Privacy Notice

Effective Date: 13 December 2022

1. Who we are

We are a financial technology company incorporated in Nigeria and carrying on business at 75, Olonode Street, Yaba, Lagos State.

2. About the Privacy Notice

This Privacy Notice explains how Crednet Technologies Limited. ("CredPal”, “we”, “us”, or “our”) processes users’ Personal Information—that is, information that identifies or can identify our website visitors, application users, business partners, recipients of marketing communications, end-users of our solutions, and event attendees ("you" or "your").

We understand that the information you provide to us is very important. We have therefore written this Privacy Notice to (x) detail your rights as a data subject under applicable data protection laws; (y) reiterate our commitment to protect your Personal Information; and (z) to explain how we process or use every shred of data you share with us when you visit, interact with, or use our website (accessible at credpal.com), mobile application (available for download on Google Play Store and Apple App Store) (collectively, our " Online Channels"); or when you visit, interact with or use any of our offices, sales, marketing and other offline activities (our "Offline Channels"); and when you purchase and use products and services (that have been requested by you or deployed by one of our business customers, such as your employer or service provider (our "Services").

3. The Personal Information We Collect About You

The Personal Information that we collect generally falls into the following categories:

3.1 Personal Information you voluntarily provide via our Online and Offline Channels

We collect Personal Information when you provide it directly to us at the point of requesting or during the course of the use of any of our products or Services. So when you sign up to use, order or request information about our products or Services, participate in a CredPal program or promotion, subscribe to marketing communications, or request support, you may be asked to supply your Personal Information to facilitate the delivery of the specific product(s) or Services.

Particularly, we may collect information to facilitate card issuance, account opening and monitoring, fraud prevention, general risk management, and customer relations. This information may include your name, password, email address, location information, phone number, date of birth, gender, Bank Verification Number, National Identification Number, permanent residential address, phone contact, personal account number, country of residence, passport number, and other national ID numbers, employment details (for example, the organization you work for, your job title) .etc.

Government-issued means of identification could be uploaded as a png or jpeg image on our App.

In the course of our business relationship with you—for instance, when requesting a loan from CredPal—we may collect information regarding your workplace (including the name, size and location of the company you work for and your role within the company), billing address and payment details (e.g, credit/debit cards, bank details, and other information required for billing and fraud prevention); family and friends information (such as details about your next of kin and beneficiaries); information concerning lifestyle and economic circumstances; employment details; financial details; and (z) other personal information when you reach out to us through the Contact Us form on our website, communicate with us over the phone, or via email and other electronic means to initiate a business relationship, make general enquiries, or file a complaint about our Services. Additionally, we may request access to your phone contacts for when you request to purchase airtime either for self use or a third party. We may also keep a record of our correspondence with you in order to assist you in the future.

Finally, we may also collect Personal Information from you offline, such as call recording and chat transcript data when you contact our sales and customer representative teams or contact information when you attend or participate at any of our events or webinars.

3.2 Personal Information automatically collected when you use our Online Channels

When you visit or use our Online Channels, we may automatically collect certain information about your device. These may include information captured by web beacons and cookies technologies we deploy, computer and connection information (e.g. browser plug-in types, versions, time zone setting, and operating systems, device information (e.g. device brand and model, screen dimensions, etc.), unique identification numbers (e.g. Internet Protocol address and device ID), browser information (e.g. URL, browser type, pages visited, date/time of access). Primarily, we collect this information to improve our website and applications’ user interface and experience.

During your visits, we may also use tools such as JavaScript to measure and collect session information including page response times, download errors, length of visits to certain pages, and page interaction information. We may also collect technical information to help us identify your device for fraud prevention and diagnostic purposes.

3.3 Personal Information we collect from third parties and affiliated entities

We may obtain your Personal Information from third-party services and organizations (such as entities we use for customer identification validation and account details verification), agencies, such as credit reference, debt collection, fraud prevention, and government agencies, or from third-party sources such as publicly available databases. We may also collect your Personal Information from our Online Channels partners, such as third-party web analytics services, including Google Analytics, which collect data (such as website usage) in connection with our Online Channels and help us evaluate your use of and interaction with our Online Channels. (You may learn about Google’s advertising features, including Google Analytics currently available opt-out mechanisms, here.)

By accepting the CredPal privacy terms, you have given consent to the collection and processing of your personal information for legitimate business purposes, including but not limited to determining your creditworthiness. Additionally, you attest that all the information you have provided is accurate and true, and you hereby grant CredPal and Pngme permission to check the accuracy of the information you have provided and conduct any necessary research on it using the references you have given and any other reliable sources.

You hereby grant Pngme and CredPal permission to process any personal information and records relating to you that may be obtained from third parties for this purpose, including government agencies, your employer, credit bureaus, business partners, and other entities Pngme may deem appropriate and sufficient in the conduct of your business, sensitive or otherwise.

You also acknowledge that regardless of whether your credit score is established or the loan is approved, Pngme may use and communicate with this application, all supporting papers, and any additional information related to it. You also expressly and irrevocably consent to CredPal and Pngme disclosing any information about you to any bank, affiliate, or other financial institution. You expressly consent to the following disclosures of your basic credit information: 1) on a regular basis; 2) to other lenders and fully authorized credit reporting agencies; and 3) to recipients of your basic credit information.

All of these terms apply only when PngMe is given authorization.

4. How We Use Your Personal Information

We may use the Personal Information collected from you to:

• design and improve our products, services and marketing;
• assess you for products and services and enable us to provide and operate them;
• manage our business, including our human resources, and comply with our internal policies;
• exercise our rights under contracts with you, including collecting any amounts due from you;
• conduct verification or credit checks and reviews on you, obtain or provide credit references or detect fraudulent applications;
• provide you with marketing information (you may opt-out by clicking the “unsubscribe” button in our emails or by contacting us);
• comply with compulsory or voluntary requirements that we have such as legal, tax, regulatory, sanctions or market requirements in Nigeria and overseas;
• comply with requests made by different bodies or authorities such as legal, regulatory, law enforcement, government and tax authorities in Nigeria and overseas;
• monitor, prevent and detect fraud, enhance our systems’ security, monitor and verify identity or access, and combat spam or other malware or security risks;
• meet legal requirements, including complying with court orders, valid discovery requests, valid subpoenas, and other appropriate legal mechanisms; and
• fulfil other purposes disclosed at the time you provide Personal Information or otherwise where we are legally permitted or are required to do so.

Where we need to process your Personal Information for additional purposes that we have not identified at the time of collection, we will obtain your consent for these additional uses to the extent required by applicable law.

5. Legal Bases for Processing Your Personal Information

We at CredPal process your Personal Information in accordance with privacy and data protection laws, and always only where at least one of the following legal bases applies:

• where you have given us consent to process your Personal Information. Please note that by continuing to use our website, you consent to the processing of your Personal Information in accordance with this Privacy Notice; or
• where it is necessary to process your Personal Information to perform a contract or provide a Service, which you have requested; or
• where it is necessary to respond to a lawful request from law enforcement or regulatory authority, body or agency; in the defence of legal claims or in order to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, or violations of any of our website’s or application’s terms; or
• where we have a legitimate interest, for instance, to aid: (x) our auditing, reporting, corporate governance, and internal operations; (y) audits and assessments of our operations, privacy, security and financial controls, risk, and compliance with legal obligations; (z) our general business, accounting, record keeping and legal functions; and (xx) any actual or contemplated merger, acquisition, asset sale or transfer, financing, bankruptcy or restructuring of all or part of our business; or
• where it is necessary to protect an interest which is essential for your life, health and bodily safety; or
• where it is necessary for the performance of a task carried out in the public interest or in order to fulfil a public mandate imposed on us.

6. Your Rights Under the Nigeria Data Protection Regulation

As a data subject, the law vests you with the following rights:

1. Right to withdraw your consent to data processing;
2. Right to transfer data we hold about to you to a third party;
3. Right to request for the deletion of your data from our systems;
4. Right to have the data we hold about you sent to you in an electronic format;
5. Right to restrict and object to the processing of your data in certain circumstances;
6. Right to rectify data we hold about you where you believe such data to be incomplete or inaccurate; and
7. Right to lodge a complaint with a relevant authority, where you have reason to believe that we have violated the term(s) of this Privacy Notice.

You may seek to exercise any of the above rights at any time by sending us an email at dpo@credpal.com or by sending a post to the postal address provided below.

7. Sharing Your Personal Information with Third Parties

Upon the initiation or completion of any transaction and for the provision of any product or Services which you may have requested or authorized, we may share your Personal Information with our financial partners and providers of reward, co-branding or loyalty programs, third parties who provide services to us—such as our hosting service provider—or those with whom you have consented to us sharing your information, or any person who you hold a joint account with, people who can give instructions for you, or anyone who may give security for your loans. We may also share your Personal Information with our agents, business partners, financiers and underwriters etc., where necessary for the discharge of an obligation; in order to fulfil any legal requirements, or in order to administer or enforce customer agreements and applicable terms and policies. When we share your Personal Information with third parties, we require them to enter into a Third-Party Data Processing Contract with us that mandates them to process the Personal Information we transfer to them in a manner that is consistent with this Privacy Notice, the Nigeria Data Protection Regulations and other relevant laws.

8. Transfer Across Borders

For operational expediency, we may transmit, store, or process your data to a location outside Nigeria. When we do this, we take all reasonable measures to ensure that such transfers comply with applicable laws. If necessary, we will ask the party to whom we transfer your personal information to agree to our privacy principles, associated policies and practices. Note that we primarily rely on your consent to transfer your data across borders; thus, by using our website or mobile application, you understand and agree that your information may be transferred to and stored on servers located outside Nigeria.

9. Retaining Your Personal Information

We will retain your Personal Information as long as your account with us is active or for longer, as may be required for legal, accounting, tax, or compliance purposes. We may also retain your Personal Information where there is an outstanding obligation due to you from us (or vice versa) or where we reasonably believe that there is a prospect of litigation in respect to our relationship with you.

10. Cookies and Similar Technologies

We use cookies, Pixel tags, Local Shared Objects, and similar technologies to provide the best possible experience for our users. These technologies help us gather usage statistics, provide essential functionality and improve site performance, and offer a more personalized experience when using our Online Channels, to guarantee a smooth and secure user experience, and to enable the efficient operation of our Online Channels. By using our Online Channels, you consent to our use of cookies and similar technologies.

For your information, cookies are small bits of information that are stored by your computer’s web browser. They include a unique identifier that is used to recognize you when you visit or use our website and mobile application. Pixel tags are very small images or small pieces of data embedded in images, also known as “web beacons” or “clear GIFs,” that can recognize cookies, the time and date a page is viewed, a description of the page where the pixel tag is placed, and similar information from your computer or device. Local Shared Objects (sometimes referred to as “Flash Cookies”) are similar to standard cookies except that they can be larger and are downloaded to a computer or mobile device by the Adobe Flash media player.

To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.aboutcookies.org or www.allaboutcookies.org. You may also adjust your browser settings to automatically refuse cookies or to delete already accepted cookies. Note however that disabling cookies—especially functional cookies—may affect the functionality of our website.

11. Data Security

To protect your data from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction, we at CredPal employ reasonable physical, administrative, and technical measures, including but not limited to: (x) strict implementation of information security policies; (y) use of secured servers and firewalls; and (z) encryption on computing devices. However, note that no data storage system can be guaranteed to be 100 percent secure, and the nature of the Internet and public networks makes it impossible to completely guarantee the security of data transmitted via the Internet, so we encourage you to also employ due diligence and care when providing your Personal Information to us via our Online Channels.

12. General Information

Please note that CredPal’s products and services are not intended for children under the age of 18. If we learn that information has been submitted, or that we have collected Personal Information, from a person under the age of 18, we will take immediate steps to delete such information. However, we may collect or process Personal Information of any child, where permitted by law. For instance, we may collect Personal Information about a child from a parent or guardian directly, and usually with the child’s explicit consent. If you believe that we are collecting or processing a child’s information inappropriately, please contact our Data Protection Officer.

For your convenience and information, please note that our websites or applications may contain links to other third-party websites or applications that are not owned or controlled by CredPal. As these platforms operate independently from CredPal, we advise that you review the privacy notices of these third parties before submitting your information or data, as our Privacy Notice will not cover your interactions with these platforms who may have a different approach to data protection.

This Privacy Notice does not cover job applicants and candidates who apply for employment at CredPal, or to employees and non-employee workers, whose Personal Information is subject to different privacy notices which are provided to such individuals in the context of their employment or working relationship with us.

We at CredPal take reasonable measures to ensure that the data we hold about you is complete, accurate, and represents the true state of your affairs at every relevant point in time. Please inform us if your Personal Information changes during the course of your relationship with us.

In line with the principle of data minimization, we always aim to collect the minimum amount of Personal Information necessary to fulfil our objectives.

13. Changes to Our Privacy Notice

This Privacy Notice was last updated on 13 December 2022. We may update this Privacy Notice from time to time. When we update the Notice, we will revise the “Effective Date” date above and may notify you of the new Privacy Notice either by sending you an email or by placing a prominent notice on our Online Channels.

14. Contact Us

If you have questions or comments about our data protection practices, or if you would like help exercising any of your data subject rights, please contact our Data Protection Officer. You may contact us using the following information:

Full name of legal entity: Crednet Technologies Limited

Name of Data Protection Officer: Olushola Sunday

Email address: dpo@credpal.com