Privacy Policy
1. Who we are
234 Exchange ("we", "us", "our") — a business name registered in Nigeria (Reg. No. 2550123), registered office 234 Muri Okunola Street, Victoria Island, Lagos — is the controller of your personal data for the purposes of the Nigeria Data Protection Act 2023 (NDPA). Where we provide virtual asset services in partnership with Ideospay Solutions Limited (a FINTRAC-registered Money Services Business), certain data may be processed by that partner in connection with those services.
This Policy explains what personal data we collect, how we use it, and your rights. It applies to your use of our website, apps and Services.
2. Information we collect
You provide to us:
- Identity & verification (Cash-out): full name, date of birth, nationality, residential address, government-issued ID, photograph/selfie, and other KYC information and documents.
- Bank details (Cash-out): bank name, account number, account name.
- Contact: email address and any information you send us in support requests.
We collect automatically:
- Device and technical data (IP address, device/browser type), usage data, and cookies (see our Cookie Policy).
Transaction data:
- Wallet addresses, transaction references/hashes, assets, amounts and timestamps.
From third parties:
- Verification results from identity-verification providers, sanctions/PEP and risk-screening results, and blockchain analytics used for compliance.
3. Why we use your data, and our legal basis
| Purpose | Legal basis (NDPA / GDPR where applicable) |
|---|---|
| Providing the Services and processing transactions | Performance of a contract |
| Identity verification, AML/CFT, sanctions screening, fraud prevention, transaction monitoring | Compliance with a legal obligation; legitimate interests |
| Communicating with you and providing support | Contract; legitimate interests |
| Security, maintaining and improving the Services | Legitimate interests |
| Regulatory reporting and responding to lawful requests | Legal obligation |
| Marketing (where applicable) | Consent (which you may withdraw) |
4. Sharing your data
We share personal data only as needed, with:
- Service providers — identity verification, compliance/screening, payment and settlement partners, and infrastructure providers, acting on our instructions.
- Our virtual asset partner — Ideospay Solutions Limited, for compliance and settlement purposes.
- Regulators, law enforcement and authorities — including where required to make reports or respond to lawful requests (for example, to the Nigeria Financial Intelligence Unit, and, via our partner, to FINTRAC).
- Professional advisers, and in connection with a corporate transaction (e.g. merger or acquisition), subject to confidentiality.
We do not sell your personal data.
5. International transfers
Your data may be transferred to and processed in countries other than Nigeria — in particular Canada, in connection with our virtual asset partner. Where we transfer data internationally, we take steps to ensure an adequate level of protection consistent with the NDPA, including appropriate contractual safeguards.
6. Retention
We keep personal data only as long as necessary for the purposes described, and to meet our legal and regulatory record-keeping obligations (including AML record-keeping periods), after which it is deleted or anonymised.
7. Security
We use technical and organisational measures to protect personal data, including encryption of sensitive data at rest, access controls and monitoring. No system is completely secure, and we cannot guarantee absolute security.
8. Your rights
Subject to applicable law, you have the right to: access your data; request correction or erasure; restrict or object to processing; request portability; and withdraw consent where processing is based on consent. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) — and, if you are in the EU/UK, with your local supervisory authority under the GDPR / UK GDPR. To exercise your rights, contact us at support@234exchange.com (attn: Data Protection).
9. Children
The Services are not intended for anyone under 18, and we do not knowingly collect data from children.
10. Changes
We may update this Policy; the "Last updated" date will change. Material changes will be notified where reasonably practicable.
11. Contact
Privacy questions or requests: support@234exchange.com (attn: Data Protection).