In short: we only collect the information we genuinely need to give you a safe, working account and card, we are honest about how we use it, and we never sell your personal data. Here are the details.
01 Who we are
Gresh Finance (“Gresh”, “we”, “us” or “our”) operates GreshFi, a digital wallet and virtual card service that helps people in Nigeria pay for global and local services with USD and NGN cards. When you use Gresh, we are the data controller responsible for your personal data.
Gresh is operated by Gresh Global Enterprise, registered in Nigeria under registration number 8662921, with its office at 2 Oyinkansola Williams Street, Chief Rotimi Williams, Kay Farms Estate, Obawole, Iju, Lagos State.
If you have any questions about this policy or how we handle your data, you can reach us any time at hello@greshfinance.com.
02 Information we collect
We collect information in three ways:
Information you give us
- Your name, email address, phone number, date of birth and residential address.
- Identity and verification details needed to confirm who you are and keep your account secure, such as a government-issued ID, your BVN or NIN, and a selfie or liveness check. This is required under Nigerian financial and anti-money-laundering rules (Know Your Customer, or KYC).
- Details you provide when you fund your wallet, create a card, or make a payment.
- Anything you send us when you contact support or fill in a form.
Information we collect automatically
- Device and technical information such as your device type, operating system, app version and IP address.
- How you use the app, including transactions, log-ins and activity, which helps us keep your account safe.
- Cookies and similar technologies on our website (see section 10).
Information from trusted partners
- Identity verification providers, licensed card issuers, payment processors and financial partners who help us confirm your identity, issue your cards and process your transactions.
03 How we use your information
We use your personal data to:
- Create and verify your account and meet our KYC and anti-money-laundering obligations under Nigerian law.
- Issue and manage your virtual cards and process your payments and wallet top-ups.
- Detect and prevent fraud, including real-time risk checks on transactions to protect your money.
- Provide customer support and respond to your requests.
- Send you important service messages, and, only where you have agreed, product news and offers (you can opt out at any time).
- Meet our legal, regulatory and reporting obligations.
- Understand how our product is used so we can improve it.
04 Our lawful basis for using your data
Under the Nigeria Data Protection Act 2023, we must have a lawful basis to process your personal data. Depending on the situation, we rely on:
- Performance of a contract — to give you the account, wallet and cards you signed up for.
- Legal obligation — to meet KYC, anti-money-laundering, tax and other regulatory requirements.
- Your consent — for things like marketing messages or optional features. You can withdraw your consent at any time.
- Legitimate interests — to prevent fraud, keep our service secure and improve it, balanced carefully against your rights and freedoms.
06 International data transfers
Because our virtual USD cards and some of our partners operate outside Nigeria, your information may sometimes be transferred to and processed in other countries. When this happens, we take steps consistent with the NDPA and NDPC guidance to make sure your data stays protected, for example by using partners in countries with adequate protection, putting contractual safeguards in place, or relying on your consent where appropriate.
07 How long we keep your data
We keep your personal data only for as long as we need it for the purposes described in this policy, and for as long as we are required to under Nigerian financial, tax and anti-money-laundering laws. When we no longer need it, we securely delete it or make it anonymous so it can no longer identify you.
08 How we keep your data safe
Protecting your data is central to how we build Gresh. We use encryption, strict access controls, continuous monitoring and a real-time fraud detection system that checks transactions as they happen. We also work only with licensed, reputable financial partners. No system can ever be guaranteed to be completely secure, but we follow industry best practice and keep improving our safeguards.
09 Your rights
Under the Nigeria Data Protection Act 2023, you have the right to:
- Ask for a copy of the personal data we hold about you.
- Ask us to correct information that is wrong or incomplete.
- Ask us to delete your data, where we are not required to keep it.
- Ask us to restrict or object to how we use your data.
- Ask us to transfer your data to you or another provider (data portability).
- Withdraw your consent at any time, where we rely on it.
- Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you are unhappy with how we have handled your data.
To exercise any of these rights, just email hello@greshfinance.com. We will respond within the time required by law.
11 Children
Gresh is intended for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with their data, please contact us and we will remove it.
12 Changes to this policy
We may update this policy from time to time as our product, partners or the law change. When we do, we will post the new version here and update the “Last updated” date above. If the changes are significant, we will let you know directly.
13 Contact us
If you have any questions, concerns or requests about your privacy, we would genuinely like to hear from you:
Email: hello@greshfinance.com
Office: 2 Oyinkansola Williams Street, Chief Rotimi Williams, Kay Farms Estate, Obawole, Iju, Lagos State, Nigeria