Trust Center · the page your buyers read
The colour of the block is the basis, not the framework.
Certified, independently examined, self-assessed, still under way — four different things, and a page that renders them the same way is making its weakest claim look like its strongest. Here they cannot be confused at a glance.
How LagosPay handles personal data
Generated from the registers we keep for the Commission rather than written for this page — so it says what those registers say, including where that is uncomfortable.
Two certified, two independently examined, one self-assessed, one still under way and claiming nothing yet. Certified means a body that can take it away issued it. Self-assessed is all anyone can do for GDPR — no certificate exists for it.
Who we are
PublishedLagosPay Limited, RC 1544019, registered with the Commission.
Who to contact
PublishedTunde Adeyemi is the data protection officer. Write to dpo@lagospay.ng.
What we do with personal data
Published12 activities are on the register, each with the lawful basis it rests on.
Where the data lives
Published4 transfers leave Nigeria, each listed with the mechanism it rests on.
Who else touches it
Published9 suppliers see personal data, all named.
How it is protected
Published24 measures are in force, counted from the register rather than described.
When something went wrong
Not publishedNot published. The board has not agreed a wording, and the November incident is the reason — which is the thing a reader would most want to know.
What you can ask us for
PublishedAccess, correction, erasure, objection and portability. Answered without undue delay, which is the standard the Act sets and the only one there is.
Four bases, four treatments
Three of these are not interchangeable, and one of them claims nothing at all
Asiri takes the wording from the assurance behind the claim, then colours the block to match. A reviewer scanning the row sees the basis before they read a word.
A body issued it, and can take it away
An accredited registrar examined you and put a number on it. Scope, number and expiry are all checkable with the issuer.
ISO 27001 · PCI DSS
Somebody reported on you
An independent firm looked and wrote it down, but there is no certificate to hold. The report is the whole of the assurance.
NDPA audit · SOC 2 report
You checked yourself
Which is all anyone can do for GDPR, because no certificate exists for it. Saying so plainly is worth more than implying otherwise.
GDPR · NIST CSF
Claiming nothing yet
An observation window is open and a firm is engaged. Until the report is issued the badge asserts nothing at all, and says so.
SOC 2 · window closes 30 Jun
Updates · written by a person, not generated
Every post opens with the sentence a reviewer would decide on
Not the summary that flatters — the verdict. And each one names the register entries it touches, with the count already in them, which is the thing neither a blog nor a status page can do.
3,100 agents were monitored without being told
This one is our fault, it affected 3,100 people, and it is not yet fixed.
Our anti-fraud system profiles agent behaviour continuously. The onboarding pack does not mention it, no separate notice exists, and none of the forty agents our auditor sampled had heard of it. On that basis all 3,100 are affected.
The monitoring continues in the meantime, because stopping it would leave the network exposed to the fraud it detects. That is a judgement we have made and we accept it is arguable. We are publishing this before the fix rather than after — a disclosure that only appears once it is safe to make is not a disclosure.
What this touches on our register
Kuda Collections declined an audit request, and what we did about it
Your data was not exposed. What we cannot yet show you is what happens to it after we hand it over.
Our auditor asked Kuda Collections for its processing logs, to test what happens to customer records after we pass them on. Kuda declined, citing its own confidentiality obligations. Two audit tests could not be performed at all.
All six erasure requests passed to Kuda in the period were deleted from our systems; we hold written confirmation for none of them. Our contract contains no right of audit — that is the underlying problem rather than their refusal. Our auditor has recorded it as a limitation on their opinion, and we are not asking for it to be softened.
What this touches on our register
Eleven documents, four levels of access
Two of them are named here and will never be sent to you
Listing a document you refuse to share, with the reason, tells a reviewer more than quietly omitting it. And a request is released by the company, never by Asiri — who asked, for what and why becomes part of their audit trail whichever way they decide.
Downloadable now. No request, no NDA.
ISO/IEC 27001 certificate
Certificate · 2 pages · 18 Sep 2024Data processing agreement, template
Agreement · 9 pages · 11 Feb 2026Sub-processor list
Register · generated by Asiri · 2 Jul 2026Ask, and somebody there decides. Usually answered within two working days.
NDPA audit return, 2024
Audit file · 22 pages · includes the qualified opinionDPO report to management, H1 2025
Report · signed by the officerAsk, and sign a mutual non-disclosure agreement first. The agreement is the reason this can be shared at all.
ISO 27001 statement of applicability
Report · 34 pages · names the 2 excluded controlsPCI DSS attestation of compliance
Attestation · 12 pages · signed by the QSAPenetration test summary, Q1 2026
Report · 8 pages · summary onlyNamed here so you know it exists. Not shared outside the company, and the reason is stated rather than left blank.
NDPA audit return, 2025
At review and unsigned — a draft opinion is not an outcomePenetration test, full report
61 pages · names live weaknesses and where they sitWhat Asiri will not do
It will not publish this page on your behalf
Asiri holds every register a trust page needs and could generate one for any company on it. It does not. A trust page is a statement a company chooses to make, and one produced without that choice would be Asiri's claim about them rather than their own.
Visit the address of a company that has not published, and the page says exactly that — then tells you the Act still gives you every right it describes, and to ask them directly.
Every publication is kept
Changes to this page
Supplier list regenerated and the security measures re-counted from the register. The incident section was held back for a board wording.
Added the transfer to the marketing platform in the United States, and the clauses it rests on.
First published, on registration with the Commission.
A page that moves silently underneath you cannot be cited later. This one carries a version, so it can.
Answer the security questionnaire once, in public
Most of what a buyer sends you is already on this page. Send the link, and what comes back is the handful of questions that genuinely need a person — which is a better meeting than the rest of them. Included from Growth up, on your own domain.