Part 1: Data Processing Principles

We are committed to processing personal data in compliance with the NDP Act 2023 principles:

Part 2: Consent of Data Subject

• We obtain consent before processing personal data unless processing is required by law, contract, vital interest, or legitimate interest.
• Consent is freely given, specific, informed, and unambiguous.
• Data subjects may withdraw consent at any time, without affecting the lawfulness of prior processing.

Part 3: Scope of Data Processing

We collect and process personal data from:

• Customers — account holders, loan applicants, depositors, and guarantors.
• Employees & Contractors — for HR, payroll, and compliance.
• Third Parties — vendors, agents, and service providers.

Data categories may include:

• Identification details (Name, NIN, BVN, Passport, Driver's License)
• Contact details (Email, Phone number, Address)
• Financial information (Bank account details, Loan records, Transaction history)
• Employment details (for staff and applicants)
• Sensitive data (biometric information where applicable)

Part 4: Data Subject Rights

In line with the NDP Act 2023 and GAID 2025, Data Subjects have the following rights:

• Right to access your personal data
• Right to rectify inaccurate or incomplete data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing (including marketing communications)
• Right not to be subject to automated decision-making/profiling

Part 5: Data Retention & Security

• Data is retained only as long as necessary to fulfill the purposes for which it was collected or as required by law.
• We employ technical, organizational, and physical safeguards, including encryption, access control, firewalls, and staff training, to prevent unauthorized access, alteration, disclosure, or destruction.

Part 6: Mandatory Data Collection

Certain personal data is mandatory under laws and regulations such as Know Your Customer (KYC), Anti-Money Laundering (AML), and Counter-Terrorism Financing (CTF) requirements. Failure to provide such data may result in our inability to provide services.

Part 7: Transfer to Third Parties

We may share personal data with:

• Regulatory authorities (e.g., NDPC, CBN, NDIC, EFCC, NFIU)
• Credit bureaus and financial institutions
• Service providers engaged for core banking, IT support, payment processing, and debt recovery

All transfers are governed by contracts ensuring confidentiality and compliance.

Part 8: Cookies & Technical Info

• When you use our website or digital platforms, we may collect technical information such as IP address, browser type, and usage patterns.
• Cookies may be used to enhance user experience and analyze web traffic. Users may opt out by adjusting browser settings.

Part 9: Data Security & Integrity

We adopt ISO/IEC 27001-aligned security controls, periodic risk assessments, access restrictions, and incident response measures to preserve confidentiality, availability, and integrity of data.

Part 10: Job Applicants

Personal data provided by job applicants (such as CVs, academic and professional qualifications, references, and any other supporting documents) will be collected and processed solely for recruitment and selection purposes.

We will retain such data only for as long as necessary to complete the recruitment process. Records of unsuccessful applicants will be securely deleted within six (6) months of the recruitment exercise, unless a longer retention period is required by law or with the applicant's express consent.

Successful applicants' data will be incorporated into their employee records and processed in accordance with the Bank's Employee Privacy Policy.