Privacy Policy

This policy explains how VTUking ("VTUking", "we", "us") collects, uses, shares and protects personal information when you use the VTUking mobile app, the website at vtuking.ng, and the services available through them (together, the "Service"). VTUking is operated by ZedBinary Ltd, a company registered in Nigeria (RC7235301). If you do not agree with this policy, please do not use the Service.

1. Summary

We collect only what is needed to open your account, verify you where the law requires it, deliver the products you pay for, and keep your money and account safe.
We do not sell your personal information, and we never share it with data brokers.
We do not collect your location, your contacts, your photo library, or your camera or microphone data.
Our website uses analytics and advertising cookies. You can control them in your browser. Section 7 explains exactly which ones.
You can delete your account at any time by emailing [email protected] from your registered address.

2. Who we are and what the Service does

VTUking is a Nigerian electronic vending and bill-payment service. You fund a wallet by bank transfer or card and use that balance to buy mobile airtime and data bundles, cable TV subscriptions, prepaid electricity tokens and WAEC scratch cards, to print recharge cards, and to fund a virtual USD card. These are real goods and services delivered by mobile networks, broadcasters, electricity distribution companies and our card-issuing partner.

Many of our users are resellers who buy at our rates and sell on to their own customers. When you enter a customer's phone, meter or smartcard number to deliver a product, you are responsible for having the right to share that detail with us.

3. Information we collect

Split three ways: what you hand us, what your use of the Service creates, and what stays on your device.

3.1 Information you give us

What	When	Why
Full name	Sign-up	Identifying your account, issuing receipts, and meeting regulatory record-keeping duties.
Email address	Sign-up	Signing in, verifying your email, sending transaction and security notices, and answering support requests.
Phone number	Sign-up and verification	Confirming it is yours with a one-time code, delivering top-ups, and contacting you about your account.
Password	Sign-up	Securing your account. Stored only as a salted hash on our servers, never in readable form.
Transaction PIN	First purchase	Authorising purchases. Verified on our servers and never displayed back to you.
Date of birth and gender	Identity verification	Customer identification required of financial services in Nigeria.
Bank Verification Number (BVN)	Verification upgrade	Confirming your identity with the bank registry so we can raise your limits, enable corporate funding, and issue a virtual USD card.
Recipient details	Each purchase	The phone, meter or smartcard number you are crediting, so the exact product you paid for reaches the right place. Also used for support and dispute resolution.
Payment card details	Card funding	Entered on a secure page provided by our licensed payment processor. We receive a confirmation and a masked reference, never your full card number or CVV.
Support correspondence	When you contact us	Answering you and keeping a record of the issue.

Not requested

We do not ask for government ID photographs, selfies, passport or driver's licence scans, or your bank login credentials. If anyone asks for these in VTUking's name, it is not us. Report it to [email protected].

3.2 Information created by your use of the Service

Wallet and transaction data: Your wallet balance, the dedicated bank account number assigned to you for funding, funding transfers received, every purchase with its amount, product, provider, status, reference and timestamp, commission earned, and receipts.
Account status: Email and phone verification status, verification level, account type, and whether a transaction PIN is set.
Virtual USD card data: If you create a virtual USD card, the card's masked number, balance, funding history and card transactions. The full card number is issued and held by our card partner and displayed to you in the app on request.
Session and device information: A device identifier generated by the app, the device model and operating system, and session activity. This lets us detect suspicious sign-ins and lets you see where your account is signed in.
Technical and security logs: IP address, timestamps, and error diagnostics generated when your device communicates with our servers. Used for security, fraud prevention and debugging.
Crash and performance diagnostics: If the app crashes or slows down, a report describing the fault (device model, OS version, app version and the technical trace) helps us fix it. These reports do not contain your wallet balance, PIN or password.

3.3 Stored only on your device

Biometric unlock: If you turn on fingerprint or face unlock, your biometric data is held by Apple or Google in the device's secure hardware. VTUking never sees it, never receives it and cannot store it. The operating system only tells the app "unlocked" or "not unlocked".
Session tokens: Held in the device's secure storage so you are not asked to sign in repeatedly. Erased when you sign out or delete the app.
Local preferences: Theme choice, whether "Remember me" is on, and the email address you last signed in with. Never your password.

3.4 Information we do not collect

We do not request or receive location data (precise or coarse), your contacts, your photo library, your camera, your microphone, your health data, or your browsing history in other apps.

4. Permissions the app asks for

Biometrics: Requested only if you choose to turn on fingerprint or face unlock. Declining it does not limit any feature. Password sign-in always remains available.
Notifications: Requested so we can tell you when a purchase is delivered, when your wallet is credited, and when something on your account needs attention. You can turn notifications off in your device settings at any time.
Storage or photos (save only): Requested only at the moment you choose to save or share a receipt or printed recharge card. We write the file you asked for and read nothing else.

The app requests no other device permissions.

5. How we use your information

We use personal information to:

Create and operate your account, and sign you in securely.
Verify your email address and phone number and, where required, your identity and BVN.
Assign you a dedicated bank account number and credit your wallet when a transfer or card payment arrives.
Process the purchases you authorise with your transaction PIN, and deliver those products to the phone line, meter, smartcard or card you specified.
Calculate and display the commission or discount applied to eligible purchases, and your earnings as a reseller.
Show your transaction history and generate receipts you can save, print or share.
Issue and operate a virtual USD card through our card partner, if you request one.
Comply with Nigerian financial-services obligations, including customer identification (KYC), anti-money-laundering and anti-fraud rules, and respond to lawful requests from regulators and law-enforcement authorities.
Detect, investigate and prevent fraud, account takeover, and abuse of the Service.
Provide customer support and resolve disputed or failed transactions.
Send service messages about your account and transactions, and maintain and improve the app's reliability.
With your consent, send you marketing about VTUking products. Section 14 explains how to opt out.

We do not make automated decisions that produce legal effects about you without human review. Automated fraud checks may pause a transaction, but a person reviews it before any account is closed.

Legal bases

Where the Nigeria Data Protection Act 2023 (NDPA), the GDPR or similar law applies, we rely on:

Performance of a contract: Operating your wallet and delivering purchases.
Legal obligation: KYC, anti-money-laundering, tax and record-keeping duties.
Legitimate interests: Securing accounts, preventing fraud, understanding how the Service is used, and improving it.
Consent: Optional items such as biometric unlock, marketing messages and advertising cookies, which you can withdraw at any time.

Only as described here, and only to the minimum extent needed.

Product providers: Mobile network operators (MTN, Airtel, Glo, 9mobile), cable TV broadcasters (DSTV, GOTV, StarTimes), electricity distribution companies (including PHED, IKEDC, EKEDC and AEDC) and WAEC. They receive the recipient detail needed to deliver what you bought: the phone number, meter number or smartcard number, and the amount.
Our licensed payment service providers: They issue and operate your dedicated funding account number, process card payments, and notify us of incoming funds so your wallet can be credited.
Our card-issuing partner: If you request a virtual USD card, the licensed issuer receives the identity details required by card-scheme and regulatory rules (name, date of birth, phone number and BVN) to open the card in your name.
Identity-verification partners and the bank verification registry: To confirm your phone number, date of birth and BVN when you complete verification.
Infrastructure providers: Hosting, database, email, SMS and push-notification delivery, and crash-reporting services acting on our instructions under contract. They may not use your data for their own purposes.
Regulators, courts and law-enforcement authorities: Where we are legally required to disclose, or where disclosure is necessary to investigate fraud or protect our users.
A successor entity: If ZedBinary Ltd is involved in a merger, acquisition or asset sale, your information may transfer, subject to this policy.

Our commitment

We never sell your personal information, and we never share it with advertisers or data brokers. Advertising partners on our website receive cookie data only, as described in section 7, never your account records.

7. Cookies, analytics and advertising on the website

The website at vtuking.ng, like most websites, collects information that browsers and servers make available: browser type, language preference, referring site, and the date and time of each request. We use it to understand how visitors use the site and to keep it running.

The website also loads the following third-party services, each of which may set cookies or similar identifiers in your browser:

Google Tag Manager and Google Analytics: Measure page views and traffic sources so we know which pages are useful.
Google AdSense: Displays advertisements. Google and its partners may use cookies to show ads based on your visits to this and other sites.
Meta Pixel: Lets us measure the results of advertising on Facebook and Instagram and show VTUking ads to people who have visited the site.

These services operate under their own privacy policies. You can opt out of personalised advertising at Google Ads Settings and in your Facebook ad preferences, block cookies in your browser settings, or use a browser extension that blocks trackers. Blocking these cookies does not affect your ability to use the website or the app.

The VTUking app does not load advertising SDKs.

8. International transfers

We are based in Nigeria and process data there. Some infrastructure providers, including cloud hosting, email delivery and our card partner's systems, may store or process data outside Nigeria. Where that happens we rely on contractual safeguards requiring a level of protection consistent with the NDPA 2023 and, where applicable, standard contractual clauses.

9. How long we keep information

Account and profile data: For as long as your account is open.
Transaction, wallet, card and KYC records: For the period Nigerian financial and anti-money-laundering law requires. Currently a minimum of five years after the transaction or after the account closes, whichever is later.
Security and technical logs: Typically up to 12 months, unless needed for an ongoing investigation.
Support correspondence: Up to 24 months after the matter is closed.
Website analytics: Held by the analytics providers under their own retention settings, which we configure to the shortest period available.

Required by law

Transaction, wallet and KYC records survive account deletion, because Nigerian anti-money-laundering law requires us to keep them. They are held in restricted form and used for no other purpose.

When a retention period ends, data is deleted or irreversibly anonymised.

10. Deleting your account

Email [email protected] from your registered email address and ask us to delete your account. We will confirm the request with you, then close the account permanently and revoke your sessions on every device. Where the app offers an in-app deletion option, you can use that instead.

Before you delete

Spend or withdraw your wallet balance and any virtual card balance first. A remaining balance is not automatically refunded on deletion. Records we must keep by law (section 9) are retained in restricted form and are not used for any other purpose.

11. Security

All communication between the app, the website and our servers uses HTTPS/TLS encryption.
Passwords are stored only as salted hashes. Your transaction PIN is verified server-side and never shown back to you.
Session tokens live in the device's secure storage, not in ordinary app storage.
Every purchase requires your transaction PIN, and the app can additionally be locked with fingerprint or face unlock.
Card payments are handled on our payment processor's secure page. We never store full card numbers or CVVs.
BVN verification allows a maximum of three incorrect attempts. We reserve the right to close any account that supplies false information or that we consider suspicious.
If we detect that a session token has been reused or stolen, we end that session automatically.

No system is perfectly secure, but we work to protect your data and will notify you and the Nigeria Data Protection Commission of a breach affecting your personal data as the law requires.

12. Your rights

Subject to Nigerian law, and to the GDPR where it applies to you, you may ask us to:

Access: Tell you what personal information we hold about you.
Correct: Fix information that is inaccurate or incomplete.
Delete: Remove your account and the data we are not legally required to keep.
Object or restrict: Stop or limit certain kinds of processing.
Port: Give you a machine-readable copy of the data you provided.
Withdraw consent: For anything you consented to, such as marketing or biometric unlock, without affecting processing that already took place.

To exercise any of these, email [email protected] from your registered address. We respond within 30 days. We may need to verify your identity before acting, to make sure we are not disclosing your data to somebody else. You may also complain to the Nigeria Data Protection Commission, or to your local supervisory authority.

13. Children

The Service is not directed to children. You must be 18 or older to open a VTUking account, as Nigerian financial-services rules require. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we delete the account and its data. If you believe a minor has created an account, contact [email protected].

14. Marketing communications

We send transactional and security messages, such as verification codes, transaction confirmations and account alerts, because they are part of the Service and cannot be turned off while your account is open.

We may also send promotional emails, SMS or push notifications about VTUking products and rates. Every promotional email includes an unsubscribe link, you can reply STOP to a promotional SMS, and push notifications can be switched off in your device settings. Opting out never affects your ability to use the app.

15. Links to other sites

The Service may contain links to external sites we do not operate, including our product providers, app stores and social networks. If you follow a link you will be on that third party's site, under its privacy policy. We have no control over, and accept no responsibility for, the content or privacy practices of any third-party site, product or service.

16. Changes to this policy

We may update this policy as the Service or the law changes. The "Last updated" date at the top always reflects the current version. If a change materially affects how we use your information, we will tell you in the app or by email before it takes effect. Continuing to use the Service after a change means you accept the updated policy.

17. Contact

ZedBinary Ltd (RC7235301)
14 Unity Close, Gbazango, Abuja, FCT, Nigeria
[email protected] · 0813 062 4702

We aim to answer every privacy enquiry within 30 days.