Privacy Policy

Nafini ("we," "our," or "us") is committed to protecting your privacy and safeguarding your personal information.

This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you use Nafini through WhatsApp, our website, or any related services.

By using Nafini, you acknowledge that you have read and understood this Privacy Policy.

This Privacy Policy applies to all users of Nafini and covers personal information collected through:

• WhatsApp conversations;
• our website and web applications;
• customer support interactions;
• onboarding processes;
• identity verification processes; and
• financial services made available through Nafini.

We process your personal information in accordance with:

• the Nigeria Data Protection Act, 2023 (NDPA);
• applicable regulations issued by the Nigeria Data Protection Commission (NDPC); and
• other applicable laws governing financial services, anti-money laundering, fraud prevention, and lawful disclosures.

Where another country's data protection laws apply to your use of Nafini, we will comply with those laws where required.

Depending on how you use Nafini, we may collect the following categories of information.

Personal Information

• Full name
• Mobile phone number
• Email address
• Date of birth (where required)
• Residential address (where required)

Identity Information

Where required for identity verification or financial services, we may collect:

• Bank Verification Number (BVN)
• National Identification Number (NIN)
• Government-issued identification details
• Other information reasonably required to verify your identity

These identifiers are treated as sensitive personal data and are protected using enhanced security measures.

Financial Information

We may collect information relating to:

• virtual accounts assigned to you;
• payment history;
• payment references;
• transaction amounts;
• account balances where necessary to provide services;
• bill payment records;
• budgeting information; and
• reminders created through the Service.

Nafini does not collect more financial information than is reasonably necessary to provide the requested services.

Technical Information

We may automatically collect:

• device information;
• IP address;
• browser information;
• operating system;
• WhatsApp account information necessary to provide the Service;
• usage logs; and
• security logs.

Communications

We collect information contained in:

• conversations with our AI assistant;
• customer support messages;
• feedback;
• complaints; and
• surveys.

We collect information:

• directly from you;
• when you communicate with our AI assistant;
• during onboarding;
• during identity verification;
• during payment-related activities;
• from financial infrastructure used to provide our services;
• from publicly available sources where legally permitted; and
• where required by law.

We process your information to:

• provide the Nafini service;
• create and manage your account;
• enable virtual account functionality;
• process payments and payment instructions;
• provide budgeting and reminder services;
• personalize your experience;
• verify your identity;
• prevent fraud;
• detect suspicious activity;
• investigate financial crimes;
• comply with applicable laws and regulatory obligations;
• improve our AI systems;
• secure our platform;
• resolve disputes;
• provide customer support; and
• communicate service updates.

We do not process your personal information for purposes incompatible with those described in this Privacy Policy unless required or permitted by law.

Depending on the circumstances, we process personal information because:

• processing is necessary to provide the services you request;
• you have provided consent where consent is required;
• processing is necessary to comply with legal obligations;
• processing is necessary to protect legitimate interests such as fraud prevention, platform security, and service improvement, provided those interests do not override your rights and freedoms; or
• processing is otherwise permitted under applicable law.

Where required to provide financial services or comply with applicable legal and regulatory obligations, Nafini may collect and retain your BVN and NIN.

These identifiers are processed for purposes including:

• identity verification;
• Know Your Customer (KYC) requirements;
• fraud prevention;
• financial crime monitoring;
• transaction verification;
• account security;
• regulatory compliance;
• investigation of suspicious or unlawful activity; and
• resolution of disputes.

We do not use your BVN or NIN for marketing purposes.

Access to these identifiers is strictly limited to authorized personnel with a legitimate business need and is subject to technical and organizational security controls.

We may disclose your information where reasonably necessary to:

• provide requested services;
• process financial transactions;
• facilitate virtual account services;
• verify your identity;
• comply with legal obligations;
• investigate fraud;
• protect our rights;
• respond to lawful regulatory requests; or
• protect users and the public.

We may share information with:

• financial institutions involved in providing requested services;
• payment processors;
• identity verification providers;
• cloud hosting providers;
• technology vendors acting on our behalf;
• professional advisers;
• auditors;
• regulators;
• courts;
• law enforcement agencies; and
• other parties where disclosure is required or permitted by law.

We do not sell your personal information.

Your personal information may be processed or stored outside Nigeria where this is necessary to provide the Service.

Where personal information is transferred internationally, we take reasonable steps to ensure that appropriate safeguards are implemented in accordance with applicable data protection laws.

We implement reasonable technical and organizational measures designed to protect personal information, including:

• encryption of sensitive information during transmission and, where appropriate, at rest;
• role-based access controls;
• authentication and authorization controls;
• audit logging;
• continuous monitoring;
• secure cloud infrastructure;
• employee confidentiality obligations; and
• regular security reviews.

Although we take reasonable steps to protect your information, no method of electronic transmission or storage is completely secure.

We retain personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy or as required by law.

Where collected, BVN and NIN are retained for five (5) years after account closure or the end of our relationship with you, unless a longer retention period is required or permitted by applicable law, regulatory obligations, legal proceedings, or ongoing fraud investigations.

When information is no longer required, we securely delete, anonymize, or otherwise dispose of it in accordance with our internal retention procedures.

Subject to applicable law, you may have the right to:

• request access to your personal information;
• request correction of inaccurate information;
• request deletion of information where legally permissible;
• object to certain processing activities;
• request restriction of processing;
• withdraw consent where processing is based on consent;
• request portability of your information where applicable; and
• lodge a complaint with the Nigeria Data Protection Commission (NDPC).

Some rights may be limited where retention or processing is required by law or necessary to prevent fraud, investigate unlawful activity, or comply with regulatory obligations.

Nafini is not intended for individuals under eighteen (18) years of age.

We do not knowingly collect personal information from children. If we become aware that information relating to a child has been collected without appropriate authorization, we will take reasonable steps to delete it where permitted by law.

Our services may integrate with third-party providers to enable financial services, identity verification, payment processing, messaging, hosting, analytics, and other operational functions.

Those third parties may process personal information in accordance with their own privacy policies and applicable laws.

Nafini is not responsible for the privacy practices of independent third parties.

Where you use our website or web application, we may use cookies and similar technologies to:

• maintain user sessions;
• remember preferences;
• improve website functionality;
• analyze performance; and
• enhance security.

You may manage cookies through your browser settings, although disabling certain cookies may affect website functionality.

We may update this Privacy Policy from time to time.

Where changes materially affect your rights or how we process your personal information, we will provide reasonable notice through WhatsApp, our website, or other appropriate communication channels before the changes become effective.

Your continued use of Nafini after the effective date of the revised Privacy Policy constitutes acceptance of the updated policy.

For questions, privacy requests, or complaints regarding this Privacy Policy, please contact:

Where required by applicable law, court order, regulatory directive, or a lawful request from a competent authority, Nafini may disclose relevant personal information, including sensitive identifiers such as BVN and NIN, to regulators or law enforcement agencies.

Such disclosures are made only where legally required or permitted and are limited to the information reasonably necessary for the relevant purpose.

By continuing to use Nafini, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and processing of your personal information as described herein.