2121
WhatsApp
Online Banking
This Privacy Policy explains how Islamic Bank of Afghanistan IBA collects, uses, shares and protects your personal information when you use the IBA Wallet mobile application (the "App") and its related services, including mobile top-up, wallet-to-wallet transfers, wallet-to-bank-account transfers and bank-account-to-wallet transfers (together, the "Services").
By downloading, registering for or using the App, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the App.
- Who we are
- Information we collect
- Device permissions
- How we use your information
- Legal basis for processing
- How we share your information
- Data retention
- How we protect your information
- Your rights and choices
- Deleting your account and data
- Children's privacy
- International data transfers
- Third-party links and services
- Changes to this policy
- Contact us
1. Who we are
The App is owned and operated by Islamic Bank of Afghanistan, a bank / licensed payment service provider licensed and regulated by Central Bank of Afghanistan, with its registered office at Shar-e-naw. IBA is the controller responsible for the personal information processed through the App.
2. Information we collect
2.1 Information you provide to us
- Registration and identity information: full name, father's name, date of birth, gender, nationality, mobile phone number, email address and residential address.
- Identity verification (KYC) information: national ID / passport number and a copy or photo of the document, and a photograph (selfie) used to confirm that you are the document holder, as required by anti-money-laundering (AML) and know-your-customer (KYC) regulations.
- Security credentials: your PIN or password. These are stored only in encrypted (hashed) form, and IBA staff cannot see them.
- Bank account information: the bank account number(s) you link to your wallet for Account-to-Wallet and Wallet-to-Account transfers.
- Beneficiary information: the name, wallet ID, mobile number or bank account number of people you send money to or top up.
- Communications: information you give us when you contact customer support, submit a complaint or answer a survey.
2.2 Information created when you use the Services
- Transaction information: for every top-up, wallet-to-wallet, wallet-to-account and account-to-wallet transaction, we record the amount, currency, fees, date and time, sender and recipient details, reference number, status and any note you add.
- Wallet information: wallet ID, balance, limits, account status and transaction history.
- Top-up information: the mobile number topped up, the mobile network operator and the top-up amount.
2.3 Information collected automatically
- Device information: device model, operating system and version, unique device identifiers, app version, language settings and mobile network.
- Log and usage information: IP address, login times, failed login attempts, screens visited, and crash and performance logs.
- Location information: approximate or precise location, only if you grant permission. We use it to prevent fraud and to meet regulatory requirements.
2.4 Information from third parties
- IBA's core banking systems, when you link or transfer to or from an IBA bank account.
- Payment switches, other banks and mobile network operators involved in completing your transactions.
- Identity verification providers, sanctions and watch-list screening services, and fraud prevention services.
- Government or regulatory authorities, where the law permits or requires it.
2.5 Information we do not collect
- Biometric data: if you use fingerprint or face unlock, the check happens entirely on your device through the Android operating system. IBA never receives or stores your fingerprint or face data.
- We do not sell your personal information, and we do not use it for third-party advertising.
3. Device permissions
The App may ask for the permissions below. You can refuse or withdraw any permission in your device settings, but some features may then stop working.
| Permission | Why we need it |
|---|---|
| Camera | To photograph your ID document and selfie during identity verification, and to scan QR codes for payments. |
| Contacts (optional) | To help you choose a recipient for a top-up or wallet-to-wallet transfer. We only read the contact you select. We do not upload or store your contact list. |
| Biometric / fingerprint | To let you log in and approve transactions with your device's fingerprint or face unlock. The check is done on your device. |
| Notifications | To alert you about transactions, security events and service updates. |
| Location (optional) | To detect fraud and to comply with regulatory requirements. |
| Internet / network state | To connect securely to IBA servers and process transactions. |
One-time passwords (OTPs) sent by SMS may be filled in automatically using Google's SMS Retriever API. This does not give the App access to your other SMS messages.
4. How we use your information
- To provide the Services: opening and managing your wallet, processing top-ups and transfers, showing your balance and history, and sending receipts.
- To verify your identity: completing KYC checks and confirming that you are the person using the account.
- For security and fraud prevention: authenticating logins, detecting suspicious or unauthorized activity, and protecting your account and our systems.
- To comply with the law: meeting AML, counter-terrorist-financing, sanctions screening, tax and reporting obligations, and responding to lawful requests from authorities.
- For customer support: answering questions, resolving disputes and handling complaints.
- To communicate with you: sending transaction alerts, security notices and important changes to the Services or this policy. We send promotional messages only where the law allows, and you can opt out at any time.
- To improve the App: analysing crash reports and aggregated usage to fix problems and improve performance.
5. Legal basis for processing
Depending on applicable law, we process your personal information on one or more of these grounds:
- Performance of a contract: to provide the wallet services you signed up for.
- Legal obligation: to comply with banking, payment, AML/KYC and tax laws and regulations of Afghanistan.
- Legitimate interests: to keep the Services secure, prevent fraud and improve the App.
- Consent: for optional features such as contacts, location or marketing messages. You may withdraw consent at any time.
6. How we share your information
We share personal information only as needed for the purposes described in this policy:
- Transaction counterparties: when you send money, the recipient may see your name, wallet ID or masked phone number and the transaction reference.
- Banks, payment switches and networks: to process wallet-to-account and account-to-wallet transfers.
- Mobile network operators: the mobile number and amount needed to complete a top-up.
- Service providers: companies that work on our behalf, such as cloud hosting, SMS and push-notification delivery (for example, Google Firebase), identity verification, crash reporting and customer support tools. They must protect your information and may use it only to provide services to IBA.
- Regulators, courts and law enforcement: including central bank, when the law requires it or to protect the rights, property or safety of IBA, our customers or others.
- IBA group companies and auditors: for internal audit, risk management and compliance.
- Corporate transactions: if IBA is involved in a merger, acquisition or sale of assets, subject to the same protections described here.
We do not sell, rent or trade your personal information to third parties for their own marketing.
7. Data retention
We keep your personal information only as long as we need it for the purposes in this policy.
8. How we protect your information
- Data sent between the App and our servers is encrypted with TLS.
- Sensitive data is encrypted when stored, and PINs and passwords are stored only in hashed form.
- We use multi-factor authentication (PIN, OTP and optional biometrics), session timeouts and device binding.
- Access to personal information is limited to authorised staff who need it for their work, and all access is logged.
- We monitor for fraud, run regular security testing and follow applicable banking security standards.
No system is completely secure. To help protect your account, never share your PIN, password or OTP with anyone. IBA will never ask you for your PIN or OTP by phone, SMS, email or social media. If you think your account has been compromised, contact us immediately (see Contact us).
9. Your rights and choices
Subject to applicable law and our regulatory obligations, you have the right to:
- Access the personal information we hold about you.
- Correct information that is inaccurate or incomplete. You can update some details directly in the App.
- Delete your account and personal information (see section 10).
- Withdraw consent for optional processing, such as location, contacts or marketing.
- Object to or restrict certain processing.
- Complain to IBA, or to central bank data protection or consumer protection authority.
To exercise these rights, contact us using the details below. We may need to verify your identity before we act on your request, and we will respond within 30 days.
10. Deleting your account and data
You can request deletion of your IBA Wallet account and associated data at any time by:
- In the App: going to Islamic Bank of Afghanistan in person and delete their account;
Before we close your account, you must withdraw or transfer any remaining wallet balance and settle any pending transactions. Once your account is closed, we delete your personal information. The exception is information we must keep by law, such as KYC and transaction records (see section 7). We keep that information securely, use it only for legal and regulatory purposes, and delete it when the retention period ends.
11. Children's privacy
The App is not intended for anyone under 18 years of age, and we do not knowingly collect personal information from children. If we learn that we have collected information from a child without proper authorisation, we will close the account and delete the information, except where the law requires us to keep it.
12. International data transfers
Your information is mainly stored and processed in Afghanistan. Some service providers, such as cloud, notification or crash-reporting services, may process data in other countries. When this happens, we take appropriate steps to protect your information as described in this policy and as required by applicable law.
13. Third-party links and services
The App may contain links to, or integrations with, third-party websites and services, such as mobile network operators or other banks. We are not responsible for their privacy practices. Please read their privacy policies.
14. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page. If the changes are significant, we will also notify you through the App, by SMS or by email before they take effect. If you keep using the App after the changes take effect, you accept the updated policy.
15. Contact us
If you have questions, requests or complaints about this Privacy Policy or how we handle your personal information, please contact:
Islamic Bank of Afghanistan — Data Protection / Customer Care
Address: Main Branch Shahr-e- ,Malalai Zezhantoon Square, Kabul City, Afghanistan
Email: info@ibafg.af
Phone / Call center: 0794555001
Website: [https://www.ibafg.com/]
