Last updated 2026-10-19 · CrossaPay Limited (Near National Investment Bank - Osu Branch, Close to North Ridge, Accra, Ghana)
1. Who we are
CrossaPay Limited of Near National Investment Bank - Osu Branch, Close to North Ridge, Accra, Ghana (“CrossaPay”, “we”, “us”) is responsible for the personal data described in this policy. It applies to our website, your CrossaPay account and every transfer you make. We handle personal data in line with Ghana’s Data Protection Act, 2012 (Act 843) and the Nigeria Data Protection Act, 2023.
2. What we collect
Information you give us
- Account details: your name, email address, mobile number, country, and your acceptance of our Terms. Your password is stored only as a one-way hash — nobody at CrossaPay can see it.
- Identity verification (when you complete it): document type, issuing country, the last four characters of the document number and your date of birth. We don’t store full document numbers.
- Recipients: the names and bank account or mobile money numbers of the people you send money to. Account numbers are stored encrypted.
- Payments: the mobile money number and network you pay from (Ghana), and the amounts you pay.
- Support: messages you send us through the contact form or support tickets.
Information we collect automatically
- Security data: sign-in times, IP address, browser and device type, and active sessions — used to protect your account.
- Country suggestion: when you sign up, we pre-select your country from the country our hosting provider detects for your connection, or from your device’s time zone and language. It’s only a suggestion; we keep the country you choose.
Information from others
- Our payment partner, Flutterwave: whether payments, payouts and refunds succeeded, their references, and — when you add a bank recipient — the name registered to that account.
- Our own checks: results of fraud and compliance checks on your transfers.
When you add a recipient, you give us their details. Please let them know you are sharing their details with us to send them money.
3. Why we use it, and our legal basis
- To provide the service you ask for — opening your account, quoting, collecting your payment, paying your recipient, receipts and support (to perform our contract with you).
- To meet our legal duties — knowing our customers, monitoring for fraud, money laundering, terrorist financing and sanctions breaches, keeping records and reporting to authorities when required (legal obligation).
- To keep CrossaPay and your account safe — detecting suspicious sign-ins and transfers, and preventing misuse (our legitimate interests).
- To tell you about our products — only if you opt in. You can switch this off at any time in Profile → Notifications (consent).
4. Automated checks
Every transfer is checked automatically against fraud and compliance rules — for example its amount, your recent activity and whether the recipient’s account is used by many senders. A transfer that fails these checks may be held or refused. A held transfer is always reviewed by a member of our team, and you can ask us to explain or reconsider a decision by contacting us.
5. Who we share it with
We never sell your personal data. We share it only when we need to:
- Flutterwave, our payment partner, which processes your payment and pays your recipient. It receives your name, contact details, payment details and your recipient’s details.
- Service providers that run CrossaPay for us — website and database hosting, and email delivery. They may use your data only to provide their service to us.
- Authorities — regulators, law enforcement, courts and financial intelligence units — when the law requires it.
- Professional advisers such as auditors and lawyers, under a duty of confidentiality.
- A new owner if our business is sold or merged, in which case this policy continues to protect your data.
6. Transfers outside Ghana and Nigeria
Some of our service providers process data in other countries. When that happens we take the steps the law requires to keep your data protected, such as contracts with data-protection safeguards.
7. How long we keep it
- Transfer, payment and identity records: for at least five years after the transfer or the end of our relationship, as anti-money-laundering laws in Ghana and Nigeria require.
- Account details: while your account is open, then for as long as we must keep the records above.
- Support messages and security logs: only as long as needed to help you, protect accounts and meet our legal duties.
When we no longer need personal data, we delete it or make it anonymous.
8. How we protect it
- Passwords are stored as one-way hashes; recipient account numbers and two-step sign-in secrets are encrypted.
- Connections to CrossaPay are encrypted, and sign-in cookies are protected against theft.
- Staff can see only what their role needs, must use two-step sign-in, and their actions are recorded in an audit log.
- You can protect your account further by turning on two-step sign-in and signing out of devices you don’t recognise (Profile → Security).
No system is completely secure. If a breach puts your data at risk, we will tell you and the relevant authorities as the law requires.
9. Cookies
CrossaPay uses one essential cookie that keeps you signed in. It’s needed for the website to work, so it doesn’t require consent. We don’t use advertising or analytics cookies, and we don’t track you on other websites.
10. Your rights
You have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data — we will, except where the law requires us to keep it (see section 7);
- object to, or ask us to restrict, how we use your data;
- receive your data in a commonly used format, or ask us to send it to another organisation;
- withdraw your consent to marketing at any time.
To use any of these rights, email support@crossapay.com, or open a ticket from Support in your CrossaPay dashboard. We may need to confirm your identity first, and we will reply within the time the law allows. If you’re not happy with how we handle your data, you can complain to the Data Protection Commission (Ghana) or the Nigeria Data Protection Commission.
11. Children
CrossaPay is only for people aged 18 and over. We don’t knowingly collect data about children.
12. Changes to this policy
We will tell you about important changes before they take effect. The date at the top shows when this policy was last updated.
13. Contact us
For any question about your personal data, email support@crossapay.com, or open a ticket from Support in your CrossaPay dashboard. See also our Terms and Conditions.