This Privacy Policy explains how Nairafolio (“the Company,” “we,” “our,” or “us”) collects, uses, discloses, and protects your personal data in compliance with the Nigeria Data Protection Regulation (NDPR) and applicable laws of the Federal Republic of Nigeria. By accessing or using our website, mobile application, or related services, you consent to the practices described herein.

1. Information We Collect

1.1 We may collect personal identification information such as your full name, date of birth, address, telephone number, and email address.

1.2 We may also collect financial and regulatory information such as your BVN, bank account details, government-issued identification documents, and transaction records to comply with Know-Your-Customer (KYC) requirements.

1.3 We collect technical and usage data, including IP addresses, device identifiers, login timestamps, browsing behavior, and interactions with our platform.

Additional Clauses:

1.4 Information may be collected directly from you, through automated means (such as cookies or tracking technologies), or from third parties including banks, payment processors, and regulatory authorities.

1.5 Failure to provide requested information may result in limited access to Nairafolio’s services, suspension of transactions, or inability to fulfill contractual obligations.

1.6 All data collected shall be used strictly in accordance with this Policy and relevant legal obligations; we do not engage in unlawful or excessive data collection.

2. Legal Basis for Processing

2.1 We process personal data in order to perform contractual obligations to Clients, including delivering advisory and investment services.

2.2 We also process personal data to comply with applicable Nigerian laws, including anti-money laundering and counter-terrorist financing regulations.

2.3 In certain cases, we rely on your consent (e.g., for marketing communications) or our legitimate interest in improving our services.

2.4 Where consent is the basis of processing, you have the right to withdraw such consent at any time without affecting the lawfulness of prior processing.

2.5 Legitimate interests include service optimization, fraud prevention, risk management, and business continuity, provided such interests do not override your fundamental rights.

2.6 Where data processing is required by law, Nairafolio may retain or disclose personal data regardless of Client consent, subject to the limits imposed by applicable statutes.

3. How We Use Your Information

3.1 To establish and verify your identity and ensure compliance with regulatory requirements.

3.2 To process deposits, withdrawals, and investments, and to deliver advisory or management services.

3.3 To communicate service updates, notifications, and other relevant account information.

3.4 Your data may also be used to improve user experience, enhance platform security, and develop new services tailored to Client needs.

3.5 We may use anonymized and aggregated data for analytical or research purposes, provided such data cannot reasonably be linked to individual users.

3.6 We reserve the right to monitor and analyze transactions in order to detect unusual patterns, prevent fraud, and comply with anti-money laundering obligations.

4. Sharing and Disclosure of Information

4.1 We may share your data with banks, payment processors, custodians, and other financial institutions to facilitate transactions.

4.2 We may disclose your data to regulators such as the Central Bank of Nigeria (CBN), Securities and Exchange Commission (SEC), or law enforcement authorities when legally required.

4.3 We may share your data with third-party service providers that support IT infrastructure, analytics, or customer service operations.

4.4 All third parties engaged by Nairafolio are bound by contractual obligations to maintain confidentiality and apply adequate data protection safeguards.

4.5 Nairafolio shall not sell, rent, or commercially exploit your personal data to third parties for marketing purposes without your express consent.

4.6 In the event of a corporate restructuring, merger, or acquisition, your data may be transferred as part of the business assets, subject to continued protection under this Policy.

5. Data Security

5.1 We adopt industry-standard technical and organizational measures to safeguard personal data against unauthorized access, alteration, or disclosure.

5.2 Security measures include encryption, firewalls, access controls, and periodic vulnerability assessments.

5.3 Access to sensitive information is restricted to authorized employees and agents subject to confidentiality obligations.

5.4 Despite our best efforts, no electronic system is entirely secure. By using our services, you acknowledge that residual risks inherent in internet-based communications may remain.

5.5 In the event of a suspected data breach, Nairafolio will promptly investigate, contain the risk, and notify affected Clients in accordance with NDPR requirements.

5.6 Clients are encouraged to maintain strong passwords, secure their devices, and update login details regularly as part of shared security responsibility.

6. User Rights

6.1 You have the right to request access to your personal data, including copies of the information held about you.

6.2 You have the right to request correction or updating of inaccurate or incomplete personal data.

6.3 You have the right to request erasure of personal data, subject to regulatory and contractual obligations.

6.4 You may object to or restrict certain forms of processing, particularly where based on legitimate interests or direct marketing.

6.5 Requests to exercise these rights must be submitted in writing and may require verification of identity to prevent unauthorized disclosures.

6.6 Nairafolio reserves the right to decline requests that are manifestly unfounded, excessive, or inconsistent with legal requirements, but will provide reasons for such refusals.

7. Data Retention

7.1 Personal data is retained for as long as necessary to fulfill the purposes for which it was collected.

7.2 We may retain certain records for extended periods to comply with legal, regulatory, and tax obligations.

7.3 Once data is no longer required, it shall be securely deleted, anonymized, or archived.

7.4 Regulatory requirements may mandate retention of Client records for a minimum of five (5) to seven (7) years after account closure or transaction completion.

7.5 Secure deletion may involve permanent erasure of digital records, shredding of physical documents, or anonymization techniques that render personal data non-identifiable.

7.6 In cases of ongoing legal disputes, investigations, or audits, Nairafolio may retain relevant data until the matter is fully resolved.

8. International Data Transfers

8.1 Personal data may, in limited circumstances, be transferred outside Nigeria to trusted service providers engaged by Nairafolio.

8.2 Where such transfers occur, Nairafolio shall ensure compliance with NDPR and apply adequate safeguards for data protection.

8.3 Transfers will be limited to jurisdictions that maintain reasonable levels of data protection.

8.4 Clients will be notified in advance where international transfers are material to the operation of their accounts.

8.5 Cross-border transfers shall be restricted to essential functions such as cloud hosting, payment processing, or secure communication systems.

8.6 Nairafolio shall maintain contractual clauses with third parties to ensure that transferred data continues to be handled in accordance with Nigerian standards.

9. Third-Party Services

9.1 The Platform may contain links to third-party websites, applications, or services.

9.2 Nairafolio is not responsible for the privacy practices of such third parties and encourages Users to review their respective policies.

9.3 Use of third-party services shall be at the Client’s own risk.

9.4 Any data voluntarily provided by Clients to third parties is outside the control of Nairafolio, and such third parties are solely responsible for compliance with applicable data protection rules.

9.5 Integration with third-party services (e.g., payment gateways) is provided for convenience only and does not constitute endorsement or guarantee of their security standards.

9.6 Clients acknowledge that third-party platforms may use cookies, tracking technologies, or marketing tools independently of Nairafolio’s policies.

10. Children’s Privacy

10.1 Nairafolio’s services are not intended for individuals under the age of eighteen (18).

10.2 We do not knowingly collect or process personal data from minors.

10.3 If we become aware that data belonging to a minor has been collected, it will be deleted immediately.

10.4 Parents or guardians who believe that their child’s data has been submitted to Nairafolio are encouraged to contact us without delay.

10.5 Verification of age may be conducted during onboarding using national identification systems to ensure compliance with this restriction.

10.6 Any attempt by a minor to misrepresent age or submit falsified documents shall be considered a violation of these Terms and may be reported to authorities.

11. Updates to Privacy Policy

11.1 Nairafolio may revise this Privacy Policy periodically to reflect changes in law, regulation, or business practice.

11.2 Updated versions shall be published on our website and/or application.

11.3 Continued use of the Platform following updates constitutes acceptance of the revised Policy.

11.4 Where material changes are introduced, we will notify Clients via email, SMS, or in-app alerts prior to enforcement.

11.5 Clients are advised to review this Policy regularly to remain informed of their rights and our obligations.

11.6 If a Client does not agree with any revision, they must discontinue use of the Platform and may request closure of their account.

12. Contact Information

For privacy-related inquiries, requests, or complaints, you may contact us at:

Fadunsi Avenue

Ikeja. Lagos

12.1 Communications must be submitted through verified channels; Nairafolio shall not be held responsible for unauthorized instructions transmitted via unverified sources.

12.2 All complaints will be acknowledged within a reasonable timeframe and resolved in line with regulatory standards.

12.3 If you are dissatisfied with our handling of your data, you may escalate complaints to the National Information Technology Development Agency (NITDA), the regulatory body for data protection in Nigeria.