Data Privacy Policy

A. Consent

You accept the terms of this privacy policy when you access our platforms and give your consent upon such access, when you use the services offered on our website and digital platform, or when you visit any of our offices and submit your data for official or non-official purposes.

B. What Personal Data Do We Collect?

We collect Personal Data about you when you use the services offered on our website and digital platform, including the following:

1. Sign-up / Onboarding Information:

When you register to use the services offered on our digital platform, we will collect Personal Data as necessary to offer and fulfill the service you request. Depending on the service you choose, in line with regulatory requirements for Know Your Customer (KYC) purposes, we may require that you provide us with your name, gender, birthday, facial photo, residential address, ID information (photo, number), utility bill, email address, mobile number, social media handles, and debit/credit card details to create an account. We will also require your NIN and/or your BVN in line with regulation and in furtherance of our KYC computation processes.

• We may also require you to provide additional, necessary personal details as you use our services.

C. Transaction Information

When you use our platform for loans, money transfers, purchases, bill payments, or cash deposits and withdrawals, we collect transaction-related information and other necessary data to provide the services. This includes loan details, amounts sent/received, merchant info, and device/location data.

We may verify your identity with third parties, including your listed contact person, but their information will only be used for identity verification and emergency purposes. Loan details will not be shared with your contacts.

We also gather device data for credit scoring, including device make, model, and operating system. Additional information may be collected from third-party sources, like credit bureaus.

By using our services, you consent to this data collection, processing, and use of this data as described.

D. Participant Personal Data

When you use our services, we may collect Personal Data about the other participants associated with the transaction, including your phone contacts with your consent, so you can easily transact with your friends and contacts and enable instant messaging (IM). We collect Personal Data such as name and financial account information about the participant who is receiving money from (or sending money to) you when you send or receive money through the Services.

E. Image Information

We may collect your image (upload, storage, and use) information to support account opening, such as uploading your portrait. We may also collect information from your images when you use our customer support to upload evidence such as statements and checks. In addition, we may collect your image information in connection with regulatory KYC purposes.

F. Information from Other Sources

We may collect information from other sources, such as our social media platforms when you reach out to us to lodge a complaint about our services. However, we will only ask for information relevant to the help required of us to you.

G. Other Information We Collect Related to Your Use of Our Website or Services

We may collect additional information from or about you when you communicate with us, contact our customer support, respond to a survey, or use functionality offered by third-party service providers through our Platform. For instance, when you initiate third-party applications through the Nomase mobile application platform, with your prior consent, your SMS may be collected and monitored to help third-party service providers reduce risks associated with your application through the relevant model/system to provide customized services.

H. When You Apply for a Job with Us

We may request Personal Data about your education, employment, and state of health. As part of your application, you will be asked to provide your express consent to our use of this information to assess your application and any monitoring activities which may be required of us under applicable laws as an employer. We may also carry out screening checks (including reference, background, and criminal record checks). We may exchange your Personal Data with academic institutions, recruiters, health maintenance organizations, law enforcement agencies, your referees, and your previous employers without your consent to process your application for possible positions with us.

I. We Do Not Collect the Information of Minors

If you are under the age of 18, you are not eligible to use the service offered on our digital platform.

3. How Do We Retain Personal Data?

We retain Personal Data in an identifiable format only for as long as required for our business purposes, with specific reference to the service rendered to you, and to fulfill our legal or regulatory obligations. Subject to applicable law, which might, from time to time, oblige us to retain your Personal Data for a certain period of time, we will retain your Personal Data for as long as necessary to fulfill the purposes we collect it for, including the purposes of satisfying any legal, accounting, or reporting obligations.

As a regulated financial institution, we will keep your personal information for ten (10) years following the termination of the relationship or for as long as necessary per regulatory requirements. Furthermore, in compliance with CBN regulation, transaction documents and data will be kept on file for a minimum of five (5) years.

4. How Do We Process Personal Data?

We collect your personal data to provide you an efficient and secure customer experience. We may process your Personal Data for the following reasons:

• To provide services such as initiate a payment, send or request money, or pay a bill.
• To create an account and authenticate your access to an account.
• To communicate with you about your account.
• To manage risk, fraud, and abuse of our services and prevent you from fraud (by developing and adopting measures of verifying your identity). Our risk and fraud tools use personal data, device information, and geolocation from our Platform that offers services to help detect and prevent fraud and abuse of the services.
• To verify your identity and conduct customer due diligence.
• To maintain and improve our services, website, and our App, including monitoring the usage of our service.
• To review credit or loan eligibility.
• To comply with our legal and regulatory obligations and to enforce the terms of our sites and services, including to comply with all applicable laws and regulations.
• To track information breaches and remediate such identified breaches.
• To resolve disputes and troubleshoot problems.
• With your prior consent.
• To market Nomase products and services.
• To use cookies to provide a targeted display, feature, service, or offer to you.
• To provide you with location-specific functionality like searching nearby agents if you authorize us to access your Geolocation information through the Services.

We will not send unsolicited marketing communications to you by SMS or email if you have not opted in to receive them. Additionally, you may withdraw your consent at any time and free of charge.

5. Sharing Your Personal Data

We may share your Personal Data or other information about you with others for the following reasons:

• With other sister companies/affiliates: We may share your Personal Data with other entities/affiliates/sister companies as necessary to enable the technical service you request, to manage risk through risk model systems, to prevent potentially illegal and fraudulent acts and violations of our policies and agreements, and to help us manage the connectivity of our services.
• With other companies that provide services to us: We may share Personal Data with third-party service providers that perform services and functions at our direction and on our behalf. These third-party service providers may, for example, provide you with services, verify your identity, assist in processing transactions, send you advertisements for our products and services, or provide customer support. Rest assured that we take stringent measures to ensure these third-party service providers implement legally compliant safeguards to protect the security and confidentiality of your Personal Data.
• With unaffiliated third-party service providers: Providers that offer functionality through our Platform, with your prior consent, to help complete the service you request.
• With other financial institutions: We may share Personal Data with other financial institutions that we have partnered with to offer related services, unless your consent extends to other uses. We may also share Personal Data to process transactions and keep your financial information up to date.
• Professional Advisers: We may share Personal Data with our legal, financial, and professional advisors such as lawyers, accountants, auditors, and insurers when required to facilitate services like consultancy, compliance, insurance, accounting, and other similar services.
• With other parties to transactions: When you use the services, such as other users and their service providers. This includes other users you are sending or receiving funds from and their service providers. The information might also include personal data and account information necessary to facilitate the transaction, and personal data to help other participant(s) resolve disputes and detect and prevent fraud.
• Where permitted or required by law: We may share information about you with other parties for Nomase MFB’s business purposes or as permitted or required by law, including: if we need to do so to comply with a court proceeding, other legal process, or an applicable regulation; to law enforcement authorities or other government officials, or other third parties pursuant to a court order or other legal process or requirement applicable to Nomase MFB or an affiliated entity; where we reasonably believe that the disclosure is necessary or appropriate to prevent imminent physical harm or financial loss or in connection with an investigation of suspected (or actual) illegal activity; with credit agencies and data processors for credit reference checks and anti-fraud and compliance purposes – all in accordance with applicable data privacy regulations and laws; to investigate violations of or enforce a user agreement or other legal terms applicable to any service; to protect our property, services, and legal rights; if in the future, we sell or transfer, or consider selling or transferring all or part of Nomase MFB’s business, we will disclose your information to such third party as legally permitted. In the event that we are acquired by, or merged with a third-party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer, disclose, or assign your information in connection with the foregoing events.
• To support our audit, compliance, and corporate governance functions.
• With your consent: We also will share your Personal Data and other information with your consent or direction.

6. How We Use Cookies

Cookies are small files placed on your computer’s hard drive that enable the website to identify your computer as you view different pages. Cookies allow websites and applications to store your preferences in order to present contents, options, or functions that are specific to you. Like most interactive websites, our website uses cookies to enable the tracking of your activity for the duration of a session. Our website uses only encrypted session cookies which are erased either after a predefined timeout period or once the user logs out of the platform and closes the browser. Session cookies do not collect information from the user’s computer. They will typically store information in the form of a session identification that does not personally identify the user. Certain aspects of our website are only available through the use of cookies, so your use of our website may be limited or not possible if you choose to disable or decline cookies. If you choose to decline the cookies, you may simply exit our website.

You can manually disable cookies on your computer and devices or delete existing cookies. Disabling cookies may limit your browsing experience on certain aspects of our website. Nomase MFB does not share cookie information with any other website nor do we sell this data to any third party without your consent.

7. What Are Your Rights?

We would like to make sure that you are fully aware of all your data protection rights. These include the following:

1. Requests to Access, Rectify, or Erase Your Data

• Access Request: As permitted under law and applicable data privacy regulations, you have the right to ask us whether we hold any Personal Data relating to you and, if we do, to be provided with a copy of that Personal Data in electronic form, unless you want to receive it in any other way (for example, a paper copy). In addition, you can ask us for information on how we use your Personal Data, who we share it with, how long we keep it, where it is stored, and other information to help you understand how we use it.
• Rectification Request: You have the right to ask us to correct your Personal Data (including by means of providing a supplementary statement) if it is inaccurate, or to update outdated or incomplete Personal Data without undue delay. Where we cannot correct the Personal Data, we include a note on our files regarding your request to correct your Personal Data.
• Erasure Request: You have the right to ask us to erase your Personal Data if: (i) Your Personal Data are no longer necessary for the purpose(s) they were collected for; (ii) Your Personal Data have been unlawfully processed; (iii) Your Personal Data must be erased to comply with a regulation; (iv) You withdraw your consent for the processing of the Personal Data (and if this is the only basis on which we are processing your Personal Data); (v) You object to the possession, provided there are no overriding legitimate grounds for continued processing, or (vi) You object to processing for direct marketing purposes. If we receive your erasure request, we will also take reasonable steps to inform other data controllers processing the data so they can seek to erase links to or copies of your Personal Data. We may refuse to act on your request to erase your Personal Data if the processing of your Personal Data is necessary: (d) To exercise our right of freedom of expression and information; (e) To comply with the relevant Nigerian laws and regulations; (f) For the performance of a task carried out in the public interest or to exercise some official authority vested in us; (g) To establish, exercise, or defend legal claims; (h) To comply with pertinent legal and regulatory directives. In these cases, we can restrict the processing instead of erasing your Personal Data if requested to do so by you.

2. Requests to Object

You have the right to object at any time to the processing of your Personal Data if we process it based on our legitimate interests. This includes any so-called “profiling”. Our privacy notice informs you when we rely on legitimate interests to process your Personal Data. In these cases, we will stop processing your Personal Data unless we can demonstrate compelling legitimate reasons for continuing the processing. We may reject your request if the processing of your Personal Data is needed to establish, exercise, or defend legal claims. You have the right to object at any time if we process your Personal Data for direct marketing purposes. You may also object at any time to profiling supporting our direct marketing. In such cases, we will stop processing your Personal Data when we receive your objection.

3. Request to Restrict

You have the right to ask us to restrict the processing of your Personal Data if: (a) You contest the accuracy of your Personal Data and we are in the process of verifying the Personal Data we hold; (b) The processing is unlawful and you do not want us to erase your Personal Data; (c) We no longer need your Personal Data for the original purpose(s) of processing, but you need them to establish, exercise, or defend legal claims and you do not want us to delete the Personal Data as a result, or (d) You have objected to processing carried out because of our legitimate interests while we verify if our legitimate grounds override yours. If processing is restricted, we may process your Personal Data (excepting for storage purposes) only: (e) If you have given us your consent; (f) For establishing, exercising, or defending legal claims; (g) For protecting the rights of another natural or legal person, or (h) For reasons of important public interest as defined under the NDPA and relevant Nigerian laws; (i) To comply with pertinent legal and regulatory directives. Once processing is restricted following your request, we will inform you before we lift the restriction.

4. Requests for Portability

If our processing is performed by computer and is necessary to fulfill a contract with you, or is based on your consent, you have the right to: (a) Receive any Personal Data you have provided to us in a structured, commonly used, and machine-readable electronic format; (b) Send your Personal Data to another organization or have us do so for you if it is technically feasible for us to do so. If your request relates to a set of Personal Data that also concerns other individuals, we may restrict the transfer to only the portion relevant to you, unless you establish that you have also obtained their consent.

5. Requests to Object to Automated Decisions

Generally, you have the right to object to any legal decision concerning you or which otherwise significantly affects you if this is based solely on the automated processing of your Personal Data. This includes automated decisions based on profiling. In such instances, you may undertake a legal process to prevent or advance your rights. Otherwise, we may refuse your request regarding such automated decisions where: (a) Necessary to enter into a contract with you, or for the performance of your contract with us; (b) Permitted by regulations, or (c) Based on your explicit consent. Our actions on the automated processing involving your sensitive Personal Data (where you have given your explicit consent or the processing is necessary for reasons of substantial public interest) are in complete compliance with the NDPA and relevant laws.

6. The Right to Lodge a Complaint

You have the right to lodge a complaint with the National Information Technology Development Agency (NITDA) or other relevant authorities.

7. The Right to Withdraw Consent

Where we have obtained your consent to process your personal data, or consent to send you information, you may withdraw your consent at any time and we will cease to carry out the particular activity consented to, unless we consider that there is an alternative reason to justify our continued processing of your data for this purpose, in which case we will inform you of this condition.

8. How Do We Protect Your Personal Data?

Security: Nomase MFB implements and maintains appropriate technical, physical, and administrative security measures designed to provide reasonable protection for your Personal Data against loss, misuse, unauthorized access, disclosure, and alteration.

Confidentiality: Your Personal Data is regarded as confidential and will not be divulged to any third party, except under legal and/or regulatory conditions. You have the right to request sight of, and copies of, any and all information we keep on you, if such requests are made in compliance with the Freedom of Information Act and other relevant enactments.

While we are dedicated to securing our systems and services and safeguarding the information entrusted to us, we cannot ensure the absolute security of the information you transmit to us via the Internet or electronic communication or when you use our electronic services. Your role in fulfilling confidentiality duties includes, but is not limited to, adopting and enforcing appropriate security measures such as securing and maintaining the privacy of your password(s) and account/profile registration information, adherence to physical security protocols on our premises, and verifying that the Personal Data we maintain of you is accurate and current. We will inform you of any breaches which may affect your Personal Data. When you use any of your Accounts, we implore you to always use strong passwords (a combination of letters, numbers, upper and lower cases, and special characters), enable two-factor authentication on your Accounts, ensure you do not share your password with anyone, and ensure that your login credentials are kept confidential at all times.

9. Remedies for Violation and Timeframe for Remedy

In the event of a violation of this policy, our Data Protection Officer shall within 7 days redress the violation. Where the violation pertains to the disclosure of your Personal Data without your consent, such information shall be retracted immediately, and confirmation of the retraction sent to you within 48 hours of the redress.

10. Governing Law

This Privacy Policy is made according to the Nigeria Data Protection Act (2023) or any other relevant Nigerian laws, regulations, or international conventions applicable to Nigeria.

11. Changes to Our Privacy Policy

We may update this Privacy Policy from time to time on an ad-hoc basis to reflect our current privacy practices as well as the legal, regulatory, and operating environment, and such revised versions will automatically become applicable to you. We will notify you of any material changes to this Policy with prominent notice as appropriate under the circumstances. We may notify you by posting a prominent notice on our website, or send you an email or device notification, prior to the change becoming effective. The revised Privacy Policy will be effective as of the published updated date.

12. How Does Your Personal Data Move Globally?

Our operations are supported by a network of computers, cloud-based services, and other infrastructure and information technology. Your Personal Data will be stored in Nigeria where we are providing services to you, except where you provide your consent for your Personal Data to be processed outside Nigeria to enable us to process your transactions. Data are stored with appropriate encryption methods and security standards. We will protect your information as prescribed in this Privacy Policy if your Personal Data is transferred out of Nigeria. By using our Platform and Services, you consent to your Personal Data being transferred out of Nigeria to a jurisdiction which has adequate data protection laws as prescribed in the NDPA.

13. Our Contact

If you have any general questions or concerns about this Privacy Policy or the way in which we handle your Personal Data, kindly contact us via the channels below and we will respond to your complaint, request, or enquiry within 48 hours:

Nomase Microfinance Bank Limited, 82, Egbeda-Idimu Road, Egbeda, Lagos. info@nomasebank.com 08068965846