Terms of Use

“Platform” means all of the following, together and separately:

• our website at www.budpay.com, including all pages, subdomains and content;

• the BudPay dashboard, our browser-based application through which merchants configure their account, view transactions and settlements, manage users, and access reports;

• the BudPay mobile applications for iOS and Android, including any tablet version, and any successor or companion app we release;

• our APIs, SDKs, plugins, developer tools and documentation;

• any other channel through which we deliver our services, including hosted checkout pages, payment links, virtual accounts, USSD strings and any point-of-sale or terminal software we supply.

Where these Terms refer to the Platform, they apply to all of these channels unless a clause says otherwise. Some features are available only on some channels; we are not obliged to offer identical functionality across all of them.

“Services” means the payment collection, settlement, payout, virtual account, reporting and related services we provide through the Platform.

Your use of the Services is also governed by:

• our Privacy Notice;

• our Cookie Policy (for our website and dashboard);

• our Acceptable Use Policy;

• your Merchant Service Agreement with us, if you have signed one;

• any product schedule, order form or third-party provider terms that apply to a specific service you have enabled.

Together these are the “Related Documents”. Please read them.

If a Related Document conflicts with these Terms, the following order applies, from highest to lowest:

1. applicable law and the directions of any regulator or court;

2. the rules of the relevant card scheme or payment network;

3. your signed Merchant Service Agreement;

4. any product schedule or order form;

5. these Terms;

6. the remaining Related Documents.

A signed Merchant Service Agreement therefore takes priority over these Terms, and nothing we publish on the Platform changes what you and we have negotiated and signed.

We may change these Terms. When we do, we will post the updated version on the Platform and update the “Last updated” date.

• Where a change is neutral or in your favour, a clarification, a new feature, a correction, it takes effect when we post it.

• Where a change reduces your rights or increases your obligations in a material way, we will give you at least 30 days’ notice before it takes effect. We will notify you by email to your registered address, by notice in the dashboard, or both.

• If you do not accept a material change, you may close your account before the change takes effect. Continuing to use the Services after that date means you accept the change.

• Where a change is required by law, by a regulator or by a card scheme, and the timetable imposed on us is shorter than 30 days, we will give you as much notice as we reasonably can.

We keep previous versions of these Terms and will provide an earlier version on request.

The Platform is intended for businesses and for individuals aged 18 or over. If the age of majority where you live is higher than 18, that higher age applies to you.

We do not knowingly provide the Services to anyone under 18. If we learn that an account holder is under 18, we will close the account. If you believe a person under 18 has an account with us, contact us at [dataprotection@budpay.com].

You may not use the Services if you are resident in, or accessing the Platform from, a country we do not support, or if you or your business is subject to sanctions administered by Nigeria, the United Nations, the United States, the United Kingdom or the European Union. Our supported countries list is available on request and may change.

We are a payment service provider. We process payments between you and the people who pay you, and we settle the proceeds to the account you nominate.

We are not a bank, and we do not take deposits. Funds we hold pending settlement are held in accordance with our regulatory obligations and are not a deposit with us.

We are not a party to the sale between you and your customer. We do not select, supply, inspect, endorse or take responsibility for the goods or services you sell, or for their quality, legality, safety, delivery or description. Disputes about what you sold are between you and your customer.

We provide the Services as an independent contractor. Nothing in these Terms creates a partnership, joint venture, agency or employment relationship, and neither of us may hold the other out as having authority to bind it.

We do not promise any commercial outcome. Nothing on the Platform, in our marketing, or in anything our people say to you is a guarantee of transaction volumes, approval rates, conversion, revenue or growth.

To use the Services you must open an account. We will ask you for information about you and your business, which will typically include your business name and registration details, the names and identification of your directors, beneficial owners and authorised signatories, your contact details, your bank account details and a description of what you sell.

You authorise us to verify that information, directly or through third parties, including identity verification providers, credit reference agencies, sanctions and politically-exposed-person screening providers, and public registries. We may repeat these checks at any time while your account is open. This is part of how we meet our obligations under Nigerian anti-money-laundering law and the rules of the card schemes.

We may approve your account, approve it with conditions or limits, or decline it. We may decline an application, or close an approved account, where we cannot complete verification, where the risk is outside what we are able to accept, or where we are required to.

Everything you tell us must be accurate, complete and current. If any of it changes, your business name, registered or trading address, ownership or control, banking details, payment methods, or the goods or services you sell, tell us within 14 days. If your business goes through a restructuring, merger, acquisition or change of control, tell us before it completes if you can, and in any event within 14 days.

We may be unable to act on instructions or answer queries that reach us from an email address, phone number or account that is not registered to you.

You are responsible for everything done through your account. You must:

• keep your password, API keys, secret keys, webhook signing secrets and one-time codes confidential, and never share them;

• use a distinct password for your BudPay account and change it if you suspect it is known to anyone else;

• enable and keep enabled any multi-factor authentication we make available;

• give dashboard access only to people who need it, using the role-based permissions we provide, and remove access promptly when someone leaves or changes role;

• rotate API keys when a person with access to them leaves, and immediately if you suspect they have been exposed;

• secure the devices you use to access the Platform, including by using a screen lock, keeping the operating system and our app updated, and not using a device that has been jailbroken, rooted or otherwise modified to bypass its security controls;

• avoid accessing your account over public or untrusted networks; and

• tell us without delay, using the contact details in clause 27, if you suspect that your credentials have been compromised or that anyone has used your account without authority.

If we ask you to take a reasonable step to protect the security of your account or of the Services, please take it.

Where a loss arises because you shared your credentials, failed to secure your device, or delayed in telling us about a compromise, that loss is yours and not ours. We may also suspend your account or reset your credentials where we reasonably believe they have been compromised.

8.1 Multi-factor authentication

We require every user to authenticate using a password and one time password (“OTP”) by default, at no additional cost. We strongly recommend the use of Google Authenticator as an additional authentication method, as it provides enhanced security compared to OTP. Where a user chooses not to enable Google Authenticator, or disables it after enabling it, the user accepts the associated risk of unauthorised access and any resulting transaction, payout, configuration change or data disclosure. We strongly recommend that you enable multi factor authentication (“MFA”) using additional authentication factors where available, as this provides enhanced protection against unauthorised access and account takeover. Where you or any of your users choose not to use an available additional authentication factor beyond the default 2FA, or disable any such additional factor after enabling it:

• you accept the risk of any unauthorised access to your account, and of any transaction, payout, configuration change or data disclosure that results;

• we are not liable to you for any loss arising from that unauthorised access, except to the extent the loss was caused by our own gross negligence, wilful misconduct or fraud, or by a failure of our systems unrelated to the missing authentication factor; and

• you will indemnify us against any claim, loss, fine or cost we incur, including a claim by your own customer or by a regulator, arising from unauthorised access to an account on which multi-factor authentication was not enabled.

We may make multi-factor authentication mandatory for some or all accounts, roles or actions; for example for payouts, for changing bank details, or for API key generation and we may do so with immediate effect where a card scheme, a regulator or a security incident requires it.

Where we notify you that a security control is required and you do not implement it within the period we state, we may take either or both of the steps in clause 17.1.

Subject to these Terms, we grant you a limited, revocable, non-exclusive, non-transferable, non-sublicensable, royalty-free licence to install and use our mobile applications on devices you own or control, and to access and use our dashboard, APIs, SDKs and documentation, in each case for the purpose of receiving the Services. This licence covers updates and replacement versions.

Our apps. You download our mobile apps from the Apple App Store or Google Play, and your use of them is also subject to the rules of that store. Additional terms that apply to app store distribution are in Schedule A.

Permissions. Our apps may ask for access to device features, for example the camera to scan a document or QR code, notifications to alert you to a transaction or a dispute, biometric authentication to sign you in, and storage to save a report. You choose whether to grant these, and you can change your mind in your device settings. Some features will not work without the relevant permission. What we do with the resulting data is explained in our Privacy Notice.

Updates. We may release updates, and some updates are necessary for security, for compatibility, or to keep us compliant with card scheme or regulatory requirements.

Where an update is mandatory we will tell you, and if you do not install it, parts of the Platform may stop working. We may also discontinue an app, a feature or an API version. Where we retire an API version we will give reasonable notice and, where practical, a migration path.

What you must not do with our software. You must not rent, lease, lend, sell, sublicense or otherwise transfer your rights in it. You must not copy, modify, adapt, translate, reverse engineer, decompile, disassemble, or attempt to derive source code from it, or create derivative works from it, except to the extent the law says you may despite this restriction. You must not remove or obscure any proprietary notice, circumvent any technical restriction, or use it in a way our documentation does not permit.

Integration requirements. You must follow the implementation, access and use requirements in our documentation, including our security and authentication requirements. If you do not, you are responsible for the resulting loss — yours, ours and any third party’s.

Third-party components. Our software may include or interoperate with third-party materials and technology. You get no rights in those materials beyond your right to use our software as permitted here, and any separate third-party licence terms that we make available to you also apply.

You are responsible for who you sell to and what you sell them. In particular:

• Know your customer. You are solely responsible for verifying the identity of your customers, confirming that the person paying is authorised to use the payment method, and deciding whether the customer is eligible to buy what you are selling.

• Keep proof of delivery. You must obtain and keep records that show what you sold, when you delivered or made it available, and to whom. We will ask you for these when a payment is disputed, and your ability to defend a dispute usually depends entirely on them. Keep them for at least five years, or for any longer period your Merchant Service Agreement or the law requires.

• Verify before you fulfil. Confirm the status of a transaction by a server-to-server call to our transaction status endpoint before you release goods or provide services. Do not rely on a browser redirect, an on-screen message or an unverified callback. If you fulfil an order without verifying server-side, you carry that risk.

• Publish clear terms. Your website, app or checkout must clearly show what you are selling, your price and currency, your delivery timescales, your refund, return and cancellation policy, your customer service contact details, and how you protect your customers’ information.

• Handle customer complaints. Deal with your customers’ complaints and refund requests promptly and fairly. Most disputes that reach the card schemes could have been resolved by you first.

• Use approved authentication. Where we require 3-D Secure or another authentication method for a payment type, use it.

• Comply with the rules that apply to you. These include Nigerian law, consumer protection and advertising rules, tax obligations, data protection law, and the rules of the card schemes and payment networks that apply to merchants.

• Meet PCI DSS. Complying with the Payment Card Industry Data Security Standard, to the level applicable to you, is your responsibility, as is compliance with every other law and rule governing your access to, use, storage and disclosure of user and cardholder information. We are responsible for the cardholder data we hold on our own systems, which we protect with access controls, encryption, network controls and regular security updates in line with PCI DSS.

• Comply with anti-bribery law. Each of us will comply with the anti-bribery and anti-corruption laws applying in Nigeria, including the Corrupt Practices and Other Related Offences Act and the Economic and Financial Crimes Commission (Establishment) Act, and neither of us will offer or accept any improper payment in connection with this relationship.

Our fees are set out in your Merchant Service Agreement or in the pricing schedule that applies to your account, and are shown in the dashboard. Where a fee applies to a transaction you initiate, we will disclose it to you before you confirm.

Unless your Merchant Service Agreement says otherwise, we deduct our fees from the amounts we settle to you. Where we cannot, we may invoice you, and invoices are payable within the period stated on them.

Fees are exclusive of value added tax and any other tax, levy or duty, which you pay in addition where applicable.

Your bank, card issuer or mobile money provider may charge you separately ; for example a cash advance fee if you fund a transaction with a credit card, or a transfer or maintenance fee on your settlement account. Those charges are between you and them.

Where a third party increases a cost that we pass through; interchange, scheme fees, switching fees, telecommunications charges or a regulatory levy; we may pass on the increase, and we will tell you when we do.

We settle amounts due to you to the account you nominate, within the settlement cycle stated in your Merchant Service Agreement or, if you do not have one, the cycle published for your account in the dashboard.

Settlement is net of our fees and of any amount we are entitled to recover, retain, withhold or set off under these Terms, your Merchant Service Agreement or applicable law.

Your authority to us. You authorise and instruct us to receive, hold and disburse funds on your behalf as they settle from the card schemes and our partner banks, and to determine, in accordance with the settlement cycle applying to your account, how and when those funds are paid out to you. This authority remains in force until your account is permanently closed.

You are not entitled to interest or any other compensation on funds we hold pending settlement in the ordinary course. This does not affect any right to interest on late settlement expressly given to you in a signed Merchant Service Agreement, which prevails.

Where a payout is not enough. If the amount we are due to settle to you is insufficient to cover what you owe us, you authorise us to set off the shortfall against future settlements and, where that is not sufficient, to debit your nominated bank account. You will give us the bank account details and mandates we reasonably need in order to do this.

Changes to your payout schedule. We may change your payout schedule, suspend payouts or initiate a reversal where there are pending disputes, where your chargebacks or refunds are excessive or expected to become excessive, where there is other suspicious activity on your account, or where the law or a court, regulator, card scheme or partner bank requires it. We will tell you when we do, with our reasons, unless the law prevents us.

Settlement timing depends on systems we do not control, including your bank, our acquiring and partner banks, the card schemes, the switches and NIBSS. Where a delay is caused by one of those, or by a legal or regulatory requirement, or by an event outside our reasonable control, the delay is not a breach by us.

If a transaction fails or does not complete, tell us in writing and we will return the amount, including any fee you were charged on it, using the method the payment came in on.

If you need to refund a customer for a completed transaction, you can initiate a refund through the dashboard or the API, subject to any limits on your account. You are responsible for deciding whether a refund is due under your own policy and the law. A refund is funded from your available balance or, where that is insufficient, recovered from you.

Refunds go back to the original payment method. Where that is not possible, for example a closed card, we will tell you and agree an alternative route with you.

A chargeback happens when a card issuer reverses a payment, usually because the cardholder says they did not authorise it, did not receive what they paid for, or did not get what was described.

When a payment you have received is disputed:

• we will notify you, with the transaction details, the reason code and the deadline for your response;

• you must respond by the deadline with evidence that value was given, including your delivery or collection records;

• we will submit your evidence to the card scheme in line with its rules and tell you the outcome;

• the card scheme’s decision on the merits is final as between you and us; and

• where the dispute is decided against you, is undisputed, or you do not respond in time, you must reimburse us the amount of the chargeback and the associated costs and fines actually charged to us.

Where a dispute is decided in your favour, withdrawn, or does not result in any liability to us, we will not recover it from you, and we will reverse any chargeback fee we charged on it.

We may retain the disputed amount from funds not yet settled to you while a dispute is running. Detailed provisions on chargebacks, retentions, security and reserves are in your Merchant Service Agreement, which prevails over this clause.

Tell us as soon as you notice an unauthorised or irregular transaction on your account so that we can act quickly. Claims against us relating to a payment must be brought within six months of the payment date. After that, to the extent the law allows, the claim is waived.

We are not liable for the goods or services paid for using the Services. We may, but do not have to, assist in a dispute between you and your customer. Where you ask us to look into a transaction, give us the transaction reference and the relevant details so that we can.

We may place a hold on a transaction, on funds, or on your account, and may require security or a reserve, where:

• we are required to by law, by a regulator, by a court, by a card scheme or by a partner bank;

• we reasonably suspect fraud, money laundering or other criminal activity;

• your chargeback or fraud levels exceed the thresholds that apply to your account; or

• we reasonably believe funds will be needed to meet a chargeback, refund, fine or other liability of yours.

We will tell you when we do this, with our reasons and the expected duration, unless the law prevents us from telling you — which can happen where a suspicious transaction report has been made. Where a hold or reserve arises from a court order or a legal or regulatory requirement, it may last longer than 180 days, and may last as long as the order or requirement does.

Where we impose a reserve, we will tell you the percentage of your payouts being held, the period, and any other condition. We will tell you if those terms change.

Security over reserved funds. To secure performance of your obligations to us, you grant us a lien over and a security interest in the funds held in any reserve, and in amounts otherwise due to you, for all amounts payable by you to us. You remain liable for all obligations relating to your transactions after a reserve is released, and you must keep your nominated bank account open and operational for open settlements, chargebacks and adjustments.

Where you have a Merchant Service Agreement, its provisions on holds, deferrals, reserves and notice periods apply instead of this clause.

When using the Platform or the Services, or when dealing with us, other BudPay customers or third parties, you must not:

Legal and regulatory

1. breach these Terms, the Acceptable Use Policy, the Privacy Notice, your Merchant Service Agreement or any other agreement with us;

2. break any law or regulation, including those on financial services, consumer protection, competition, advertising, discrimination, tax, sanctions, anti-money-laundering or data protection;

3. use the Services in a way that we, the Central Bank of Nigeria, any other regulator or any card scheme reasonably considers to be an abuse of the card system or a breach of scheme or network rules;

4. access the Services from a country we do not support, or on behalf of a sanctioned person;

5. sidestep any limit, suspension, restriction or decision we have applied to your account, including by opening or using another account;

6. control or operate an account connected to another account that has done any of the things in this clause;

Honesty and financial crime

7. give us information that is false, inaccurate, incomplete or misleading, or omit information we have asked for;

8. refuse to cooperate with an investigation, or to confirm your identity or verify information you have given us;

9. send or receive funds that we reasonably believe may be the proceeds of fraud or other crime;

10. process a transaction you know or suspect to be fraudulent, unauthorised or not genuine;

11. use the Services to test card numbers or card behaviour, or to process a transaction that has no genuine underlying sale, including processing your own cards through your own account;

12. split a single sale into multiple transactions, or process a transaction on behalf of another business, to avoid a limit, a fee or a scheme rule;

What you sell

13. sell counterfeit, stolen, unlawful or prohibited goods or services, or anything on our restricted list;

14. infringe anyone’s copyright, patent, trade mark, trade secret, design, database right, or rights of privacy or publicity, including ours;

15. behave in a way that is defamatory, threatening, harassing or abusive, or harass or threaten our people, our other customers or our partners;

The Platform itself

16. place an unreasonable or disproportionate load on the Platform or on the systems, networks or servers used to provide it;

17. introduce or facilitate any virus, worm, trojan, ransomware, malware or other harmful code, or attempt to gain unauthorised access to any system, account or data;

18. use an anonymising proxy, a bot, a scraper, a crawler or any other automated means to access, monitor or copy the Platform without our written permission, or bypass any robot exclusion or rate limit;

19. probe, scan or test the vulnerability of the Platform, or breach or circumvent any security or authentication measure, except under a written agreement with us or in accordance with a published responsible disclosure programme;

20. interfere with the Platform, with our systems, or with anyone else’s use of the Services; or

21. do anything that could cause us to lose the services of an acquirer, partner bank, processor, card scheme, internet service provider or other supplier.

Our Acceptable Use Policy sets out the categories of business and activity we cannot support. It forms part of these Terms.

If we believe, discover or are told that you have done any of the things in clause 16 or in the Acceptable Use Policy, or that your use of the Services creates a risk of loss, complaint, fine or regulatory action, we may take any of the following steps. Which step we take depends on how serious the issue is, and we will take the least disruptive step that adequately addresses the risk.

• ask you for information or an explanation, and require you to fix the problem within a stated period;

• apply limits to your account — for example on transaction size, volume, payment methods or payout speed;

• require additional controls, such as manual review, velocity limits or address verification;

• require security or a reserve, or hold funds, in accordance with clause 15;

• suspend part or all of your access to the Services;

• refuse to process particular transactions or a category of transactions;

• close your account and terminate these Terms;

• decline to provide services to you in future;

• report the matter to a regulator, a card scheme, a partner bank or law enforcement, and share relevant information with them;

• contact third parties who have transacted with you, where we reasonably need to in order to limit loss;

• correct information on your account that we have found to be inaccurate; and

• restrict access from a particular IP address or device where it is the source of abuse;

• take legal action, including proceedings to recover amounts you owe us and to restrain continuing misuse of the Platform.

17.1 Thresholds

We set thresholds for fraud, chargebacks, refunds and security compliance on your account, whether under your Merchant Service Agreement, in the dashboard, or by notice to you. Card schemes and our partner banks set thresholds of their own that we must observe.

Where you exceed a threshold, or fail to implement a security control we have told you is required, we will notify you and give you a reasonable period to bring the account back within it. If you do not, we may, at our discretion, either or both:

(i) shift to you any liability arising from the non-compliance, including any chargeback, fine, assessment, penalty or cost imposed on us or on our partners as a result; and

(ii) discontinue the provision of the Services to you altogether, on notice.

Where a card scheme, a partner bank or a regulator directs us to act immediately, we will act and tell you at the same time.

We will tell you when we suspend or close your account, and give our reasons, unless the law prevents us or telling you would prejudice an investigation.

You are responsible for all reversals, chargebacks, claims, fees, fines, penalties and other liabilities that we, another customer or a third party incurs because of your breach of these Terms or your use of the Services.

You may close your account at any time from the dashboard, or by writing to us. Closure does not take effect until you have settled everything you owe us and any open transactions and disputes have run their course.

We may suspend or close your account, or terminate these Terms, where:

• you breach these Terms or any Related Document;

• we are required to by law, by a regulator, by a court, by a card scheme or by a partner bank;

• your issuing or partner financial institution directs us to;

• we reasonably suspect fraud, money laundering or other criminal activity on your account;

• your account has been inactive for [8] weeks; or

• we stop offering the Services or the relevant product, in which case we will give you at least 30 days’ notice unless a shorter period is forced on us.

Where the reason is not urgent, we will give you at least 30 days’ notice. Where it is urgent, fraud, a legal or regulatory requirement, a scheme direction, or a serious security risk, we may act immediately.

After termination: you must stop using the Platform, and remove our APIs, logos and payment marks from your properties. We will settle amounts due to you, less anything you owe us and anything we are entitled to retain for chargeback, refund or other risk. We may retain funds for the period stated in your Merchant Service Agreement or, if you do not have one, for up to 180 days, to cover disputes that may still arise. We will keep your data for as long as our Privacy Notice and the law require, and will give you access to export your transaction data for a reasonable period after closure.

Clauses on fees owed, chargebacks, confidentiality, intellectual property, liability, indemnity, governing law and any other clause intended to survive will continue to apply after termination.

Some of our services are delivered with partners; for example foreign-currency virtual accounts, cross-border payouts, card issuing, identity verification and fraud screening.

Where you enable one of those services, the terms of the relevant partner also apply to you, and by enabling the service you agree to them as stated in Schedule B. We will update that Schedule as our partners change, and we will notify you of a change that affects a service you use.

You acknowledge that we do not own or control our partners’ systems, and that we are not liable for their acts or omissions except to the extent the law makes us, or your Merchant Service Agreement says we are. A breach by you of a partner’s terms may result in your access to that particular service being limited or withdrawn, and we will tell you if that happens.

How we handle personal information is explained in our Privacy Notice, which forms part of these Terms.

In summary, and without changing anything in the Privacy Notice or in your Merchant Service Agreement:

• You control your customers’ data. As between you and us, you decide why and how the personal information of your customers is collected in your checkout, and you own the relationship with them. You are responsible for having a lawful basis for giving that information to us, for telling your customers about it in your own privacy notice, and for handling their requests about their data.

• We process it in two capacities. We act on your instructions in respect of processing carried out to deliver the Services to you. We act in our own right, deciding our own purposes, in respect of fraud prevention and detection, anti-money-laundering and sanctions compliance, card scheme compliance, dispute management, regulatory reporting, and the security and integrity of the Platform. We are responsible for our own compliance in respect of that second category.

• The limited rights we need. You grant us a non-exclusive, worldwide, royalty-free licence to process transaction and customer data to the extent necessary to: provide, secure, support and improve the Services; prevent and investigate fraud and financial crime; produce aggregated and anonymised analytics and reporting that do not identify you, your customers or any individual; and comply with law and with card scheme rules or a lawful request from a regulator, court or law enforcement agency. This licence lasts as long as we need it for those purposes and no longer, and it does not permit us to sell your customer data or to use it to market our own products to your customers.

• Security. We maintain PCI DSS compliance at the level applicable to our activities, and technical and organisational measures appropriate to the risk. You must do the same, and must never store or allow anyone else to store a full card number, a card verification value or full magnetic stripe or chip data.

• Breaches. If either of us discovers a personal data breach affecting the other’s data, we will tell the other without undue delay and cooperate on notifications to the Nigeria Data Protection Commission and to affected individuals.

Both of us will comply with the Nigeria Data Protection Act 2023 and any other data protection law that applies.

Each of us may receive information from the other that is confidential — including information about services, pricing, know-how, technology, security, business plans, customers and transaction data. Each of us will keep the other’s confidential information confidential.

If you receive our confidential information, you may use it only to exercise your rights and perform your obligations under these Terms, and you may share it only with your employees, officers and professional advisers who need it and who are bound by confidentiality obligations at least as protective as these. The same applies to us in respect of yours. Each of us will protect the other’s confidential information with at least the care we apply to our own, and never with less than reasonable care.

These obligations do not apply to information that: is public when disclosed, or later becomes public other than through a breach of a confidentiality obligation; was already lawfully known to the recipient; or is independently developed by the recipient without using the other’s confidential information.

Either of us may disclose the other’s confidential information where required by law, by a regulator, by a card scheme or by a court. Where we are permitted to, we will tell the other first and give it a fair chance to object or to narrow the disclosure.

These obligations continue for three years after termination, and indefinitely in respect of personal data, cardholder data and source code.

The Platform, the Services, our software, our documentation and everything we create in connection with them, together with all intellectual property rights in them, belong to us or to our licensors. Nothing in these Terms transfers any of that to you.

“BudPay”, our logo, our page headings, custom graphics, button icons, scripts and trade dress are our trade marks or those of our licensors. You may not copy, imitate, modify or use them without our written consent, except that you may use the payment marks and badges we supply, in the form we supply them, to show that you accept payments through us.

Your intellectual property remains yours. Nothing in these Terms gives us any right in your platform, your systems, your content or your trade marks, other than the limited permissions in clause 23 and the licence in clause 20. Anything you build to integrate with us — your own code, configuration, architecture and integration work — is yours.

You will, at our reasonable request, take such steps and sign such documents as are reasonably needed to confirm or perfect our rights in our intellectual property. This does not require you to assign anything of your own.

If you send us feedback, suggestions or ideas about the Services, we may use them without restriction, obligation or payment to you. We will not identify you as the source without your consent.

We would like to be able to say that you are a customer. You permit us to use your name and logo, in the form you supply and in accordance with any brand guidelines you give us, to identify you as a customer on our website, in customer lists, in investor and partner materials, and in press and marketing materials.

You can withdraw this permission at any time by writing to us, and we will stop using your name and logo in new materials within 30 days and remove it from our website within a reasonable period.

Using your name and logo does not imply that we endorse your products or services, or that you endorse ours. Neither of us may make a public statement that suggests otherwise, or issue a press release naming the other, without the other’s prior written approval.

We work to keep the Platform available, secure and working correctly, and we monitor it continuously. But we do not promise that the Platform will be uninterrupted, timely, error-free or free of harmful components, or that it will meet your particular requirements.

We may take the Platform or any part of it down for maintenance. Where maintenance is planned, we will give reasonable notice and aim for low-traffic periods. Where it is urgent, we may act without notice and will tell you as soon as we can.

Except as expressly stated in these Terms or in your Merchant Service Agreement, and to the fullest extent the law allows, the Platform and the Services are provided “as is” and “as available”, and we exclude all warranties, conditions and terms that would otherwise be implied by law, including as to satisfactory quality, fitness for a particular purpose, accuracy, title and non-infringement.

Where your Merchant Service Agreement includes a service level or availability commitment, that commitment applies and this clause is read subject to it.

No information or advice given by us or on our behalf, whether spoken or written, creates a warranty.

Nothing in these Terms limits or excludes either party’s liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be limited or excluded under Nigerian law.

Subject to that:

(a) Neither of us is liable to the other for indirect, incidental, special, punitive or consequential loss, or for loss of profit, revenue, income, business, contracts, opportunity, anticipated savings, goodwill or reputation, or for business interruption, or for corruption or loss of data, whether or not it was foreseeable.

(b) Our total liability to you, for all claims arising out of or in connection with these Terms, the Platform and the Services, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited in aggregate to:

(i) the total fees you paid us in the 3 months before the event giving rise to the claim;

(c) That cap does not apply to our obligation to settle funds due to you, which is a debt and is payable in full, calculated after applying any amount we are entitled to recover, retain, withhold or set off; nor to our gross negligence or wilful misconduct; nor to fraud; nor to misappropriation of your funds; nor to a breach by us of our confidentiality or data protection obligations.

(d) Your liability to us is subject to the same aggregate cap, except in respect of: chargebacks, refunds, chargeback costs and fines; amounts due under the indemnity in clause 26; your gross negligence or wilful misconduct; fraud; and your breach of confidentiality or data protection obligations, for which your liability is not capped by this clause.

(e) Neither of us is liable for the acts or omissions of a third party that is not acting on its instructions, except that this does not limit your liability for chargebacks, refunds, chargeback costs or fines arising from transactions on your account.

(f) Where you have a signed Merchant Service Agreement, its limitation of liability applies to the Services covered by it, in place of this clause.

We are not liable for loss you suffer because of an event outside our reasonable control, including failure of a bank, card scheme, switch, NIBSS, telecommunications or internet provider, power failure, industrial action, epidemic, act of government or regulator, civil unrest, or natural disaster. Where such an event occurs we will tell you and work to restore service.

You will indemnify us, our affiliates and our respective officers, employees and agents against all losses, damages, liabilities, fines, costs and expenses (including reasonable legal costs) arising out of or in connection with:

• your breach of these Terms or any Related Document;

• any claim by your customer, or by any third party, relating to the goods or services you sell, your marketing, or your handling of a transaction, refund or dispute;

• any claim that your content, platform, trade marks or the goods or services you sell infringe a third party’s intellectual property or other rights;

• your breach of applicable law, including data protection and consumer protection law; and

• chargebacks, refunds, fines, penalties and assessments arising from transactions on your account.

We will tell you promptly of a claim we expect you to indemnify, let you take over its defence if you confirm in writing that the indemnity applies, and not settle it without your consent. You will not settle a claim in a way that admits fault on our part, imposes an obligation on us, or affects our relationship with a regulator or card scheme, without our written consent. We may participate in the defence at our own cost.

If something goes wrong, tell us and we will try to fix it.

• First contact: hi@budpay.com, or through the dashboard support channel.

• Compliance, onboarding and acceptable use: compliance@budpay.com.

• Escalation and complaints: hi@budpay.com.

• Fraud: frauddesk@budpay.com.

• Data protection: dataprotection@budpay.com, for the attention of our Data Protection Officer.

• Telephone: +234 803 449 2604.

• Post: 21 Fatai Idowu Arobieke Street, Lekki Phase 1, Lagos.

We will acknowledge your complaint and resolve it within the timescales required by the Central Bank of Nigeria’s consumer protection rules. If we need longer, we will tell you why and how long we expect to take.

If a dispute arises between us, we will each try in good faith to resolve it by discussion, and each of us will escalate it internally to someone with authority to settle it.

If we cannot resolve it within 30 days, the dispute will be referred to arbitration before a sole arbitrator appointed by written agreement between us, under the Arbitration and Mediation Act 2023. The seat and venue will be Lagos, Nigeria and the language will be English. Each of us bears its own costs of the arbitration, and the arbitrator’s award is final and binding.

Where you have a signed Merchant Service Agreement containing a dispute resolution clause, that clause applies to disputes about the Services and prevails over this clause.

Nothing in this clause stops either of us from applying to a court for urgent injunctive or interim relief, or stops us from pursuing recovery of an undisputed debt.

To the extent the law permits, each of us brings claims in its own capacity and not as a claimant or class member in a class or representative action. Where the law does not permit that restriction, it does not apply.

Assignment. You may not assign or transfer your rights or obligations under these Terms without our written consent. We may assign or transfer ours to an affiliate, or in connection with a merger, reorganisation, financing or sale of our business or assets, and we will tell you if we do. We may also subcontract performance, and we remain responsible to you for anything a subcontractor does.

Notices. We will send notices to the email address registered on your account, or post them in the dashboard or in our app. You should send notices to the relevant address in clause 27. A notice is treated as received on the day it is sent if sent on a business day, and otherwise on the next business day. Keep your registered email address current — a notice we send to it is effective even if you no longer monitor it.

Entire agreement. These Terms, together with the Related Documents, are the whole agreement between us about the Platform and the Services, and replace anything said or written before. Neither of us relies on any statement not set out in them. This does not limit liability for fraud.

Waiver. If we do not enforce a right, that is not a waiver of it, and we may still enforce it later.

Severance. If a provision is held to be invalid or unenforceable, it is severed to the minimum extent necessary and the rest of these Terms continue in force.

Third parties. Except as stated in Schedule A, no one other than you and us has any right to enforce these Terms.

Electronic communications. Agreements, notices, disclosures and other communications that we send you electronically satisfy any legal requirement that they be in writing, and you agree to receive them that way.

Language. These Terms are in English. Any translation we provide is for convenience, and the English version governs.

Governing law. These Terms are governed by the laws of the Federal Republic of Nigeria.

These terms apply where you obtain our app from a third-party app store, and are required by those stores. In this Schedule, “Store Provider” means Apple Inc. in respect of the Apple App Store, and Google LLC in respect of Google Play.

1. These Terms are between you and us only. They are not with the Store Provider. We, not the Store Provider, are solely responsible for the app and its content.

2. Store rules also apply. Your licence to use the app is limited to the devices you own or control and is subject to the usage rules of the relevant store, which may be more restrictive than these Terms.

3. Maintenance and support. We are solely responsible for support and maintenance of the app. The Store Provider has no obligation to provide any.

4. Warranty. To the maximum extent permitted by law, the Store Provider gives no warranty in relation to the app. If the app fails to conform to any applicable warranty, you may notify the Store Provider, which may refund the purchase price (if any). Beyond that, the Store Provider has no warranty obligation, and any other claim, loss, liability, damage, cost or expense attributable to a failure to conform to a warranty is our responsibility.

5. Product claims. We, not the Store Provider, are responsible for addressing any claim by you or a third party relating to the app or your use of it, including product liability claims, claims that the app fails to conform to a legal or regulatory requirement, and claims under consumer protection or privacy law.

6. Intellectual property claims. If a third party claims that the app or your use of it infringes its intellectual property rights, we, not the Store Provider, are responsible for the investigation, defence, settlement and discharge of that claim.

7. Legal compliance. You confirm that you are not located in a country subject to an embargo or designated as a terrorist-supporting country by the relevant authorities, and that you are not on any restricted or prohibited party list.

8. Third-party beneficiary. The Store Provider and its subsidiaries are third-party beneficiaries of this Schedule and may enforce it against you.

9. Contact. Questions, complaints and support requests about the app should be sent to hi@budpay.com.

In providing certain Services, including foreign virtual account, international payout, foreign exchange, payment processing and other specialised services, BUDPAY may engage or partner with third party service providers, financial institutions, payment processors or other regulated entities (each, a “Third Party Service Provider”).

Where a Service is provided through or facilitated by a Third Party Service Provider, the Merchant acknowledges and agrees that the applicable Service may be subject to the terms, conditions, policies and requirements of such Third Party Service Provider, as communicated or made available to the Merchant from time to time. Such terms may be incorporated into these Terms by reference where applicable.

The Merchant agrees to comply with all applicable requirements of the relevant Third Party Service Provider and acknowledges that BUDPAY does not control the systems, platforms or services operated by such Third Party Service Provider. Any suspension, restriction, withdrawal or termination of services by a Third Party Service Provider, including as a result of the Merchant’s breach of the applicable third party terms or regulatory requirements, may result in the corresponding suspension, restriction or termination of the affected Services.

BUDPAY may replace, add or remove Third Party Service Providers where reasonably necessary for the provision, continuity or compliance of the Services.