Legal

This privacy policy (this "Privacy Policy") explains how personal information is collected, used, stored, and disclosed by Grey. This Privacy Policy applies to our website and all related sites, applications, services and tools regardless of how you access or use them. If anything here applies to only one of our Services or to customers in a particular country, we'll explicitly point this out to you. This Privacy Policy is part of our Terms of Use. By accessing or using our Services, website, software, services, applications, products and content offered via Grey (collectively, the “Services”), you agree to this Privacy Policy and our Terms of Use.

This Privacy Policy applies to your use of (regardless of means of access) our Services. You may access or use our Services through a desktop, laptop, mobile phone, tablet, or other consumer electronic device (each, a "Device").

This Privacy Policy does not apply to services that are not owned or controlled by Grey, including third-party websites and the services of other Grey merchants. These other sites may place their own cookies, plug-ins or other files on your computer, collect data or solicit personal information from you. Grey does not control these third-party websites and we are not responsible for their privacy statements. Please consult such third parties' privacy statements.

WHO WE ARE

“Grey” refers to the group of companies operating under the Grey brand. The Grey group consists of the following entities, each of which may process your Personal Information depending on the product, service, or region through which you interact with us:

• Grey Inc., registered in Delaware, USA — the main data controller for the Grey group. Grey Inc. is responsible for how your Personal Information is used across our brands and platforms as described in this Privacy Policy, and is your first point of contact for privacy questions and requests, regardless of which Grey entity you primarily interact with;
• Grey Finance Ltd, registered in the United Kingdom;
• Greytech Services Limited, registered in Nigeria ;
• Grey Finance Inc., registered in Canada.

Where more than one Grey entity is involved in processing your Personal Information for a particular product or service, those entities act as joint controllers, and Grey Inc. remains available at all times to address your questions or help you exercise your rights under applicable data protection law, regardless of which entity is a joint controller for a specific processing activity.

INFORMATION WE COLLECT

Information You Provide Us: To gain full access to our website and services, you must register for a Grey account. When you register for an account, we collect Personal Information which you voluntarily provide to us. Personal Information refers to information relating to an identified person or information that can be used to identify you, (e.g. name, email, address, bank details, telephone number). It may also include anonymous information that may be linked to you specifically, (e.g. IP address).

The Personal Information we have about you is directly made available to us when you:

• Sign up for a Grey Account;
• Use any of our services;
• Contact us or our customer support team;
• Fill our online forms;

In certain cases, including when you engage in high-value or high-volume transactions, or when we are required to comply with applicable anti-money laundering (AML) regulations, we may request additional information. This may include:

• Copies of bank account statements.
• Other documents required for identity verification or compliance purposes.

We also gather your personal data using cookies, pixel tags, and other advanced tracking technologies to enhance your experience, tailor content, and optimize our services during your interactions with our platform. These tools allow us to understand your preferences, monitor usage patterns, detect and prevent fraudulent activities and strengthen security, ensuring a safer and more personalized user experience.

Personal Information We May Collect About You: We may collect, use, process, store, or transfer personal information such as:

• Traceable Information: These are information that can be linked directly or indirectly to you when ever you use or interact with our services. This includes details about your device (e.g., type, OS, unique identifiers), interactions with our services (e.g., features accessed, actions performed, usage duration), financial transactions (e.g., history, payment details, timestamps), and additional data such as location, usage patterns, and session information.
• Identity Data & Identification Documents: Information such as, your full name(s), your government-issued identity number, bank verification number (BVN) or NIN and your date of birth. Identification documents may include passport or any Government-issued identity card, a photograph (if applicable) and any other registration information you may provide to prove you are eligible to use our services. This data is to enable us to verify your identity in order to offer our services to you;
• Contact Data: This is data that is needed to reach out to you, such as your contact address, email address, telephone number, details of the device you use and billing details;
• Log/Technical information: When you access Grey's services, our servers automatically record information that your browser sends whenever you visit a website, links you have clicked on, length of visit on certain pages, unique device identifier, log-in information, location and other device details.
• Financial Data: Information, such as personal account number, the merchant's name and location, the date and the total amount of transaction, and other information provided by financial institutions or merchants when we act on their behalf;
• Transactional Data: These are information relating to payments when you as a merchant (using one or more of our payment processing services) or as a customer, are using our products or services;
• Marketing and Communications Data: This includes both a record of your decision to subscribe or to withdraw from receiving marketing materials from us or from our third parties.
• Records of your discussions with us, if we contact you and if you contact us.

HOW WE MAY USE YOUR PERSONAL INFORMATION

We may use the Personal Information we collect to:

• Create and manage any accounts you may have with us, verify your identity, provide our services, and respond to your inquiries;
• To administer Grey (i.e. to provide our Services to you) and support internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes. This helps ensure Grey's stability and security, improve our Services, website, and user experience, create new products, and solicit your feedback.
• Process your payment transactions (including authorization, clearing, chargebacks and other related dispute resolution activities);
• Protect against and prevent fraud, unauthorized transactions, claims and other liabilities;
• Provide, administer and communicate with you about products, services, offers, programs and promotions of Grey, financial institutions, merchants and partners;
• Evaluate and improve our business, including developing new products and services;
• As necessary to establish, exercise and defend legal rights; As may be required by applicable laws and regulations, including for compliance with Know Your Customers and risk assessment, Anti-Money Laundering, anti-corruption and sanctions screening requirements, or as requested by any judicial process, law enforcement or governmental agency having or claiming jurisdiction over Grey Inc. or it's affiliates/subsidiaries;
• To comply with our legal and regulatory obligations.
• We also facilitate seamless communication between Users and send both marketing and non-marketing communications. This helps us better understand your preferences, enhance the effectiveness of our marketing efforts, and refine our campaigns and communication channels to serve you more effectively.
• For other purposes for which we provide specific notice at the time of collection.

LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA

We will only use your Personal Information where the law allows us to. Depending on the purpose, our legal basis will generally be one of the following:

• Contract: where processing is necessary to provide the Services you have asked for, such as opening and running your Grey account or processing a payment;
• Legal obligation: where we must process your Personal Information to comply with a legal or regulatory requirement, such as identity verification, Know-Your-Customer (KYC), Anti-Money Laundering (AML), sanctions screening, and tax reporting obligations;
• Legitimate interests: where we have a genuine business reason to use your Personal Information that is reasonable and does not unfairly impact your rights, such as improving our Services, preventing fraud, or communicating with you about your account;
• Consent: where you have given us your permission to use your Personal Information in a specific way, such as for certain marketing communications, and which you may withdraw at any time; and
• Vital interests: in rare cases, where necessary to protect your life or the life of another person.

The table below sets out the main purposes for which we use your Personal Information and the legal basis (or bases) we rely on for each:

• Verifying your identity and carrying out KYC/AML checks (including when you open an account, update your details, or request account closure): Legal obligation; Legitimate interests (to prevent fraud and protect our platform).
• Providing the Services, including processing payments and managing your account: Contract; Legal obligation.
• Detecting and preventing fraud, unauthorised transactions and financial crime: Legal obligation; Legitimate interests.
• Responding to customer support enquiries and privacy requests, and keeping records of those communications: Contract; Legal obligation; Legitimate interests.
• Retaining KYC, transaction and financial crime records after your account is closed: Legal obligation.
• Sending you marketing communications and personalising offers: Consent, where required by applicable law; otherwise Legitimate interests.
• Improving our Services, including troubleshooting, research and analytics: Legitimate interests.

Where a purpose relies on more than one legal basis, we have identified the primary basis first. If you have questions about the legal basis for a specific use of your Personal Information, contact us using the details in the Contact Us section below.

If you withdraw consent to a specific use of your Personal Information, you will not be able to use any Service or feature of Grey that requires the collection or use of that Personal Information. Withdrawing consent does not affect the lawfulness of any processing we carried out before you withdrew it.

HOW WE SHARE YOUR PERSONAL DATA

We may disclose or share your Personal Information with third parties which include our affiliates, employees, officers, service providers, agents, suppliers, subcontractors as may be reasonably necessary for the purposes set out in this policy. Grey only shares personal information with External Third parties in the following limited circumstances:

• We have your consent. We require opt-in consent for the sharing of any personal information; We share Personal Information with third parties directly authorized by you to receive Personal Information, such as when you authorize a third party application provider to access your account. The use of your Personal Information by an authorized third party is subject to the third party's privacy policy and Grey shall bear no liability for any breach which may arise from such authorization by you.
• We provide such information to our subsidiaries, affiliated companies or other trusted businesses or persons for the purpose of processing personal information on our behalf. We require that these parties agree to process such information based on our instructions and in compliance with this Privacy Policy and any other appropriate confidentiality and security measures
• We have a good faith belief that access, use, preservation or disclosure of such information is reasonably necessary to satisfy any applicable law, regulation, legal process or enforceable governmental request, enforce applicable Terms of Service, including investigation of potential violations thereof, detect, prevent, or otherwise address fraud, security or technical issues, or protect against imminent harm to the rights, property or safety of Grey, its users or the public as required or permitted by law

If Grey becomes involved in a merger, acquisition, or any form of sale of some or all of its assets, we will provide notice before personal information is transferred and become subject to a different privacy policy.

Your data may be processed by our employees outside your residence country, who may be involved in tasks such as fulfilling payment orders, processing payment details, or providing support services. We will ensure that your data is handled securely and in compliance with applicable laws and this Policy.

OTHER RIGHTS TO YOUR PERSONAL INFORMATION WITH US

Below are the rights you have as a user in relation to your Personal Information;

• Right to request access or copies to your Personal Information by contacting us
• Right to information on their personal information collected and stored;
• Right to objection or request for restriction; this means refrain us from doing certain things with your data or restrict the extent of our collection or processing of your data.
• Right to correct or rectify any Personal Information that you provide which may be incorrect, out of date or inaccurate.
• Right to object to the processing of your Personal Information for marketing purposes. You have a right to ask us not to contact you for marketing purposes by adjusting your notification preference on the settings page or by opting out via the unsubscribe link in marketing emails we send you.
• Right to request that Grey erase your Personal Information. You have the right to ask us to erase your Personal Information. Please note that this is a limited right which applies where the data is no longer required, or the processing has no legal justification. The exceptions to this right is where the applicable law requires us to retain a historical archive or where we retain a core set of your personal data to ensure we do not inadvertently contact you in future where you object to your data being used for marketing purposes.
• Right to object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you.
• Right to request the movement of data from Grey to a third party; this is the right to the portability of data.

The legal basis on which we process your Personal Information depends on the specific purpose for which it is used — see the “Legal Basis for Processing Your Personal Data” section below for a full breakdown. You also have the choice at any time to withdraw consent, where our processing is based on consent. You may decline to provide your personal Information when it is requested by Grey, however, certain services or all the services may be unavailable to you, or your account may be closed as a result. You may review your account settings and update your Personal Information directly or by contacting us. If you wish to exercise any of the rights set above, please contact us using the contact information provided in the Contact Us segment below.

HOW WE VERIFY YOUR IDENTITY FOR PRIVACY REQUESTS

Before we act on a request to access, correct, restrict, delete your Personal Information, or withdraw your consent, we need to verify that the request is genuinely coming from you. This protects your account and your data from being accessed or deleted by someone impersonating you.

We will ask you to verify your identity through secure, authenticated channels, which may include our dedicated Grey email addresses (support@grey.co, hello@grey.co, or dpo@grey.co), the Grey app, or a secure verification portal. We will never ask you to send identification documents, selfies, or other sensitive verification information as an attachment to an ordinary email; where verification is handled by email, we will direct you to a secure upload method for any such documents rather than asking you to attach them directly.

We aim to acknowledge privacy requests promptly and to respond, or explain any delay, within the timeframe required by applicable law in your jurisdiction (generally within 30 days of verifying your identity). If we are unable to fulfil part of your request — for example, because we are required to retain certain data — we will explain why.

SECURITY AND STORAGE OF YOUR PERSONAL INFORMATION

We have suitable security measures in place to prevent your Personal Information from being accidentally lost or used or accessed in an unauthorised way by a third party.

When your bank account information is transmitted via our Services, it will be protected by encryption technology. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Information on our instructions.

All our employees who have access to your personal data are required to adhere to this Policy and all third-party service providers are requested by Grey to ensure appropriate safeguards are in place. In addition, contracts are in place with third-party service providers that have access to your personal data, to ensure that the level of security and protective measures required is in place, and that your personal data is processed only as instructed by Grey.

We continuously educate and train our employees about the importance of confidentiality and privacy of customer personal information. We maintain physical, technical and organizational safeguards that comply with applicable laws and regulations to protect your personal information from unauthorised access.

We have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. Unfortunately, no method of electronic transmission or storage via the Internet is 100% secure. Therefore, we cannot guarantee absolute security of your Personal Information. You also play a role in protecting your Personal Information. Please safeguard your password for your Grey account and do not share them with others.

If we receive instructions using your Grey account login information, we will consider that you have authorized the instructions. You agree to notify us immediately of any unauthorized use of your Grey account or any other breach of security.

We reserve the right, in our sole discretion, to refuse to provide our Services, terminate Grey accounts, and to remove or edit content. Subject to applicable law, which might, from time to time, oblige us to store your Personal Information for a certain period of time, we will retain your Personal Information for as long as necessary to fulfil the purposes we collected it for, including the purposes of satisfying any legal, accounting, or reporting requirements.

DATA BREACH NOTIFICATION

If a data breach involving your Personal Information is likely to result in a risk to your rights and freedoms, we will notify you and the relevant regulator without undue delay, and in line with the specific timeframe and process that applies in your jurisdiction, including the following:

• Nigeria: we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of a breach that is likely to result in a risk to your rights, in accordance with the Nigeria Data Protection Act 2023, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms;
• United Kingdom: we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of a breach that is likely to result in a risk to your rights, in accordance with the UK GDPR, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms;
• European Union: we will notify the competent lead supervisory authority (or the relevant national data protection authority) within 72 hours of becoming aware of a breach that is likely to result in a risk to your rights, in accordance with the EU GDPR, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms;
• Canada: we will report a breach of security safeguards involving Personal Information to the Office of the Privacy Commissioner of Canada (OPC), and notify affected individuals, as soon as feasible where the breach creates a real risk of significant harm, in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA);
• United States: we will notify affected individuals and the relevant state regulator(s) in accordance with applicable state data breach notification laws, and will meet our safeguarding and notification obligations under the Gramm-Leach-Bliley Act (GLBA) where applicable.

Where a breach affects individuals in more than one of these jurisdictions, we will follow the notification requirements applicable to each affected individual's jurisdiction.

DATA RETENTION

We will retain your personal data only for as long as is necessary to fulfil the purposes for which we collected it. As a regulated financial institution, Grey is required by law to store some of your personal and transactional data beyond the closure of your account with us. We only access your data internally on a need-to-know basis, and we'll only access or process it if absolutely necessary.

We will always delete data that is no longer required by a relevant law or jurisdiction in which we operate. We do this automatically, so you don't need to contact us to ask us to delete your data. Deletion methods include shredding, destruction and secure disposal of hardware and hard-copy records, and deletion or over-writing of digital data.

As a general guide, and save where a longer period is required by applicable law in your jurisdiction, we retain the following categories of Personal Information for the following periods, measured from the date your account is closed (unless stated otherwise):

• Identity Data & Identification Documents, including KYC/AML verification records: 7 years, in line with anti-money laundering and counter-terrorism financing recordkeeping obligations;
• Financial Data and Transactional Data: 7 years from the date of the relevant transaction or account closure, whichever is later, to meet financial recordkeeping and audit obligations;
• Fraud and financial crime records: up to 7 years from the date of the relevant event, or longer where necessary to defend a legal claim or complete an ongoing investigation;
• Support and complaint correspondence: 7 years from the date the matter is resolved, to meet regulatory complaint-handling and evidentiary requirements;
• Marketing and Communications Data, including your consent and opt-out status: for as long as necessary to give effect to your preferences, and in any event no more than 3 years from your last interaction with us, unless you ask us to delete it sooner;
• Technical, log and device data: up to 12 months, save where a longer period is necessary for a fraud or security investigation.

These periods reflect Grey’s internal records retention policy and the regulatory requirements that apply in the jurisdictions in which we operate (including Nigeria, the United Kingdom, and the United States), and may vary depending on your country of residence or the Grey entity providing your Services. Where we cannot state a precise period for a specific category, we will explain the criteria we use to determine that period if you ask us.

As a general minimum, and consistent with common practice among regulated payment and remittance providers, Grey retains identity verification, transaction, device, and usage data for a minimum of 7 years following the end of your relationship with us, to meet our anti-money laundering, counter-terrorism financing, and other financial recordkeeping obligations. This period may be longer where a specific law in your jurisdiction requires it, where data is needed to resolve an outstanding claim, dispute, or unresolved balance on your account, or where we are required to retain data for an ongoing legal or regulatory process.

We may retain certain information when necessary to ensure safety, security, and prevent fraudulent activities. For instance, if your account is deactivated due to unsafe behavior or security violations, we may retain specific details about your account to safeguard our platform and prevent unauthorized re-registration or misuse

Under some circumstances, we may anonymize personal information so that it can no longer be associated with a particular individual. We reserve the right to use such anonymous and de-identified data for any legitimate business purpose without further notice to the relevant individual or its consent.

COOKIES

Like many other websites, we use cookies to distinguish you from other users and to customize and improve our services. Cookies allow our servers to remember IP addresses, date and time of visits, monitor web traffic and prevent fraudulent activities.

Our cookies never store personal or sensitive information; they simply hold a unique random reference to you so that once you visit the site we can recognize who you are and provide certain content to you. If your browser or browser add-on permits, you have the choice to disable cookies on our website, however, this may impact your experience using our website. Unless you opt out of Cookies, we will assume you consent to the use of Cookies.

THIRD-PARTY LINKS

Our Services may, from time to time, contain links to the websites or online platforms of our partner networks, advertisers and affiliates. Please note that these websites have their own privacy policies and that we do not accept any responsibility for them, so if you follow a link, check these policies before you submit any personal data to these websites or platforms.

AGE RESTRICTION

Our Services are not directed, or intended to be attractive, to children under the age of 18.

We do not knowingly collect Personal Information from children under the age of 18. If you are under the Age Limit, please do not use the Services, and do not provide any personal data to us. If as a parent or guardian, you become aware that your child or ward child has provided us with any information without your consent, please contact us through the details provided in this Privacy Policy.

OPT-OUT RIGHTS

If you do not wish to receive offers or other notices from us in the future, you can "opt out" by contacting us as indicated at the end of this Privacy Policy or by following the "unsubscribe" instructions in any communication you receive from us. Please be aware that if you are a User, you are not able to opt out of receiving communications about your Grey account or related transactions with us.

CHANGE TO OUR PRIVACY POLICY

Subject to applicable law, we may change, amend or review this Privacy Policy at any time to reflect new services or changes in our Policy. All changes made will be posted on this page and where changes will materially affect you, we will notify you of this change by placing a notice online or via mail. If you keep using our Services, you consent to all amendments of this Privacy Policy.

To stay up to date on any changes, check back periodically.

ADDITIONAL INFORMATION FOR NIGERIA RESIDENTS

If you are resident in Nigeria, this section supplements the rest of this Privacy Policy. In the event of any conflict between this section and the rest of the Policy, this section prevails to the extent of the inconsistency for Nigerian residents.

• Who we are and applicable law: for Nigerian users, our local operating entity is Greytech Services Limited, the holder of our CBN International Money Transfer Operator (IMTO) licence. Your Personal Information may also be processed by other Grey group entities as described in the “Who We Are” section above. We handle your Personal Information in accordance with the Nigeria Data Protection Act 2023 (NDPA) and applicable regulations issued by the Nigeria Data Protection Commission (NDPC).
• Retention and AML/CFT obligations: as a licensed financial services provider, Grey is required under the NDPA, the Money Laundering (Prevention and Prohibition) Act, and applicable Central Bank of Nigeria (CBN) regulations to retain your identity verification, transaction, and related records for a minimum of 7 years after the end of our relationship with you. As a result, the “Right to Erasure” described elsewhere in this Policy may not apply to data we are required to retain under these obligations.
• Your rights under the NDPA: you have the rights described in the “Other Rights to Your Personal Information With Us” section above. To the extent Nigerian law provides additional or different rights, we will honour those rights as required by the NDPA.
• Data breach notification: as described in the Data Breach Notification section above, we will notify the NDPC and affected individuals in accordance with the NDPA where a breach is likely to result in a risk to your rights and freedoms.
• Making a complaint: if you are unhappy with how we have handled your Personal Information, you can contact us using the details in the Contact Us section below. If you remain unsatisfied, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

CONTACT US

If you have any questions, comments or concerns about this Privacy Policy, the personal information we hold on you, or you would like to exercise one of your data protection rights provided for under applicable privacy laws, you may contact us by:

• reaching out to the customer service support available on the website.
• sending an email to hello@grey.co

If you feel that we have not addressed your questions or concerns adequately, or you believe that your data protection or privacy rights have been infringed, you can complain to your local Data Protection Authority, including, if applicable: the Nigeria Data Protection Commission (NDPC) for customers in Nigeria, or the Information Commissioner’s Office (ICO) for customers in the United Kingdom.

If you are in the EU, you may also contact our EU Representative:

The DPO Centre

Address: Alexandra House, 3 Ballsbridge Park, Dublin, D04 C7H2, Ireland

Email: dpo@grey.co