Your money and your details deserve the same care. This policy explains, in plain language, what Cadis does with personal data and why. We collect only what we need to run the service, keep it safe, and never sell it.
1. Who we are
Cadis is a product of Hulani Studio Limited (RC 9953693), a company registered in Nigeria, with its office at 11, Ogunkelu Avenue, Greenland Estate, Mende, Maryland, Lagos, Nigeria. We decide how and why your personal data is used, which makes us the data controller under the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive 2025 (GAID).
Our Data Protection Officer can be reached at dpo@usecadis.com.
2. What this policy covers
This policy covers the Cadis mobile app, the website usecadis.com and its subdomains, and any time you contact us. It applies to people who use Cadis for themselves, to owners and team members of businesses on Cadis, and to people whose details a customer gives us so that we can pay them (for example, staff on a payroll).
3. Personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, phone number, email address, date of birth | You |
| Identity checks | BVN or NIN, the result of the check, a selfie taken for the check, proof of address (higher tiers) | You, our identity verification partner and the official databases it checks |
| Business details | Company name, RC number, CAC documents, business address, directors and team members | You and your team |
| Account and money | Account numbers issued to you, balances, Spaces, automations, payments, receipts and invoices | You, our licensed payment partners, and your use of the app |
| Payment details of others | Bank account details of people you pay, meter numbers, TV smartcard numbers, phone numbers for airtime and data | You |
| Security and device | Device model and identifier, app version, sign-in history, IP address and approximate location, notification token | Your device and our systems |
| Communications | Messages to support, feedback, complaints | You |
| Website | Your cookie choice and display setting (light or dark) | Your browser (see our Cookie Policy) |
Signing in with Face ID, Touch ID or a fingerprint is handled by your phone. We never receive or store your face or fingerprint data from those features.
4. Why we use it and our lawful basis
We only use personal data where the NDPA gives us a lawful basis. For each purpose:
| Purpose | Lawful basis |
|---|---|
| Open and run your account, Spaces and automations; make the payments you set up | Contract with you |
| Verify your identity, keep records of transactions, prevent money laundering and fraud | Legal obligation |
| Keep accounts secure: one trusted phone, sign-in alerts, PIN and limit checks, fraud detection | Legitimate interest and legal obligation |
| Send codes, receipts, reminders and security alerts | Contract with you |
| Answer support requests and complaints | Contract with you and legitimate interest |
| Improve the app and fix problems (using the least data we need) | Legitimate interest |
| Analytics or marketing cookies on the website; marketing messages | Consent, which you can withdraw at any time |
| The selfie used for identity checks (see section 5) | Your explicit consent and legal obligation |
Where we rely on legitimate interest, we have checked that it does not override your rights. You can object to it (see section 11).
5. Identity checks and your selfie
Nigerian rules require us to confirm who our customers are before they can hold or move money. To do this, you enter your BVN or NIN and take a short selfie in a verification screen run by our identity verification partner. The partner compares your selfie with the photo held for your BVN or NIN and checks that it is a live person.
A face image used to identify someone is sensitive personal data under the NDPA. We ask for your explicit consent before the check starts. We receive the result of the check and the details needed to open your account; we do not use your selfie for anything else. If you do not want to take part, you can keep using the features that do not need verification, but you cannot receive an account number or move money.
6. Information you give us about other people
When you add someone to pay (for example, staff on a payroll or a family member's meter) or invite a team member, you give us their details. Please only do so where you are allowed to, and let them know that Cadis will use those details to make the payment or send the invitation. We use them for that purpose only.
In a business account, team members can see what their role allows. The business owner decides who is invited and with which role.
8. Transfers outside Nigeria
Some of our service providers store or process data outside Nigeria (for example, cloud hosting and push notifications). We only transfer personal data abroad where the NDPA allows it: to a country the Nigeria Data Protection Commission considers adequate, or with safeguards such as contractual clauses that give your data the same level of protection. Where Nigerian law requires certain data to be stored in Nigeria, we store it in Nigeria.
9. How long we keep it
| Data | How long |
|---|---|
| Account and profile | While your account is open; deleted or anonymised after closure (see below) |
| Transactions, receipts, identity check records | Seven years after the transaction or account closure, as anti-money-laundering and financial rules require |
| Activity logs for business teams | 90 days |
| Support messages and complaints | Six years after the matter is closed, so we can deal with any later claim |
| Website cookie choice | 12 months (see our Cookie Policy) |
When you close your account, we first give you 30 days to change your mind. After that we delete or anonymise your personal data, except the records the law requires us to keep, which we hold securely for the required period and then delete.
10. How we protect it
- Encryption in transit (HTTPS) and at rest.
- Your account works on one trusted phone at a time; a new phone needs a code sent to your number.
- Payments made by hand need your transaction PIN or your phone’s biometrics.
- Staff access is limited by role, recorded, and reviewed.
- Documents are stored privately and opened only through short-lived links.
- Limits, alerts and monitoring to catch fraud early, and a one-tap account lock for you.
If a breach puts your rights at high risk, we will tell you without delay and report it to the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as the NDPA requires.
11. Your rights
Under the NDPA you have the right to:
- be told how your data is used (this policy);
- get a copy of your personal data;
- have wrong or incomplete data corrected;
- have your data deleted, unless we must keep it by law;
- restrict or object to our use of it, including for marketing;
- receive your data in a commonly used format, or have it sent to another provider;
- withdraw consent at any time (this does not affect what we did before);
- complain to the Nigeria Data Protection Commission.
To use any of these rights, email dpo@usecadis.com or support@usecadis.com from the email on your account, or write to us at our office. We will reply within 30 days and may ask you to confirm your identity first. Exercising your rights is free.
12. Automated decisions
Some checks are automatic: whether an identity check passes, which limits apply to your tier, and whether a payment looks unusual and needs extra confirmation. If an automatic decision affects you significantly (for example, a failed identity check), you can ask a person to review it, explain your view and contest it.
13. Children
Cadis is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us their data, contact us and we will delete it.
15. Changes to this policy
We will update this policy when our services or the law change. The date at the top shows the latest version. For important changes, we will tell you in the app or by email before they take effect.
16. Contact and complaints
Questions or concerns about your data: dpo@usecadis.com. General support: support@usecadis.com.
If you are not happy with our answer, you can complain to the Nigeria Data Protection Commission.