issue dedicated accounts and confirm your wallet funding. Card and bank details are handled entirely by them and never stored on our servers.
• Data & airtime vendors — fulfilment partners for MTN, Airtel, Glo and 9mobile; they receive the phone number you are buying for, to deliver the purchase.
• Communication providers — our email and SMS providers, to send confirmations and account messages.
• Infrastructure providers — our database and hosting providers, which store data securely on our behalf.

Each operates under its own privacy and data-processing terms. We do not otherwise disclose your data, except where required by law or to protect the rights, users or security of the service.

5. Data Storage & International Transfers

Account and transaction data is stored securely with our database provider, encrypted in transit and at rest, with access restricted to authorised systems. Some providers process data on servers outside Nigeria; where that happens we rely on providers that apply recognised data-protection safeguards, consistent with the NDPA's requirements for cross-border transfers.

6. How We Protect Your Data

We apply technical and organisational measures appropriate to the sensitivity of the data, including HTTPS encryption, one-way hashing of passwords and PINs, row-level database access controls, restricted administrative access, rate limiting and security monitoring. No system is perfectly secure, but we work continuously to protect your data.

7. Data Retention

We retain your account data while your account is active. If you delete your account, your personal data is permanently removed within 30 days, except records we are required to retain by law (which may be kept in anonymised form).

8. Your Rights

Under the NDPA you have the right to access, correct or delete your personal data, to object to or restrict certain processing, and to withdraw consent where processing relies on it. You can delete your account and data yourself in the app under Settings, or email us at support@datawave.ng and we will respond within 7 business days. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been breached.

9. Cookies

DataWave uses only the minimal session cookies required to keep you signed in. We do not use tracking, analytics or advertising cookies.

10. Children

DataWave is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a minor has provided us data, contact us and we will remove it.

11. Changes to This Policy

We may update this policy as the service or the law changes. The “Last updated” date above reflects the current version, and we will notify you of material changes.

12. Contact Us

For privacy questions or to exercise your rights, contact our Data Protection Officer at support@datawave.ng.
Orange Atelier Limited (RC 9394216), No. 173, Fadaman Mada, Bauchi, Bauchi State, Nigeria.