Privacy Policy
This Privacy Policy explains how Excella Digital Limited ("Excella Digital", "we", "us") collects, uses, stores, and protects your personal data when you use the Urgent2k platform. We are committed to compliance with the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act 2023 (NDPA) administered by the Nigeria Data Protection Commission (NDPC).
Effective date: 1 February 2026 | Last updated: 5 February 2026
1. Data Controller
Excella Digital Limited is the data controller for personal data processed through Urgent2k. For questions about data handling, contact our Data Protection Officer at dpo@excelladigital.com.
2. Personal Data We Collect
- Full name
- National Identification Number (NIN)
- Phone number
- Email address
- Date of birth (as returned by NIN verification)
- Bank name and account number or mobile wallet ID
- Transaction records (disbursements, donations)
- Payment reference numbers
- Device type, OS, browser
- Device fingerprint (for fraud prevention)
- IP address and approximate location
- App interaction logs and timestamps
- Your brief description of the urgent need (e.g., "transport fare", "medication")
- Category tag assigned by the system
3. Legal Basis for Processing
You consent to data processing when you create an account and submit a request. You may withdraw consent at any time by deleting your account.
Processing your identity and financial data is necessary to perform the service — verifying eligibility and disbursing funds.
Fraud prevention, platform security, and aggregated analytics serve our legitimate interests and protect all users.
We retain certain records to comply with Nigerian financial regulations, anti-money laundering rules, and NDPC requirements.
4. How We Use Your Data
- Identity verification — confirming you are who you say you are via NIN lookups.
- Eligibility enforcement — checking your 30-day cooldown and preventing duplicates.
- Payout execution — routing ₦2,000 to your verified bank account or wallet.
- Fraud detection — device fingerprinting and behavioural signals to block abuse.
- Customer support — investigating and resolving issues you report.
- Product improvement — aggregated, anonymised analytics on usage patterns (never individual profiling for marketing).
- Legal compliance — responding to lawful requests from regulators or law enforcement.
5. Who We Share Data With
We share account details with our payment processor (Flutterwave) and partner banks to execute transfers. They receive only the minimum data needed.
NIN data is verified through authorised national identity verification APIs. We do not store raw biometric data.
Cloud hosting, database, and CDN providers process data on our behalf under strict data processing agreements.
We may disclose data when compelled by court order, subpoena, or regulatory directive under Nigerian law.
6. Data Retention
- Active accounts — data is retained for as long as your account is active.
- Deleted accounts — personal data is anonymised or deleted within ninety (90) days of account deletion, except where retention is required by law.
- Financial records — transaction records are retained for a minimum of six (6) years to comply with Nigerian financial regulations.
- Fraud flags — device fingerprints and abuse records may be retained indefinitely to protect the platform.
7. Data Security
All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). NIN values are stored using one-way hashing with salts.
Role-based access with multi-factor authentication for all staff. Principle of least privilege enforced.
We conduct periodic security audits and vulnerability assessments. Critical findings are remediated within 72 hours.
In the event of a data breach, we will notify affected users and the NDPC within 72 hours as required by the NDPA.
8. Your Rights Under NDPR/NDPA
As a data subject, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request deletion of your data (subject to legal retention obligations).
- Restriction — request we limit processing in certain circumstances.
- Data portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interest.
- Withdraw consent — at any time, without affecting the lawfulness of prior processing.
To exercise any of these rights, email dpo@excelladigital.com. We will respond within fourteen (14) days.
9. Cookies & Tracking
We use essential cookies for authentication and session management. We do not use advertising or behavioural tracking cookies. Analytics are collected in aggregate without individual tracking identifiers.
10. International Data Transfers
Your data is primarily processed and stored in Nigeria. Where data is transferred to cloud infrastructure outside Nigeria, we ensure adequate safeguards through data processing agreements that meet NDPC requirements for cross-border transfers.
11. Children's Privacy
Urgent2k is not intended for individuals under eighteen (18) years of age. We do not knowingly collect personal data from minors. If we discover that a minor has provided data, we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be communicated via in-app notification or email. The "Last updated" date at the top reflects the most recent revision.
13. Contact
Data Protection Officer
Excella Digital Limited
Email: dpo@excelladigital.com
General support: help@excelladigital.com
If you are unsatisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.