PRIVACY POLICY

At EZLoan, protecting the privacy of our Data Subjects and their personal data is our utmost priority. In line with this commitment, we have developed this Privacy Policy.

This Policy explains your privacy rights and details how we collect, process, retain, share, and protect your personal data when you visit our website, premises, or use our digital platforms (collectively, "the Platform" or "Services").

This agreement between you and our outlines our privacy commitments for all our Platforms/Services. It is designed to inform you about our privacy practices and help you understand how we handle your personal data in full compliance with the Nigeria Data Protection Act (NDPA) 2023 and other applicable data protection regulations.

Consent

By accessing our Platforms or providing your consent, you acknowledge and agree to this Privacy Policy, including how we handle your personal data when you:

• • Use our website, digital platforms, or Services,
• • Visit any of our offices, or
• • Submit your data for official or non-official purposes.

User Authorization & Data Collection

To provide secure and tailored services, EZLoan collects the following categories of data, always with your consent and in strict adherence to the Nigeria Data Protection Act (NDPA) 2023:

Location Data

• • What We Collect: Approximate device location (GPS, IP address, or network signals).
• • Purpose:
  • • Assess creditworthiness by verifying geographic consistency (e.g., detecting sudden location shifts that may indicate fraud).
  • • Enhance security by flagging unauthorized access (e.g., login attempts from unusual locations).
  • • Recover or secure accounts if a device is lost/stolen.
• • Storage: Encrypted and transmitted securely to https://client-api.ezloan.com.ng via HTTPS.

Finance SMS Data

Information We Collect

With your consent, our app accesses only financial SMS messages received on your device within the past 100 days.
The data collected is strictly limited to:

• • Message time – when the SMS was received
• • Sender’s phone number – the number that sent the SMS
• • Financial message content – only messages related to banking, payments, or loans

We do not collect:

• • Personal conversations or private chats
• • One-time passwords (OTP) or authentication codes
• • Promotional or marketing messages
• • Any non-financial SMS

How We Identify Financial SMS

To ensure that only financial SMS is processed, our system uses automated pattern recognition.
It checks for common financial terms, including but not limited to:
“amt”, “bal”, “acct”, “due”, “bank”, “credit”, “debit”, “loan”, “paid”, “pay”, “rate”, “ngn”.

This recognition is applied only to confirm financial relevance.
Messages that do not match financial patterns are automatically excluded and never collected.

Purpose of Use

The SMS data is used solely for:

• • Credit assessment – to evaluate your loan eligibility
• • Fraud prevention – to detect unusual or suspicious activity

We never use SMS data for advertising, marketing, or unrelated purposes.

Data Security

• • All SMS data is encrypted during transfer and storage
• • Access is restricted to authorized systems only
• • Regular monitoring and security checks are performed
• • Your data is securely sent to our server through HTTPS encryption https://client-api.ezloan.com.ng/

Data Retention

• • SMS data is stored for a limited period of up to 90 days
• • After this period, the data is permanently deleted and cannot be recovered

Phone & Device Data

• • What We Collect:
  • • Device identifiers (IMEI, serial number), IP address, model, OS version.
  • • Settings (language/region), usage patterns, phone number (if provided).
• • Purpose:
  • • Uniquely authenticate your device to prevent impersonation or fraud.
  • • Detect suspicious activity (e.g., multiple devices using the same account).
• • Storage: Encrypted and transmitted securely to https://client-api.ezloan.com.ng via HTTPS.

Contacts Information

• • What We Collect: Only for emergency contact
• • Purpose:
  • • Ensures immediate assistance can be prioritized through verified emergency contacts.
  • • Evaluate potential fraud risks.
• • Storage: Encrypted and transmitted securely to https://client-api.ezloan.com.ng via HTTPS.

Photo Permissions

• • What We Access:
  Exclusively enables users to attach images when submitting customer support inquiries—ensuring accurate troubleshooting and feedback resolution.
• • Purpose:
  To enable critical features while prioritizing privacy—contacts streamline [emergency/communication efficiency], and gallery access ensures faster issue resolution via user-shared visuals in support cases.
• • Security & Storage:
  We do not retain or store any images accessed from your gallery. Your privacy remains intact—selected photos are processed transiently to address your inquiry, then securely discarded.

App Installation And Update Time

• • What We Access:
  packageName、firstInstallTime、lastUpdateTime、appName、appVersion、installer of the EZloan app to verify authenticity, detect tampering, and ensure system stability.
• • Purpose:
  To authenticate valid app usage while preventing unauthorized access or modifications, and maintaining seamless version compatibility.
• • Security & Storage:
  • • Data is encrypted with industry-standard protocols and transmitted securely to EZLoan servers https://client-api.ezloan.com.ng.
  • • Installation records are kept for no longer than 90 days and permanently erased upon account deletion.
  • • No external apps, files, or device storage are scanned or retained.

Personal Data We Collect

We collect and process your personal data to provide and improve our services while complying with legal requirements. Below are the types of data we collect and how we use them.

1. 1. Account Registration & Verification

• • What we collect: Your name, gender, date of birth, facial photo, residential address, government ID, email, phone number, BVN, and NIN (mandatory for KYC compliance)
• • Why we need it: To verify your identity, create your account, and comply with financial regulations

1. 1. Contact List (with your permission)

• • What we collect: Names and phone numbers from your contacts (with your consent)
• • How we use it:
  • • Make transfers easier by auto-filling recipient details
  • • Verify emergency contacts
  • • Assess loan applications
• • Your rights: You can revoke this access anytime in your settings

1. 1. Financial Transactions

• • What we collect:
  • • Loan details (amounts, dates, products)
  • • Payment records (merchants, beneficiaries)
  • • Device and location data (for security)
• • Security: We use this to prevent fraud and improve our services

1. 1. Images & Documents

• • What we collect: Photos of you (for identity verification) and documents you upload
• • Protection: All images are encrypted and stored securely

5. Technical Data

• • What we collect: Device information, app usage data, and crash reports
• • Purpose: To improve app performance and your experience

6. Job Applications

• • What we collect: Employment history, education, and background check information
• • Process: We'll ask for your explicit consent before collecting this

Important Notes:

• • We never collect minors' data (service is for 18+ only)
• • Contact info is only used for verification, not debt collection
• • We do not share data with third parties
• • You control your data through privacy settings

Data Retention Periods

We retain personal data only as long as necessary for lawful business purposes, adhering to regulatory requirements and service obligations.

Key Retention Principles

1. 1. Service-Based Retention
   • • Data is maintained while you actively use our services and for a limited period thereafter to:
     • • Support account reactivation requests
     • • Resolve disputes or inquiries
     • • Prevent fraud and maintain financial records
2. 2. Regulatory Compliance
   • • Mandatory retention for:
     • • 7 years for transaction records (per CBN AML/CFT Regulations)
     • • 10 years for KYC documents (NDIC requirements)
     • • Tax and audit records as prescribed by FIRS
3. 3. Disposal Protocol
   • • Post-retention data is either:
     • • Anonymized for analytics (where permissible)
     • • Securely erased using NIST-standard deletion methods
4. 4. User Control
   • • You may request early deletion of non-essential data via our customer service, subject to:
     • • Pending transactions being completed
     • • No active legal holds or investigations

Example: Loan application data is retained for 5 years after account closure to comply with Credit Reporting Act obligations, after which only anonymized credit performance data is preserved.

How We Process Your Personal Data

We process your personal data responsibly to deliver secure, efficient services while complying with legal requirements. Below are key processing activities and their purposes:

A. Essential Service Delivery

We process data to:

✓ Process payments, transfers, and bill payments

✓ Verify your identity for account access

✓ Communicate important service updates

✓ Resolve technical issues and customer disputes

B. Security & Compliance

We leverage data to:

✓ Detect/prevent fraud using:

• • Device information
• • Transaction patterns
• • Geolocation data
  ✓ Meet legal obligations including:
• • CBN anti-money laundering rules
• • NDIC reporting requirements
• • Court orders/regulatory investigations
  ✓ Investigate and remediate security incidents

C. Consent-Based Processing [Opt-in Only]

With your permission, we may:

✓ Send personalized marketing communications

✓ Use cookies for tailored platform features

✓ Access geolocation to show:

• • Nearby service agents
• • Localized offers

How We Share Personal Data

We disclose information only when necessary, with stringent safeguards. All sharing complies with the Nigeria Data Protection Act (NDPA) 2023 and CBN Consumer Protection Framework.

A. Compliance-Driven Disclosures

We share data when legally compelled to:

✓ Regulatory Bodies (CBN, NDIC, FIRS) – For audits/anti-money laundering checks

✓ Law Enforcement – Strictly per court orders (Section 45 NDPA exceptions)

✓ M&A Transactions – After anonymization where possible (per SEC Rule 506(c))

B. Consent-Based Sharing

For external marketing/services, we:

• • Seek explicit opt-in via checkboxes (never pre-ticked)
• • Allow real-time withdrawal through:
  • • SMS shortcode (e.g., text STOP MARKETING to 1234)
  • • Dashboard toggle in Privacy Settings

Prohibited Sharing

We never sell data to:

• • Data brokers
• • Unvetted third parties
• • Entities outside CBN-approved jurisdictions

Cookie Policy

What Are Cookies?
Cookies are small text files stored on your device when you visit our website. They enable core functionality, enhance security, and improve your browsing experience. Like most financial platforms, we use cookies to provide secure, seamless services.

Our Cookie Usage

We strictly use:
Encrypted Session Cookies - Temporary files that:

• • Create a secure connection to our systems
• • Maintain your login session during active use
• • Automatically delete when you:
  • • Log out of your account
  • • Remain inactive for 30 minutes
  • • Close your browser

We Do Not Use:

• • Persistent tracking cookies
• • Third-party advertising cookies
• • Any cookies that collect personal information

Why We Need Cookies
These secure cookies are essential for:

1. 1. Preventing fraudulent transactions
2. 2. Protecting your account from unauthorized access
3. 3. Enabling money transfers and payments
4. 4. Complying with financial security regulations

1. Your Data Protection Rights

A. Right to Access

You may request:
✓ Confirmation of whether we process your personal data
✓ A digital copy of your data (or alternative format)
✓ Additional details about:

• • Processing purposes
• • Data categories stored
• • Third-party recipients
• • Retention periods
• • Security measures

» Response Time: 30 days (extendable under NDPA Section 39)

B. Right to Rectification

Request corrections if your data is:

✗ Inaccurate ✗ Outdated ✗ Incomplete

We will:

• • Implement changes within 72 hours of verification
• • Append correction notes if disputed data cannot be altered
• • Notify all third-party processors of updates

C. Right to Erasure ("Right to be Forgotten")

Grounds for Erasure:

1️⃣ Data no longer needed for its original purpose
2️⃣ Unlawful processing occurred
3️⃣ Withdrawal of consent (where applicable)
4️⃣ Valid objection to processing
5️⃣ Legal compliance requirement

Exceptions (NDPA Section 33):

• • Ongoing contractual obligations (e.g., loan agreements)
• • Regulatory reporting requirements (CBN/NDIC mandates)
• • Legal proceedings or fraud investigations

» Process: We will erase data and notify downstream processors within 14 business days, unless exempted.

D. Right to Restriction of Processing

You may require us to temporarily freeze processing when:

1. 1. Data accuracy is contested (during verification)
2. 2. Processing is unlawful but you oppose erasure
3. 3. Data is needed for legal claims
4. 4. Objection to legitimate interest processing is under review

During restriction:

• • Data remains stored but inactive
• • Processed only with your explicit consent or for:
  » Legal claims » Public interest » Regulatory compliance

E. Right to Data Portability

Receive your machine-readable data (JSON/CSV formats) when:

• • Processing is automated
• • Based on contract or consent

We will:

• • Provide data within 30 days
• • Transfer directly to another controller if technically feasible
• • Redact third-party data without their consent

F. Right to Object

General Processing:

Challenge processing based on:

• • Legitimate interests (e.g., credit risk modeling)
• • Public interest tasks

Direct Marketing:

• • Absolute right to opt-out immediately
• • No exemptions apply

Automated Decision-Making:

Request human intervention for:

• • Credit scoring
• • Fraud detection algorithms
• • Risk assessments

» Response Timeline: 30 days for evaluation

G. How to Exercise Your Rights

1. 1. Verification: Submit:
   • • Government-issued ID
   • • Proof of account ownership
2. 2. Channels:
   • • Email: ezloan.help@pactowoh.africa
3. 3. No Fees: Free unless manifestly unfounded (NDPA Section 40)

Data Security & Protection Framework

Multi-Layered Security Measures

We implement NDPA/CBN-compliant safeguards across three dimensions:

1. 1. Technical Controls

• • 256-bit AES encryption for data at rest & TLS 1.3 for in-transit data
• • AI-driven intrusion detection systems with 24/7 SOC monitoring
• • Multi-factor authentication (MFA) mandatory for all internal systems
• • Annual penetration testing by ISO 27001-certified auditors

1. 2. Physical safeguards

• • Biometric access to data centers with security clearance logs
• • Tamper-evident CCTV (90-day retention, NDIC Section 56 compliant)
• • Secure disposal of physical records via cross-cut shredding

1. 3. Administrative Protocols

• • Role-based access controls (RBAC) with quarterly privilege reviews
• • Mandatory staff training on NDPA Section 28 obligations
• • Vendor risk assessments for all third-party processors

Violations & Remediation Framework

Response Protocol

▸ Tier 1 Violations (e.g., unauthorized internal access):

• • Remediation within 7 business days
• • Mandatory staff retraining completed within 14 days

▸ Tier 2 Violations (data disclosure without consent):

• • Immediate takedown of disclosed information
• • Written redress confirmation to you within 48 hours
• • Penalties per NDPA Section 48 (up to 2% of annual revenue)

Your Recourse

• • Lodge complaints via:
  » NDPA Portal: https://www.ezloan.com.ng
  » Email: ezloan.help@pactowoh.africa

Governing Law & Jurisdiction

This Policy is governed by:

✓ Primary: Nigeria Data Protection Act (2023)

✓ Secondary:

• • CBN Consumer Protection Framework
• • NCC Data Regulations 2021
• • ECOWAS Supplementary Act on Data Protection

Conflict Resolution

• • Arbitration in Lagos under NDPA Section 50
• • Court jurisdiction: Federal High Court, Nigeria

Policy Amendment Procedure

Review Cycles

✓ Mandatory annual review (Q1 every year)

✓ Trigger-based updates for:

• • New service launches
• • Regulatory changes (e.g., NDPC guidelines)
• • Breach incidents requiring policy adjustment

Notice Methods

1. 1. Non-material changes: Website/Social media update (7-day advance notice)
2. 2. Material changes:
   • • Email/SMS to registered users 30 days pre-implementation
   • • In-app banners for mobile users
   • • Opt-out rights for substantial processing changes

Material changes include:

• • New data collection purposes
• • Cross-border transfer expansions
• • Reduced retention periods

Contact Information & Data Rights Requests

Primary Contacts

Customer Service

📧 Email: ezloan.help@pactowoh.africa

☎️ Phone: +234 7001239956

🕒 Hours: 8:00 AM - 5:00 PM (Weekdays)