Privacy Policy

This Privacy Policy explains how Epay Financial Services S.C. collects, uses, stores, shares and protects your personal data when you use our services. Please read it carefully together with our Terms of Service.

Epay Financial Services S.C. ("Epay", "we", "us" or "our") is a share company incorporated under the laws of Ethiopia, licensed by the National Bank of Ethiopia (NBE) as a payment gateway and point-of-sale (POS) operator under licence no. NPS-PSO/019/2025, with its registered office at Bole Sub-city, Woreda 03, House No. 1034/607, Addis Ababa, Ethiopia. Epay is the data controller for the personal data described in this Policy.

This Policy applies to everyone who interacts with Epay, including:

• customers and wallet holders who register for and use our payment services;
• merchants, agents and business partners, and their representatives;
• people who pay or receive money through Epay without holding an account;
• visitors to our website, mobile applications, USSD channels, APIs and social media pages.

It covers all our channels, including our website, mobile app, USSD, APIs, SMS and email notifications, call centre and agent outlets.

By registering for or using our services, you acknowledge that you have read this Policy. Where the law requires your consent for a specific use of your data, we will ask for it separately, and you may withdraw it at any time.

Terms in this Policy carry the meaning given in the Personal Data Protection Proclamation No. 1321/2024 (the "Proclamation") unless stated otherwise.

We collect only the personal data that is relevant and necessary for the purposes in Section 5. Depending on how you use our Services, this may include:

We do not knowingly collect more sensitive personal data than the law or our regulatory duties require. Where we process biometric or other sensitive data, we apply the additional safeguards the Proclamation requires.

We collect personal data in three ways:

• Directly from you — when you register, complete KYC, make or receive a payment, contact customer support, take part in a promotion or fill in a form.
• Automatically — when you use our app, website, USSD or APIs, through logs, cookies and similar technologies (see Section 7).
• From third parties — including banks and other financial institutions, mobile network operators, the National ID Program (Fayda) and other identity verification services, credit reference bureaus, merchants and agents you transact with, fraud-prevention partners and public sources such as sanctions lists.

If you give us personal data about another person, such as a beneficiary or authorised signatory, you confirm that you are entitled to share it and that they are aware of this Policy.

We process personal data only for specified, lawful purposes and on a legal basis recognised by the Proclamation.

We will not use your personal data for a purpose that is incompatible with the one for which it was collected without informing you and, where required, obtaining your consent.

We do not sell your personal data. We share it only where necessary for the purposes in Section 5, and only with:

• Transaction counterparties — the person, merchant or institution you pay or receive money from, limited to what is needed to complete the transaction (for example, your name and reference).
• Banks, switches and payment partners — including EthSwitch, partner banks, card schemes and mobile network operators that help us process and settle payments.
• Service providers acting as our processors — such as cloud hosting, identity verification, SMS and email delivery, customer support and IT security providers, bound by written contracts requiring confidentiality and security.
• Agents — our authorised agents, to the extent needed to serve you at an agent outlet.
• Regulators and law enforcement — the National Bank of Ethiopia, the Financial Intelligence Service, courts, tax authorities and other bodies where the law requires or permits disclosure.
• Professional advisers — auditors, lawyers and insurers, under duties of confidentiality.
• Successors — a buyer or successor in a merger, acquisition or restructuring, who must continue to protect your data under this Policy.
• Others with your consent — any other party you ask or authorise us to share with.

We require all recipients to protect your personal data to a standard at least equivalent to ours and to use it only for the purpose for which it was shared.

Our website and apps use cookies, SDKs and similar technologies. A cookie is a small data file placed on your device that lets us recognise it on later visits.

You can manage or delete cookies through your browser or device settings. Blocking strictly necessary cookies may stop parts of our Services from working.

We protect personal data with technical and organisational measures appropriate to the risk, in line with the Proclamation and NBE requirements on information security and risk management. These include:

• encryption of data in transit and at rest, and tokenisation of card data;
• firewalls, intrusion detection and continuous security monitoring;
• role-based access, granted only to staff and processors who need it for their duties, with multi-factor authentication;
• confidentiality obligations for all employees, agents and processors;
• regular security testing, audits and staff training;
• business continuity and disaster recovery arrangements.

You also play a part. Keep your PIN, password and one-time codes secret, and never share them with anyone. Epay staff will never ask for them. Tell us immediately at privacy@epayethiopia.et or on 608 if you suspect unauthorised access to your account.

If a personal data breach occurs that is likely to put your rights at risk, we will notify the Authority and, where required, you, within the time limits set by law, and take steps to contain it.

We keep personal data only as long as needed for the purposes in Section 5, or longer where the law requires.

While your account is active, we keep the data needed to run it. After you close your account, we keep KYC and transaction records for at least 10 years, or any longer period required by NBE directives, anti-money laundering laws, tax laws or ongoing legal proceedings.

When the retention period ends, we securely delete or anonymise your personal data. Anonymised data that can no longer identify you may be kept for statistics and research.

We store and process personal data in Ethiopia, in line with the data sovereignty requirements of the Proclamation and NBE directives.

We transfer personal data outside Ethiopia only where the law allows — for example, where the receiving country ensures an adequate level of protection, where the Authority has authorised the transfer, where it is needed to complete an international transaction you request, or where you have given explicit consent after being told of the risks. In each case we put appropriate contractual and technical safeguards in place.

Under the Proclamation, you have the right to:

• Be informed about how your personal data is processed, as set out in this Policy.
• Access the personal data we hold about you and receive a copy.
• Correct personal data that is inaccurate, incomplete or out of date.
• Erase your personal data in certain circumstances, subject to our legal retention duties.
• Restrict our processing in certain circumstances.
• Object to processing based on our legitimate interests, and to direct marketing at any time.
• Receive your personal data in a structured, commonly used format (data portability), or have it sent to another provider where technically feasible.
• Withdraw consent at any time, without affecting processing already carried out.
• Not be subject to decisions based solely on automated processing that significantly affect you, except where the law permits.

To exercise any right, contact us using the details in Section 13. We may need to verify your identity first. We will respond within the period required by law, and free of charge unless a request is manifestly unfounded or excessive.

If you are not satisfied with our response, you may lodge a complaint with the Ethiopian Communications Authority. Complaints about payment services may also be raised with the National Bank of Ethiopia.

Minors

Our Services are intended for persons aged 18 and over. We do not knowingly collect personal data from minors without the consent of a parent or legal guardian as required by the Proclamation. If you believe we hold a minor's data improperly, contact us and we will delete it.

Third-party links

Our Services may link to websites or apps run by others, such as merchants. Their privacy practices are their own responsibility, and we encourage you to read their policies.

Marketing

We send promotional messages only where you have agreed. You can opt out at any time through the app settings, by following the unsubscribe instructions in a message, or by contacting us. You will still receive essential service messages such as transaction alerts.

Changes to this Policy

We may update this Policy to reflect changes in our Services or the law. We will post the updated version with a new "Last updated" date and, for material changes, notify you by SMS, email or in-app message before they take effect.

Governing law

This Policy is governed by the laws of the Federal Democratic Republic of Ethiopia, including the Personal Data Protection Proclamation No. 1321/2024 and applicable National Bank of Ethiopia directives.

Contact us

For questions, requests or complaints about this Policy or your personal data, contact our Data Protection Officer: