swap

Swap

Privacy policy of Swap

Effective Date: 01/01/2025 | Last Updated: 30/07/2026

SWAP LIMITED PRIVACY NOTICE

By creating an account, you acknowledge that SWAP will collect and process your personal data for account registration, identity verification, KYC/AML compliance, sanctions screening, transaction monitoring, fraud prevention, wallet and transaction processing, customer support, regulatory reporting and service delivery.

Your data may be shared with verification providers, banks, payment partners, blockchain analytics providers, regulators, law enforcement agencies and other lawful recipients where necessary.

Please read our full Privacy Policy before continuing.

PRIVACY POLICY

Last updated: July 30, 2026

1. Introduction

1.1. SWAP Limited ("SWAP", "we", "us" or "our") respects your privacy and is committed to protecting your personal data.

1.2. This Privacy Policy explains how we collect, use, store, share and protect your personal data when you access or use our website, mobile application, digital wallet, exchange, P2P, deposit, withdrawal, trading, customer support and other related digital asset services, collectively referred to as the "Platform" or "Services".

1.3. This Policy applies to all users of the Platform, including visitors, registered users, individual customers, corporate customers, authorised representatives, beneficial owners and any person who interacts with us.

1.4. Please read this Policy together with our Terms of Use, Risk Disclosure Statement, Fees Schedule, AML/KYC Policy and any other policy made available on the Platform.

1.5. By creating an account, using the Platform or submitting personal data to us, you confirm that you have read and understood this Privacy Policy.

2. Who We Are

2.1. SWAP Limited is a company incorporated under the laws of the Federal Republic of Nigeria.

2.2. For the purpose of applicable data protection laws, SWAP acts as a data controller in respect of personal data collected for account registration, identity verification, KYC/AML compliance, transaction monitoring, customer support, fraud prevention, service delivery and regulatory compliance.

2.3. Our contact details are:

SWAP Limited

Email: quwamdeen@useswap.co

Customer Support: support@useswap.co

Compliance/AML Reporting: legal@useswap.co

Data Protection Officer: info@vancefordlaw.com

Telephone: +234 901 202 3271.

3. Personal Data We Collect

3.1. We may collect the following categories of personal data:

a. Identity Data: This includes your full name, date of birth, gender, nationality, photograph, signature, government-issued identification details and any other information required to identify you.

b. Contact Data: This includes your email address, phone number, residential address, business address and other contact details.

c. Verification and KYC Data: This includes your BVN, NIN, passport, driver's licence, permanent voter's card, proof of address, biometric information, facial recognition/liveness check, source of funds, source of wealth and other information required for identity verification, KYC, AML/CFT and sanctions screening.

d. Corporate Customer Data: Where you use SWAP on behalf of a company or business, we may collect the company name, registration number, registered address, business address, directors' details, shareholders' details, beneficial ownership information, board resolutions, tax information, corporate documents and information about authorised representatives.

e. Financial and Transaction Data: This includes bank account details, payment information, wallet addresses, transaction references, transaction hashes, deposits, withdrawals, trades, conversions, P2P transactions, account balances, fees, limits, chargebacks, failed transactions and transaction history.

f. Technical and Device Data: This includes IP address, device ID, device type, browser type, operating system, mobile network, location data, login records, cookies, usage logs and other technical information generated when you use the Platform.

g. Communication Data: This includes emails, messages, support tickets, complaints, call records, survey responses, feedback and other communications between you and SWAP.

h. Compliance and Risk Data: This includes sanctions-screening results, politically exposed person checks, adverse media checks, fraud-risk indicators, blockchain analytics, suspicious activity reports, investigation records and information required by law, regulators, law enforcement agencies or competent authorities.

4. How We Collect Personal Data

4.1. We may collect personal data directly from you when you:

a. create or update your account;

b. complete KYC, AML or verification requirements;

c. use our wallet, trading, P2P, deposit or withdrawal services;

d. contact customer support;

e. submit complaints or requests;

f. respond to surveys, promotions or communications;

g. visit our website or use our mobile application; or

h. provide documents or information to us.

4.2. We may also receive personal data from third parties, including identity verification providers, banks, payment processors, blockchain analytics providers, fraud-prevention providers, compliance databases, public registers, regulators, law enforcement agencies, corporate customers, authorised representatives and other lawful sources.

5. Why We Use Your Personal Data

5.1. We may use your personal data for the following purposes:

a. to create, manage, verify and secure your account;

b. to confirm your identity and eligibility to use the Platform;

c. to comply with KYC, AML/CFT, sanctions-screening, fraud-prevention and regulatory obligations;

d. to process deposits, withdrawals, trades, conversions, P2P transactions and wallet instructions;

e. to monitor transactions and detect suspicious, fraudulent, unlawful or high-risk activity;

f. to provide customer support and resolve complaints;

g. to communicate with you about your account, transactions, security alerts, service updates and policy changes;

h. to apply fees, limits, restrictions and risk controls;

i. to prevent unauthorised access, cyber threats, abuse or misuse of the Platform;

j. to improve the Platform, user experience, security and service delivery;

k. to enforce our Terms of Use and protect our legal rights;

l. to comply with court orders, regulatory requests, law enforcement enquiries and legal obligations;

m. to conduct audits, compliance checks, risk reviews and internal investigations; and

n. to send product updates, service information and promotional messages where permitted by law or where you have not opted out.

5.2. We will not use your personal data for a new purpose that is incompatible with the purpose for which it was collected, unless permitted by law or with your consent where required.

6. Legal Basis for Processing

6.1. We process personal data only where we have a lawful basis to do so. Depending on the circumstances, we may rely on one or more of the following legal bases:

a. Consent: where you have given us permission to process your personal data for a specific purpose.

b. Contract: where processing is necessary to provide the Services to you or to take steps at your request before providing the Services.

c. Legal obligation: where processing is required to comply with applicable laws, regulations, court orders, KYC/AML obligations, sanctions obligations, tax obligations or regulatory reporting requirements.

d. Legitimate interest: where processing is necessary for our legitimate business interests, including fraud prevention, platform security, risk management, service improvement, enforcement of our Terms and protection of our legal rights.

e. Public interest or regulatory compliance: where processing is necessary for matters relating to public interest, financial crime prevention, regulatory supervision or cooperation with competent authorities.

f. Vital interest: where processing is necessary to protect the life, safety or vital interests of you or another person.

6.2. Where we rely on consent, you may withdraw your consent at any time. However, withdrawal of consent will not affect processing already carried out before the withdrawal. It may also affect our ability to provide some Services where the data is necessary for verification, security, legal or regulatory purposes.

7. KYC, AML and Compliance Processing

7.1. Because SWAP provides digital asset services, we are required to take steps to prevent fraud, money laundering, terrorist financing, sanctions breaches, market abuse and other unlawful activity.

7.2. We may therefore collect, verify, screen, monitor, retain and report personal data where necessary for:

a. identity verification;

b. KYC and customer due diligence;

c. enhanced due diligence;

d. source-of-funds and source-of-wealth checks;

e. sanctions and watchlist screening;

f. politically exposed person checks;

g. fraud prevention and transaction monitoring;

h. blockchain analytics and wallet-risk screening;

i. suspicious activity review and reporting;

j. regulatory compliance; and

k. response to lawful requests from regulators, courts, law enforcement agencies and competent authorities.

7.3. If you fail to provide required information, or if the information provided is false, incomplete, misleading or unverifiable, we may refuse service, restrict transactions, suspend your account, close your account or report the matter to competent authorities where required or permitted by law.

8. Biometric and Sensitive Personal Data

8.1. Where required for account verification, fraud prevention, security or compliance, we may process biometric information, facial recognition/liveness checks, identity documents and other sensitive personal data.

8.2. We will process such data only where permitted by law, where necessary for the relevant purpose, and with appropriate technical and organisational safeguards.

9. Blockchain Data

9.1. Some digital asset transactions are recorded on public blockchain networks.

9.2. Blockchain records may include wallet addresses, transaction hashes, transaction amounts, timestamps and related transaction data. These records may be public, permanent and not controlled by SWAP.

9.3. You should understand that blockchain data may remain visible even after your SWAP account is closed.

10. Automated Risk Reviews

10.1. We may use automated tools and manual reviews to support identity verification, sanctions screening, fraud detection, wallet-risk scoring, transaction monitoring, account-risk assessment and transaction-limit decisions.

10.2. These tools help us protect users, comply with legal obligations and reduce financial crime risk.

10.3. Where a decision significantly affects you and applicable law gives you the right to request human review, you may contact us through the details provided in this Policy.

11. Sharing Your Personal Data

11.1. We may share your personal data with the following categories of recipients where necessary, lawful or authorised:

a. identity verification and KYC providers;

b. banks, payment processors and financial partners;

c. blockchain analytics and fraud-prevention providers;

d. cloud hosting, IT, cybersecurity and infrastructure providers;

e. customer support, communication and email service providers;

f. auditors, insurers, legal advisers, consultants and other professional advisers;

g. regulators, courts, law enforcement agencies, tax authorities and competent public authorities;

h. affiliates, successors, assigns or business partners in connection with a merger, acquisition, restructuring, investment, financing or transfer of business;

i. corporate customers, authorised representatives or account administrators, where applicable; and

j. any other person where disclosure is required by law, necessary to provide the Services, necessary to protect our rights, or authorised by you.

11.2. We do not sell your personal data.

12. International Transfers

12.1. Some of our service providers, technology partners, cloud providers, verification providers or compliance partners may process personal data outside Nigeria.

12.2. Where we transfer personal data outside Nigeria, we will take reasonable steps to ensure that the transfer is made in accordance with applicable data protection laws.

12.3. This may include relying on adequacy decisions, contractual safeguards, your consent, necessity for performance of a contract, legal obligation or any other lawful transfer mechanism.

13. Cookies and Similar Technologies

13.1. We may use cookies, pixels, device identifiers and similar technologies to operate the Platform, remember your preferences, improve security, analyse usage, detect fraud, measure performance and improve user experience.

13.2. You may adjust your browser or device settings to reject or disable some cookies. However, some parts of the Platform may not work properly if cookies are disabled.

13.3. Where required by law, we will request your consent before placing non-essential cookies on your device.

14. Marketing Communications

14.1. We may send you service updates, product information, promotional messages, educational content and offers relating to our Services.

14.2. You may opt out of marketing communications at any time by using the unsubscribe option, adjusting your account settings or contacting us.

14.3. Even if you opt out of marketing, we may still send important account, transaction, security, legal, compliance or service-related messages.

15. How We Protect Your Personal Data

15.1. We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure or destruction.

15.2. These measures may include encryption, access controls, authentication tools, monitoring, staff confidentiality obligations, security reviews, limited access to sensitive data, secure storage and internal data-protection procedures.

15.3. However, no digital platform, blockchain network, internet transmission or electronic storage system is completely secure.

15.4. You are responsible for protecting your password, PIN, device, 2FA credentials and account access. You must notify us immediately if you suspect unauthorised access, fraud, compromise of your account or any suspicious activity.

16. Data Retention

16.1. We retain personal data for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services, comply with legal and regulatory obligations, resolve disputes, prevent fraud, enforce our Terms, maintain records and meet AML/CFT retention requirements.

16.2. Where personal data is no longer required, we will delete, anonymise or securely retain it in accordance with applicable law and our internal retention procedures.

16.3. Please note that some information may remain in backups, audit logs, compliance records, blockchain records or legal archives for a period required or permitted by law.

17. Your Data Protection Rights

17.1. Subject to applicable law, verification of your identity and our legal or regulatory obligations, you may have the right to:

a. request access to your personal data;

b. request correction of inaccurate or incomplete personal data;

c. request deletion of your personal data;

d. object to certain processing;

e. restrict certain processing;

f. withdraw consent where processing is based on consent;

g. request transfer of your personal data where applicable;

h. object to certain direct marketing; and

i. lodge a complaint with the Nigeria Data Protection Commission or any competent data protection authority.

17.2. These rights are not absolute. We may decline, limit or delay a request where permitted by law, including where the data is required for KYC, AML/CFT, fraud prevention, sanctions screening, regulatory reporting, legal claims, court orders, investigation, audit, tax or statutory record-keeping obligations.

18. How to Exercise Your Rights

18.1. To exercise your data protection rights, please contact us through: Data Protection Officer/Privacy Contact: info@vancefordlaw.com

18.2. We may request additional information to confirm your identity before processing your request.

18.3. We will respond within the period required by applicable law. Where a request is complex or repeated, we may require additional time or take any other step permitted by law.

19. Children's Privacy

19.1. SWAP is not intended for persons under 18 years of age or under the legal age of majority in their jurisdiction.

19.2. We do not knowingly provide Services to children. If we discover that a child has provided personal data or created an account, we may delete the data and close the account, subject to applicable law and any necessary compliance obligations.

20. Third-Party Links and Services

20.1. The Platform may contain links, integrations or services provided by third parties, including banks, payment processors, verification providers, blockchain networks, wallet providers and external websites.

20.2. This Privacy Policy does not apply to third-party websites, platforms or services. We encourage you to read their privacy policies before using them.

20.3. SWAP is not responsible for the privacy practices, content, security or actions of third-party platforms, except to the extent required by applicable law.

21. Data Breach Notification

21.1. Where a personal data breach occurs, we will take reasonable steps to contain, investigate and remediate the breach.

21.2. Where notification is required by law, we will notify affected users and/or the relevant authority in accordance with applicable legal requirements.

22. International Users

22.1. If you access or use the Platform from outside Nigeria, you understand that your personal data may be processed in Nigeria and in other jurisdictions where our service providers or partners operate.

22.2. Where the laws of your jurisdiction provide additional data protection rights, we will respect those rights to the extent they apply to our processing activities.

22.3. Where the EU GDPR, UK GDPR or similar international privacy laws apply, we will take reasonable steps to provide the additional information and protections required under those laws, including information on lawful basis, international transfers, retention, data subject rights and automated processing.

23. Changes to This Privacy Policy

23.1. We may update this Privacy Policy from time to time.

23.2. Where changes are material, we will take reasonable steps to notify you through the Platform, email, SMS, in-app notice or any other appropriate channel.

23.3. The updated Privacy Policy will become effective from the date stated in the revised version.

23.4. Your continued use of the Platform after the updated Policy becomes effective means that you have read and understood the updated Policy.

24. Contact Us

24.1. For questions, complaints or requests relating to this Privacy Policy or your personal data, please contact: