Privacy Policy

Nigeria Data Protection Act 2023

Version 1.0

Governing law: Federal Republic of Nigeria

Status: Draft — for internal review

Prepared for Crowdital Limited

Contents

In Word, right-click the table below and choose Update Field to populate page numbers.

1. Who We Are and What This Policy Covers​1

2. Personal Data We Collect​1

3. How We Collect Data​1

4. Why We Process Data, and Our Lawful Basis​1

5. Automated Decision-Making and Profiling​1

6. Who We Share Data With​1

7. Cross-Border Transfers​1

8. Retention​1

9. Security​1

10. Your Rights​1

11. Cookies and Similar Technologies​1

12. Marketing​1

13. Data Protection Governance​1

14. Changes to This Policy​1

15. Contact​1

Data Controller: [Crowdital Limited] (RC [•]), [Address], Lagos, Nigeria

Data Protection Officer: [Name] — [dpo@crowdital.com]

Version: 1.0 | Effective Date: [•] | Last reviewed: [•]

Primary law: Nigeria Data Protection Act 2023 ("NDPA") and subsidiary instruments issued by the Nigeria Data Protection Commission ("NDPC")

1. Who We Are and What This Policy Covers

1.1 Crowdital operates a digital platform that aggregates regulated investment products from licensed Issuers and makes them available to investors, directly and through Distribution Partners embedding our technology.

1.2 This Policy explains how we collect, use, share, secure and retain personal data, and the rights you have. It applies to investors and prospective investors, visitors to our website and apps, end-users reaching us through a Distribution Partner's embedded interface, and representatives of our Issuers and partners.

1.3 Controller vs. Processor. For most processing described here, Crowdital is a Data Controller. In some arrangements — for example, where we process data strictly on the documented instructions of a Distribution Partner, or where an Issuer determines the purpose of processing for its own registry — we act as a Data Processor or as a Joint Controller. The applicable role is set out in our contract with that partner and, where you are affected, is disclosed at the point of collection.

2. Personal Data We Collect

2.1 Identity and verification data

Full name, date of birth, gender, nationality, residency, photograph/selfie, signature, National Identification Number (NIN), Bank Verification Number (BVN), Tax Identification Number (TIN), passport, driver's licence, voter's card, proof of address, and — where you invest as an entity — corporate registration documents, board resolutions, and beneficial-ownership details of directors, shareholders and controllers.

2.2 Financial and investment data

Bank account details, source of funds and source of wealth information, income and net-worth declarations, investment objectives, risk tolerance, transaction and subscription history, holdings, redemptions, distributions, statements, and tax status.

2.3 Technical and usage data

IP address, device identifiers, device fingerprint, browser type, operating system, geolocation (approximate), login and session data, pages viewed, features used, referral source, and cookie identifiers.

2.4 Communications data

Emails, in-app messages, support tickets, chat transcripts, and recordings of calls with our team.

2.5 Sensitive personal data

We process biometric data (facial image for liveness/identity matching) where you use biometric verification, and we may become aware of politically exposed person (PEP) status or of information appearing in sanctions, adverse-media and criminal-record screening. We process such data only where lawfully permitted and with appropriate safeguards.

2.6 Data about third parties you give us

If you provide data about another person (e.g., a next-of-kin, beneficiary, joint holder, director or beneficial owner), you confirm you have their authority to do so and have informed them of this Policy.

2.7 Children

The Platform is not intended for persons under 18 and we do not knowingly collect their data.

3. How We Collect Data

Directly from you (registration, onboarding, forms, communications); automatically (cookies, SDKs, device and log data); from Distribution Partners whose interface you used to reach us; from Issuers, fund administrators, registrars and custodians; and from third-party sources including identity verification and KYC providers, NIBSS/BVN validation services, the National Identity Management Commission, the Corporate Affairs Commission, credit bureaux, payment providers, sanctions and PEP screening databases, and publicly available and adverse-media sources.

4. Why We Process Data, and Our Lawful Basis

Where we rely on legitimate interest, we have carried out a balancing assessment and will provide a summary on request. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing — but note that withdrawing consent does not entitle you to erasure of records we are legally required to keep (see clause 8).

5. Automated Decision-Making and Profiling

5.1 We use automated tools for identity matching, fraud scoring, sanctions/PEP screening, transaction monitoring and appropriateness filtering. These can result in an application being declined, an account being suspended, or a product being made unavailable to you.

5.2 Where a decision producing legal or similarly significant effects is made solely by automated means, you have the right to request human review, to express your point of view, and to contest the decision. Contact [dpo@crowdital.com]. We may be unable to disclose the detail of AML detection logic where doing so would constitute "tipping off" or would compromise the integrity of our controls.

6. Who We Share Data With

We do not sell your personal data. We disclose it, on a need-to-know basis and under contract, to:

(a) Issuers, fund managers, trustees, registrars, custodians and fund administratorsof products you subscribe to — necessary to record your holding and pay your entitlements;

(b) Distribution Partners — where you were introduced through their embedded interface, limited to what is required to service the relationship and as set out in our contract with them;

(c) KYC, identity, biometric and screening providers;

(d) Payment processors, banks and settlement partners;

(e) Cloud hosting, infrastructure, communications and analytics providers;

(f) Professional advisers — auditors, lawyers, accountants, insurers;

(g) Regulators, law enforcement and public authorities — including the SEC, NFIU, SCUML, NDPC, EFCC, CBN, FIRS, and courts, where required by law or where we determine disclosure is necessary to comply with legal process or to protect our rights;

(h) An acquirer or investor in a corporate transaction, under confidentiality.

Every processor is bound by a written data processing agreement requiring confidentiality, security, purpose limitation, sub-processor control, breach notification and deletion/return on termination.

7. Cross-Border Transfers

7.1 Some of our providers process data outside Nigeria (for example, cloud hosting and screening databases in [•]).

7.2 We transfer personal data outside Nigeria only where permitted by Part IX of the NDPA — that is, where the destination provides an adequate level of protection, or under an approved transfer mechanism (contractual clauses, binding corporate rules, or an applicable derogation such as necessity for the performance of a contract or your explicit informed consent).

7.3 A list of our material cross-border processors and destination countries is available on request from [dpo@crowdital.com].

8. Retention

8.1 We keep personal data only as long as necessary for the purposes above.

8.2 Statutory minimums override deletion requests. In particular, AML/CFT records — identification data, account files, business correspondence and transaction records — are retained for at least five (5) years after the end of the business relationship or the date of the transaction, and longer where a regulator, court or investigating authority so directs, or where required by SEC record-keeping rules or tax law.

8.3 Marketing data is deleted or anonymised within [12] months of consent withdrawal or of the relationship ending. Web analytics data is retained for [•] months.

8.4 We may retain anonymised or aggregated data indefinitely; such data is no longer personal data.

9. Security

9.1 We apply technical and organisational measures appropriate to the risk, including: encryption of data in transit (TLS) and at rest; access control on a least-privilege basis; multi-factor authentication for staff and, where offered, for users; network segmentation; logging and monitoring; secure development practices and code review; vulnerability scanning and periodic penetration testing; vendor due diligence; staff background checks; confidentiality undertakings; and periodic data protection and security training.

9.2 No system is perfectly secure. You are responsible for safeguarding your credentials and device (see the Terms of Use).

9.3 Breach notification. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the NDPC within 72 hours of becoming aware of it, andwill notify affected data subjects without undue delay where the risk is high, describing the nature of the breach, likely consequences and the measures taken.

10. Your Rights

Under the NDPA you have the right to:

• Be informed about how your data is processed (this Policy);

• Access the personal data we hold about you and receive a copy;

• Rectify inaccurate or incomplete data;

• Erasure ("right to be forgotten") — subject to our legal retention obligations;

• Restrict processing in certain circumstances;

• Object to processing based on legitimate interest, and to direct marketing at any time;

• Data portability — receive your data in a structured, commonly used, machine-readable format;

• Withdraw consent at any time where consent is the basis;

• Not be subject to a solely automated decision with legal or similarly significant effect (see clause 5);

• Lodge a complaint with the NDPC.

How to exercise. Email [dpo@crowdital.com] or use the in-app privacy controls. We will verify your identity and respond within thirty (30) days, extendable once where the request is complex, with notice to you. Requests are free unless manifestly unfounded, excessive or repetitive, in which case a reasonable fee may apply.

If you are unhappy with our response, you may complain to the Nigeria Data Protection Commission, [NDPC contact details], without prejudice to any other legal remedy.

11. Cookies and Similar Technologies

11.1 We use strictly necessary cookies (session, security, load balancing), functional cookies (preferences), analytics cookies, and — where you consent — marketing cookies.

11.2 Strictly necessary cookies do not require consent. All others are set only after you consent through our cookie banner, and you may change your preferences at any time via [Cookie Settings].

11.3 A full cookie table (name, provider, purpose, duration, type) is maintained at [crowdital.com/cookies].

12. Marketing

12.1 We will send marketing communications only with your consent, or where permitted by law in respect of similar products to those you already hold.

12.2 Every marketing message contains an unsubscribe link. Opting out of marketing does not stop service and regulatory communications (statements, contract notes, security alerts, terms changes), which we must continue to send.

13. Data Protection Governance

We maintain: a Record of Processing Activities; a data inventory and flow map; Data Protection Impact Assessments for high-risk processing (including biometric verification and automated screening); a vendor and cross-border transfer register; an incident response and breach notification procedure; a retention and disposal schedule; and an annual data protection audit filed with the NDPC where we are a Data Controller of Major Importance.

14. Changes to This Policy

We may update this Policy. Material changes will be notified by email or in-app notice before they take effect. The version number and effective date at the top of this Policy indicate the current version.

15. Contact

Data Protection Officer, [Crowdital Limited]

[Address], Lagos, Nigeria | [dpo@crowdital.com] | [phone]