1.0 Scope

This Policy applies to personal data processed by CreditChek in connection with:

• Our website
• Our products and platforms
• Our credit and financial data services
• Identity and verification services
• Services provided to financial institutions, lenders, fintechs, microfinance institutions, retail businesses and other customers
• Communications with customers and prospective customers
• Customer support
• Other interactions with CreditChek

CreditChek may process personal data relating to individuals, including customers, prospective customers, employees, representatives of corporate customers, vendors, partners and individuals whose information is submitted to us by our customers or obtained from authorised third parties.

Where CreditChek processes personal data on behalf of a customer, the customer may be the data controller and CreditChek may act as a data processor. Where CreditChek determines the purposes and means of processing, CreditChek may act as a data controller.

2.0 Who We Are

CreditChek Technologies Nigeria Limited (“CreditChek”) provides credit and financial data verification and insight services.

CreditChek uses structured and permissioned data from multiple sources to provide credit and financial data solutions that support financial institutions, lenders, fintechs, microfinance institutions, retail businesses and other organisations in making informed financial and credit-related decisions.

Our services may include credit information, identity verification, income and financial insights, credit-related reports and other data-driven financial services.

3.0 How We Obtain Personal Data

We may obtain personal data from different sources depending on the service being provided.

3.1 Directly from You

We may collect information that you provide when you:

• Create an account
• Register to use our services
• Contact us
• Request information about our products
• Communicate with our customer support team
• Submit a request, enquiry or complaint
• Otherwise interact with CreditChek

This information may include:

• Name
• Phone number
• Email address
• Address
• Company name
• Designation
• Country
• Account information
• Other information necessary to provide the relevant service

3.2 From Our Customers

Where CreditChek provides services to a business customer, we may receive personal data submitted by that customer for the purpose of providing the contracted service.

Our business customers are responsible for ensuring that they have an appropriate lawful basis and any required permissions to provide personal data to CreditChek.

3.3 From Credit Bureaus, Lenders and Financial Institutions

Depending on the service being provided, we may obtain information from:

• Credit bureaus
• Lenders
• Financial institutions
• Other authorised third parties

This information may include credit, identity and financial information necessary to provide our services.

3.4 From Identity and Verification Sources

We may process identification and verification information, including:

• Bank Verification Number (BVN)
• National Identification Number (NIN)
• Other identification or verification numbers
• Identity verification information
• Information necessary to verify the identity, authenticity or status of an individual

3.5 From Our Website

When you use our website, we may collect technical information and use cookies or similar technologies to improve website functionality, security and user experience.

3.6 Through Third-Party Service Providers

Where necessary to provide our services, you may be directed to or interact with a third-party platform.

For example, where a payment or wallet-funding service is provided through a third-party payment institution, payment-card information may be collected directly by that third party rather than stored on the CreditChek platform.

The third party will process such information in accordance with its own privacy policy and applicable law.

4.0 Categories of Personal Data We Process

Depending on the service and purpose of processing, the personal data we process may include:

4.1 Identity and Contact Information

• Name
• Address
• Telephone number
• Email address
• Date of birth
• Country
• Identification information
• Account information
• Other contact information

4.2 Identification and Verification Information

This may include:

• BVN
• NIN
• Other identification numbers
• Identity verification information
• Information required to establish or verify an individual's identity

4.3 Credit and Financial Information

This may include:

• Credit history
• Credit reports
• Credit accounts
• Credit inquiries
• Credit scores
• Financial information
• Bank account-related information where applicable
• Income-related information where applicable
• Loan information
• Other information relevant to assessing creditworthiness or providing financial insights

4.4 Technical and Usage Information

This may include:

• IP address
• Device information
• Browser information
• Operating system
• Application or website usage information
• Diagnostic information
• Security information
• Other technical information required to operate and secure our services

4.5 Information Relating to Business Customers

Where you interact with CreditChek on behalf of an organisation, we may process information such as:

• Name
• Work email
• Work telephone number
• Designation
• Company name
• Other information necessary for the business relationship

5.0 Why Do We Need Your Personal Data?

CreditChek applies the principles of necessity, purpose limitation and data minimisation.

We only collect and process personal data that is reasonably necessary for a specific and legitimate purpose.

Depending on the service, we may process personal data for the following purposes:

• Identity verification
• Customer and business onboarding
• Credit history assessment
• Credit reporting
• Credit scoring
• Financial and credit data analysis
• Income and financial insights
• Assessing creditworthiness
• Supporting eligibility assessments
• Fraud detection and prevention
• Security and risk management
• Providing and maintaining our services
• Processing transactions where applicable
• Responding to customer requests
• Customer support
• Service communications
• Improving and developing our products
• Complying with legal and regulatory obligations
• Establishing, exercising or defending legal claims
• Preventing misuse of our services
• Other purposes disclosed to the data subject or permitted by applicable law

6.0 Lawful Basis for Processing

CreditChek does not rely on consent as the lawful basis for every processing activity.

Depending on the nature and purpose of the processing, we may process personal data on one or more lawful bases recognised under applicable data protection law, including:

• Consent
• Performance of a contract or taking steps at the request of the data subject before entering into a contract
• Compliance with a legal obligation
• Protection of vital interests
• Performance of a task carried out in the public interest, where applicable
• Legitimate interests, where applicable
• Other lawful bases recognised under applicable law

Where CreditChek relies on legitimate interest, we will consider the purpose of the processing, whether the processing is necessary and whether our interests are balanced against the rights and interests of the affected data subjects.

Where consent is the lawful basis, consent will be obtained in an appropriate manner and the data subject may withdraw consent subject to applicable legal limitations.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

7.0 Credit Scoring, Profiling and Automated Processing

CreditChek uses automated processing in connection with some of its services.

This may include:

• Credit scoring
• Profiling
• Eligibility assessments or decisions
• Fraud detection

Automated processing may involve analysing credit, identity, financial and other relevant information obtained from authorised sources.

The purpose of this processing is to:

• Assess creditworthiness
• Generate or provide credit-related scores and insights
• Support eligibility assessments
• Identify potential fraud or suspicious activity
• Improve risk assessment
• Provide relevant credit and financial services

Where a decision is based solely on automated processing and produces legal or similarly significant effects, CreditChek will apply the safeguards required by applicable data protection law.

Where applicable, these safeguards may include the right to:

• Obtain human intervention
• Express your point of view
• Contest the decision
• Exercise other rights provided under applicable law

8.0 Sharing Your Personal Data

CreditChek may share personal data where necessary and lawful to provide our services or fulfil our legal, contractual or regulatory obligations.

Depending on the service, recipients may include:

• Lenders
• Financial institutions
• Credit bureaus
• Customers who engage CreditChek to provide data-processing services
• Technology and infrastructure providers
• Identity and verification providers
• Payment service providers
• Security and fraud-prevention providers
• Professional advisers
• Regulators and government authorities where required or permitted by law
• Other authorised third parties necessary for the provision of our services

We do not sell or trade customer personal data.

Where a third party processes personal data on behalf of CreditChek, we will take appropriate steps to ensure that the third party provides appropriate safeguards for the personal data and processes it in accordance with applicable requirements.

Where CreditChek processes data on behalf of a customer, the relevant customer may determine the purpose and means of processing and may therefore have primary responsibility as the data controller.

9.0 Third-Party Websites and Services

Our services may contain links to or integrations with third-party websites, applications or services.

Where you access a third-party service, that third party may process your personal data under its own privacy policy and terms.

CreditChek is not responsible for the independent privacy practices of third parties.

We encourage you to review the privacy policy of any third-party service before providing personal data to that service.

10.0 International and Cross-Border Data Transfers

CreditChek is developing and operating services that may involve the processing of personal data across different jurisdictions.

Where personal data is transferred or made accessible outside Nigeria, CreditChek will ensure that the transfer is carried out in accordance with applicable data protection laws and regulatory requirements.

Where required, CreditChek will obtain the consent of the relevant data subject before transferring personal data outside Nigeria.

CreditChek will also implement appropriate safeguards and contractual or other protections required by applicable data protection law for international transfers.

Where a third party outside Nigeria receives or processes personal data on behalf of CreditChek, CreditChek will take reasonable steps to ensure that appropriate data protection and security measures are in place.

11.0 Data Security

CreditChek takes the security of personal data seriously.

We implement appropriate technical and organisational measures designed to protect personal data against:

• Unauthorised access
• Unlawful processing
• Accidental loss
• Destruction
• Alteration
• Unauthorised disclosure
• Other security threats

Our security measures may include:

• Access controls
• Restricted access to sensitive data
• Authentication controls
• Encryption
• Secure networks
• System monitoring
• Backups
• Employee training
• Access authorisation
• Secure physical records management
• Procedures for identifying and responding to privacy and security incidents

No method of electronic transmission or storage is completely secure. While we take reasonable measures to protect personal data, we cannot guarantee absolute security.

12.0 Data Breaches

CreditChek maintains procedures for identifying, investigating and responding to personal data breaches and other privacy incidents.

Where a personal data breach occurs, CreditChek will assess the breach and take appropriate steps in accordance with applicable law.

Where notification to a regulatory authority or affected data subjects is required by applicable law, CreditChek will make the appropriate notification within the applicable timeframe.

13.0 Data Retention

CreditChek will generally retain personal data for ten (10) years, unless a different retention period is required or permitted by applicable law.

The retention period may be necessary to:

• Comply with applicable legal and regulatory requirements
• Maintain appropriate credit and financial records
• Resolve disputes
• Establish, exercise or defend legal claims
• Prevent fraud or misuse
• Meet contractual obligations
• Fulfil other legitimate and lawful purposes

When personal data is no longer required, CreditChek will take appropriate steps to securely delete, anonymise or otherwise dispose of the information in accordance with its applicable data retention and deletion procedures.

14.0 Cookies

CreditChek uses cookies and similar technologies on its website.

Cookies may be used to:

• Provide essential website functionality
• Improve website performance
• Remember preferences
• Understand how visitors use our website
• Maintain security
• Improve the user experience

Where consent is required for non-essential cookies, we will provide an appropriate mechanism for users to make their choices.

For more information, please refer to our Cookie Policy.

15.0 Direct Marketing

Where permitted by applicable law, CreditChek may send communications about our products, services, events or other relevant information.

Where consent is required for direct marketing, we will obtain the appropriate consent before sending such communications.

You may opt out of marketing communications at any time by using the unsubscribe mechanism provided or contacting us at [email protected].

You may continue to receive important service-related or transactional communications where necessary.

16.0 Data Subject Rights

Subject to applicable law and any applicable exemptions, you may have the following rights in relation to your personal data:

Right to be Informed

You have the right to receive clear information about how your personal data is collected and processed.

Right of Access

You may request a copy of the personal data we hold about you.

Right to Rectification

You may request correction of inaccurate or incomplete personal data.

Right to Erasure

You may request that your personal data be deleted in circumstances where applicable law provides you with this right.

Right to Restriction of Processing

You may request restriction of processing in circumstances provided by applicable law.

Right to Object

You may object to certain processing of your personal data, including direct marketing.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw your consent.

Right to Data Portability

Where applicable, you may request your personal data in a structured, commonly used and machine-readable format and exercise other portability rights recognised by law.

Rights Relating to Automated Decision-Making

Where applicable, you may exercise rights relating to decisions based solely on automated processing, including rights to human intervention, express your point of view and contest a decision.

These rights are subject to the conditions and limitations provided under applicable data protection law.

17.0 How to Exercise Your Data Protection Rights

To exercise any of your data protection rights or ask questions about how CreditChek processes your personal data, please contact:

Data Protection Contact:
[email protected]

We may take reasonable steps to verify your identity before processing a request in order to protect your personal data from unauthorised disclosure.

We will respond to valid requests within the timeframe required by applicable law.

Where we are unable to comply with a request because of a legal or permitted limitation, we will explain the reason where legally permitted.

18.0 Customer Responsibilities

Where CreditChek provides services to a business customer and processes personal data on that customer's behalf, the customer is responsible for ensuring that it has an appropriate lawful basis and any necessary permissions to collect, use and provide the personal data to CreditChek.

Customers must:

• Comply with applicable data protection laws
• Ensure that personal data provided to CreditChek is collected lawfully
• Provide appropriate privacy notices to data subjects where required
• Obtain consent where consent is required
• Ensure that they have the necessary authority to provide personal data to CreditChek
• Only provide personal data necessary for the agreed service
• Comply with applicable restrictions concerning special categories of personal data
• Cooperate with CreditChek where information is reasonably required to comply with applicable data protection obligations

Where CreditChek processes personal data as a processor, we will process such data in accordance with the applicable agreement and documented instructions of the relevant controller.

19.0 Data Accuracy

CreditChek takes reasonable steps to ensure that personal data processed by us is accurate and up to date.

Where you believe that information we hold about you is inaccurate or incomplete, you may contact us using [email protected].

Where appropriate, we may work with the relevant lender, financial institution, credit bureau or other data source to investigate and correct inaccurate information.

20.0 Children's Data

Our services are not intended for children where processing their personal data is not permitted by applicable law.

Where we become aware that personal data has been collected or processed contrary to applicable requirements, we will take appropriate steps to address the situation.

21.0 Changes to This Policy

CreditChek may update this Policy from time to time to reflect:

• Changes in our products and services
• Changes in our data-processing activities
• Changes in applicable laws or regulations
• Changes in our privacy practices
• Changes in technology and security practices

Where required by law, we will provide appropriate notice of material changes.

The "Last Updated" date at the beginning of this Policy indicates when the Policy was most recently revised.

22.0 Contact Us

If you have questions about this Policy, our processing of personal data, or your data protection rights, please contact:

CreditChek Technologies Nigeria Limited

Data Protection Contact:
[email protected]

Website:
https://creditchek.africa