PRIVACY POLICY

At EZLoan, protecting the privacy of our Data Subjects and their personal data is our utmost priority. In line with this commitment, we have developed this Privacy Policy.

This Policy explains your privacy rights and details how we collect, process, retain, share, and protect your personal data when you visit our website, premises, or use our digital platforms (collectively, "the Platform" or "Services").

This agreement between you and our outlines ourLink to DSAR porta privacy commitments for all our Platforms/Services. It is designed to inform you about our privacy practices and help you understand how we handle your personal data in full compliance with the Nigeria Data Protection Act (NDPA) 2023 and other applicable data protection regulations.

Consent

By accessing our Platforms or providing your consent, you acknowledge and agree to this Privacy Policy, including how we handle your personal data when you:

• • Use our website, digital platforms, or Services,
• • Visit any of our offices, or
• • Submit your data for official or non-official purposes.

User Authorization & Data Collection

To provide secure and tailored services, EZLoan collects the following categories of data, always with your consent and in strict adherence to the Nigeria Data Protection Act (NDPA) 2023:

Location Data

• • What We Collect: Approximate device location (GPS, IP address, or network signals).
• • Purpose:
  • • Assess creditworthiness by verifying geographic consistency (e.g., detecting sudden location shifts that may indicate fraud).
  • • Enhance security by flagging unauthorized access (e.g., login attempts from unusual locations).
  • • Recover or secure accounts if a device is lost/stolen.
• • Storage: Encrypted and transmitted securely to https://client-api.ezloan.com.ng via HTTPS.

Finance SMS Data

Information We Collect

With your consent, our app accesses only financial SMS messages received on your device within the past 100 days.
The data collected is strictly limited to:

• • Message time – when the SMS was received
• • Sender’s phone number – the number that sent the SMS
• • Financial message content – only messages related to banking, payments, or loans

We do not collect:

• • Personal conversations or private chats
• • One-time passwords (OTP) or authentication codes
• • Promotional or marketing messages
• • Any non-financial SMS

How We Identify Financial SMS

To ensure that only financial SMS is processed, our system uses automated pattern recognition.
It checks for common financial terms, including but not limited to:
“amt”, “bal”, “acct”, “due”, “bank”, “credit”, “debit”, “loan”, “paid”, “pay”, “rate”, “ngn”.

This recognition is applied only to confirm financial relevance.
Messages that do not match financial patterns are automatically excluded and never collected.

Purpose of Use

The SMS data is used solely for:

• • Credit assessment – to evaluate your loan eligibility
• • Fraud prevention – to detect unusual or suspicious activity

We never use SMS data for advertising, marketing, or unrelated purposes.

Data Security

• • All SMS data is encrypted during transfer and storage
• • Access is restricted to authorized systems only
• • Regular monitoring and security checks are performed
• • Your data is securely sent to our server through HTTPS encryption https://client-api.ezloan.com.ng/

Data Retention

• • SMS data is stored for a limited period of up to 90 days
• • After this period, the data is permanently deleted and cannot be recovered

Phone & Device Data

• • What We Collect:
  • • Device identifiers (IMEI, serial number), IP address, model, OS version.
  • • Settings (language/region), usage patterns, phone number (if provided).
• • Purpose:
  • • Uniquely authenticate your device to prevent impersonation or fraud.
  • • Detect suspicious activity (e.g., multiple devices using the same account).
• • Storage: Encrypted and transmitted securely to https://client-api.ezloan.com.ng via HTTPS.

Contacts Information

• • What We Collect: Only for emergency contact
• • Purpose:
  • • Ensures immediate assistance can be prioritized through verified emergency contacts.
  • • Evaluate potential fraud risks.
• • Storage: Encrypted and transmitted securely to https://client-api.ezloan.com.ng via HTTPS.

Photo Permissions

• • Photo Access Purpose:
  • • We only access photos you specifically select and upload for identity verification (KYC), submitting a customer support case, or reporting an app issue through images. This ensures minimal data processing.
• • When Photo Access Occurs:
  • • Access to your images occurs only when you actively upload pictures to complete identity verification, submit a support request with attached photos, or share screenshots to report a technical problem.
• • Legal Basis for Access:
  • • Under NDPA Article 25(2)(b) (necessary for compliance with a legal obligation) and Article 25(2)(a) (necessary for the performance of a contract), we process your identity documents to comply with financial regulatory legal obligations such as Anti-Money Laundering (AML) by the Central Bank of Nigeria (CBN), which is a prerequisite for providing services to you.
  • • Under NDPA Article 25(2)(a) (based on your explicit consent), we process photos you upload for this purpose. Your consent can be withdrawn at any time via privacy settings.
• • Protection:
  • • All uploaded images are strongly encrypted during transmission and securely transmitted in encrypted form to our server at https://client-api.ezloan.com.ng. Documents used for verification are securely deleted after the minimum retention period required by relevant laws (e.g., CBN and NDIC); images used for customer support or issue reporting are automatically deleted within 24-48 hours after your case is resolved.
• • Permission Control:
  • • Photo access is requested only when needed for specific features, and you can control permissions through your device settings or our app's privacy controls at any time.

Camera Permission

• • Camera Access Purpose:
  • • We only use the camera to capture live photographs of your identity documents or images for facial liveness detection to complete identity verification (KYC). This processing is necessary to fulfill legal Anti-Money Laundering (AML) obligations from financial regulators such as the CBN and to confirm the operator's identity to ensure account security. We do not use the camera for any other purposes.
• • When Camera Access Occurs:
  • • The camera is activated and used to capture images only when you explicitly initiate the identity verification process and actively select the "Capture ID" or "Start Face Recognition" function as prompted by the app. We cannot access your camera when you have not actively enabled this process.
• • Legal Basis for Access:
  • • Under NDPA Article 25(2)(b) and Article 25(2)(a), processing your identity documents and conducting liveness detection and identity verification through facial recognition technology is necessary to meet the mandatory regulatory requirements of the Central Bank of Nigeria (CBN) for "Know Your Customer" (KYC) and "Customer Due Diligence" (CDD) for financial institutions. This constitutes not only the fulfillment of a legal obligation but also a critical security measure to prevent identity theft and loan fraud, thereby safeguarding your significant financial assets and credit security.
  • • Under NDPA Article 25(2)(a) (based on your explicit consent), your consent can be withdrawn at any time via privacy settings.
• • Protection:
  • • All biometric data (such as liveness detection images) and identity document images captured by the camera are strongly encrypted during transmission and securely sent to our server at https://client-api.ezloan.com.ng in encrypted form. Images used for verification are automatically deleted once the legally required minimum retention period expires. These images will only be retained beyond this period if we are compelled to do so in order to comply with judicial or regulatory investigations—for example, in response to a lawful request from the CBN or law enforcement agencies.Your biometric data will not be used for any other purpose or shared with third parties unless explicitly required by law.
• • Permission Control:
  • • Camera permission is requested only when you perform the relevant identity verification steps. You can control permissions through your device settings or our app's privacy controls at any time. Please note that disabling camera permissions will prevent you from using features that require real-time identity verification.

Installed Applications Permission

• • Installed Applications Access Purpose:
  • • We only access metadata from the list of applications installed on your device to assess the security of your device's operating environment and identify potential malware or fraud risks, thereby protecting your account and transaction security. We collect only the following application metadata:
    • • Application names
    • • Package names
    • • Version number
    • • Installation times
    • • Last update timestamps
    • • List of permissions requested by the applications
  • • We do not access the specific content within any application (such as messages, photos, files, account credentials, or transaction records), nor do we track or analyze how you use those applications.
• • When Installed Applications Access Occurs:
  • • This access typically occurs when you launch the app, perform high-risk operations (such as modifying your linked bank card or security settings), or when a security scan is initiated by our risk control models. This is an automated process designed to dynamically assess current environmental risks.
• • Legal Basis for Access:
  • • Under the Nigeria Data Protection Act (2023) Article 25(2)(a) (necessary for the performance of a contract) and Article 25(2)(f) (necessary for the purposes of the legitimate interests pursued by the controller), this processing is essential for securing financial services, fulfilling our contractual obligation to provide you with a safe and stable service, and for the legitimate interest of preventing fraud and cybercrime. Our legitimate interests do not override your data protection rights.
  • • In certain instances, we may request this permission under NDPA Article 25(2)(a) (based on your explicit consent). Your consent can be withdrawn at any time through your device or app permission settings.
• • Protection:
  • • The collected application metadata is strongly encrypted during transmission and securely transmitted in encrypted form to our server (at https://client-api.ezloan.com.ng). This data is used solely for real-time risk assessment and security analysis and is not used to build a profile of your personal interests. Unless required to comply with judicial or regulatory investigations (e.g., in response to a legal request from the CBN or law enforcement agencies), this type of metadata, which is not directly linked to your identity, is typically automatically deleted or anonymized after the security assessment is complete.
• • Permission Control:
  • • This permission is requested when you first use relevant security features or as prompted by the system. You can control permissions through your device settings or our app's privacy controls at any time.

Personal Data We Collect

We collect and process your personal data to provide and improve our services while complying with legal requirements. Below are the types of data we collect and how we use them.

1. 1. Account Registration & Verification

• • What we collect: Your name, gender, date of birth, facial photo, residential address, government ID, email, phone number, BVN, and NIN (mandatory for KYC compliance)
• • Why we need it: To verify your identity, create your account, and comply with financial regulations

1. 1. Contact List (with your permission)

• • What we collect: Names and phone numbers from your contacts (with your consent)
• • How we use it:
  • • Make transfers easier by auto-filling recipient details
  • • Verify emergency contacts
  • • Assess loan applications
• • Your rights: You can revoke this access anytime in your settings

1. 1. Financial Transactions

• • What we collect:
  • • Loan details (amounts, dates, products)
  • • Payment records (merchants, beneficiaries)
  • • Device and location data (for security)
• • Security: We use this to prevent fraud and improve our services

1. 1. Images & Documents

• • What we collect: Photos of you (for identity verification) and documents you upload
• • Protection: All images are encrypted and stored securely

5. Technical Data

• • What we collect: Device information, app usage data, and crash reports
• • Purpose: To improve app performance and your experience

6. Job Applications

• • What we collect: Employment history, education, and background check information
• • Process: We'll ask for your explicit consent before collecting this

Important Notes:

• • We never collect minors' data (service is for 18+ only)
• • Contact info is only used for verification, not debt collection
• • We do not share data with third parties
• • You control your data through privacy settings

Data Retention Periods

We retain personal data only as long as necessary for lawful business purposes, adhering to regulatory requirements and service obligations.

Key Retention Principles

1. 1. Service-Based Retention
   • • Data is maintained while you actively use our services and for a limited period thereafter to:
     • • Support account reactivation requests
     • • Resolve disputes or inquiries
     • • Prevent fraud and maintain financial records
2. 2. Regulatory Compliance
   • • Mandatory retention for:
     • • 7 years for transaction records (per CBN AML/CFT Regulations)
     • • 10 years for KYC documents (NDIC requirements)
     • • Tax and audit records as prescribed by FIRS
3. 3. Disposal Protocol
   • • Post-retention data is either:
     • • Anonymized for analytics (where permissible)
     • • Securely erased using NIST-standard deletion methods
4. 4. User Control
   • • You may request early deletion of non-essential data via our customer service, subject to:
     • • Pending transactions being completed
     • • No active legal holds or investigations

Example: Loan application data is retained for 5 years after account closure to comply with Credit Reporting Act obligations, after which only anonymized credit performance data is preserved.

How We Process Your Personal Data

We process your personal data responsibly to deliver secure, efficient services while complying with legal requirements. Below are key processing activities and their purposes:

A. Essential Service Delivery

We process data to:

✓ Process payments, transfers, and bill payments

✓ Verify your identity for account access

✓ Communicate important service updates

✓ Resolve technical issues and customer disputes

B. Security & Compliance

We leverage data to:

✓ Detect/prevent fraud using:

• • Device information
• • Transaction patterns
• • Geolocation data
  ✓ Meet legal obligations including:
• • CBN anti-money laundering rules
• • NDIC reporting requirements
• • Court orders/regulatory investigations
  ✓ Investigate and remediate security incidents

C. Consent-Based Processing [Opt-in Only]

With your permission, we may:

✓ Send personalized marketing communications

✓ Use cookies for tailored platform features

✓ Access geolocation to show:

• • Nearby service agents
• • Localized offers

How We Share Personal Data

We disclose information only when necessary, with stringent safeguards. All sharing complies with the Nigeria Data Protection Act (NDPA) 2023 and CBN Consumer Protection Framework.

A. Compliance-Driven Disclosures

We share data when legally compelled to:

✓ Regulatory Bodies (CBN, NDIC, FIRS) – For audits/anti-money laundering checks

✓ Law Enforcement – Strictly per court orders (Section 45 NDPA exceptions)

✓ M&A Transactions – After anonymization where possible (per SEC Rule 506(c))

B. Consent-Based Sharing

For external marketing/services, we:

• • Seek explicit opt-in via checkboxes (never pre-ticked)
• • Allow real-time withdrawal through:
  • • SMS shortcode (e.g., text STOP MARKETING to 1234)
  • • Dashboard toggle in Privacy Settings

Prohibited Sharing

We never sell data to:

• • Data brokers
• • Unvetted third parties
• • Entities outside CBN-approved jurisdictions

Cookie Policy

What Are Cookies?
Cookies are small text files stored on your device when you visit our website. They enable core functionality, enhance security, and improve your browsing experience. Like most financial platforms, we use cookies to provide secure, seamless services.

Our Cookie Usage

We strictly use:
Encrypted Session Cookies - Temporary files that:

• • Create a secure connection to our systems
• • Maintain your login session during active use
• • Automatically delete when you:
  • • Log out of your account
  • • Remain inactive for 30 minutes
  • • Close your browser

We Do Not Use:

• • Persistent tracking cookies
• • Third-party advertising cookies
• • Any cookies that collect personal information

Why We Need Cookies
These secure cookies are essential for:

1. 1. Preventing fraudulent transactions
2. 2. Protecting your account from unauthorized access
3. 3. Enabling money transfers and payments
4. 4. Complying with financial security regulations

1. Your Data Protection Rights

A. Right to Access

You may request:
✓ Confirmation of whether we process your personal data
✓ A digital copy of your data (or alternative format)
✓ Additional details about:

• • Processing purposes
• • Data categories stored
• • Third-party recipients
• • Retention periods
• • Security measures

» Response Time: 30 days (extendable under NDPA Section 39)

B. Right to Rectification

Request corrections if your data is:

✗ Inaccurate ✗ Outdated ✗ Incomplete

We will:

• • Implement changes within 72 hours of verification
• • Append correction notes if disputed data cannot be altered
• • Notify all third-party processors of updates

C. Right to Erasure ("Right to be Forgotten")

Grounds for Erasure:

1️⃣ Data no longer needed for its original purpose
2️⃣ Unlawful processing occurred
3️⃣ Withdrawal of consent (where applicable)
4️⃣ Valid objection to processing
5️⃣ Legal compliance requirement

Exceptions (NDPA Section 33):

• • Ongoing contractual obligations (e.g., loan agreements)
• • Regulatory reporting requirements (CBN/NDIC mandates)
• • Legal proceedings or fraud investigations

» Process: We will erase data and notify downstream processors within 14 business days, unless exempted.

D. Right to Restriction of Processing

You may require us to temporarily freeze processing when:

1. 1. Data accuracy is contested (during verification)
2. 2. Processing is unlawful but you oppose erasure
3. 3. Data is needed for legal claims
4. 4. Objection to legitimate interest processing is under review

During restriction:

• • Data remains stored but inactive
• • Processed only with your explicit consent or for:
  » Legal claims » Public interest » Regulatory compliance

E. Right to Data Portability

Receive your machine-readable data (JSON/CSV formats) when:

• • Processing is automated
• • Based on contract or consent

We will:

• • Provide data within 30 days
• • Transfer directly to another controller if technically feasible
• • Redact third-party data without their consent

F. Right to Object

General Processing:

Challenge processing based on:

• • Legitimate interests (e.g., credit risk modeling)
• • Public interest tasks

Direct Marketing:

• • Absolute right to opt-out immediately
• • No exemptions apply

Automated Decision-Making:

Request human intervention for:

• • Credit scoring
• • Fraud detection algorithms
• • Risk assessments

» Response Timeline: 30 days for evaluation

G. How to Exercise Your Rights

1. 1. Verification: Submit:
   • • Government-issued ID
   • • Proof of account ownership
2. 2. Channels:
   • • Email: ezloan.help@pactowoh.africa
3. 3. No Fees: Free unless manifestly unfounded (NDPA Section 40)

Data Security & Protection Framework

Multi-Layered Security Measures

We implement NDPA/CBN-compliant safeguards across three dimensions:

1. 1. Technical Controls

• • 256-bit AES encryption for data at rest & TLS 1.3 for in-transit data
• • AI-driven intrusion detection systems with 24/7 SOC monitoring
• • Multi-factor authentication (MFA) mandatory for all internal systems
• • Annual penetration testing by ISO 27001-certified auditors

1. 2. Physical safeguards

• • Biometric access to data centers with security clearance logs
• • Tamper-evident CCTV (90-day retention, NDIC Section 56 compliant)
• • Secure disposal of physical records via cross-cut shredding

1. 3. Administrative Protocols

• • Role-based access controls (RBAC) with quarterly privilege reviews
• • Mandatory staff training on NDPA Section 28 obligations
• • Vendor risk assessments for all third-party processors

Violations & Remediation Framework

Response Protocol

▸ Tier 1 Violations (e.g., unauthorized internal access):

• • Remediation within 7 business days
• • Mandatory staff retraining completed within 14 days

▸ Tier 2 Violations (data disclosure without consent):

• • Immediate takedown of disclosed information
• • Written redress confirmation to you within 48 hours
• • Penalties per NDPA Section 48 (up to 2% of annual revenue)

Your Recourse

• • Lodge complaints via:
  » NDPA Portal: https://www.ezloan.com.ng
  » Email: ezloan.help@pactowoh.africa

Governing Law & Jurisdiction

This Policy is governed by:

✓ Primary: Nigeria Data Protection Act (2023)

✓ Secondary:

• • CBN Consumer Protection Framework
• • NCC Data Regulations 2021
• • ECOWAS Supplementary Act on Data Protection

Conflict Resolution

• • Arbitration in Lagos under NDPA Section 50
• • Court jurisdiction: Federal High Court, Nigeria

Policy Amendment Procedure

Review Cycles

✓ Mandatory annual review (Q1 every year)

✓ Trigger-based updates for:

• • New service launches
• • Regulatory changes (e.g., NDPC guidelines)
• • Breach incidents requiring policy adjustment

Notice Methods

1. 1. Non-material changes: Website/Social media update (7-day advance notice)
2. 2. Material changes:
   • • Email/SMS to registered users 30 days pre-implementation
   • • In-app banners for mobile users
   • • Opt-out rights for substantial processing changes

Material changes include:

• • New data collection purposes
• • Cross-border transfer expansions
• • Reduced retention periods

Contact Information & Data Rights Requests

Primary Contacts

Customer Service

📧 Email: ezloan.help@pactowoh.africa

☎️ Phone: +234 7001239956

🕒 Hours: 8:00 AM - 5:00 PM (Weekdays)