Privacy Policy

Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable individual, as defined under the NDPA 2023.
• "Business Data" means information about your organisation, including registration details, documents, wallet activity, orders, and loans.
• "Processing" means any operation performed on personal data, including collection, storage, use, and disclosure.
• "Data Controller" means the party that determines the purposes and means of processing personal data.
• "Third Party" means any individual or organisation other than you, your organisation, and CreditVeto Africa.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data.

Data We Collect

To deliver our services, CreditVeto Africa collects, stores, and processes the following categories of data:

Account and Contact Information

• Full name, work email address, phone number, and role of each person on the account
• Passwords, which are stored only in hashed form
• Staff range, the products you choose, and any field agent code given at signup
• Details of team members you invite

Business Information

• Business name, CAC registration details, date of incorporation, sector, and business address
• Documents you upload, such as proof of address, sector licences, and financial statements

Identity of Owners and Directors

• Bank Verification Number (BVN), National Identification Number (NIN), and the result of verifying them

BVN and NIN are collected solely to verify identity and meet our legal obligations. This data will not be shared with any third party beyond what is strictly necessary for identity verification or required by law.

Financial Information

• Payout and withdrawal bank accounts, with the account name we look up to confirm them
• Linked bank account data (account details, balances, and transactions), where you choose to link an account and with your explicit consent
• Wallet balances, payments, withdrawals, orders, loans, and repayments on CreditVeto Business
• Card and bank payments are processed by our payment provider. We do not store full card numbers.

Data You Provide About Other People

• Details you enter to run a Scorely credit check (such as name, BVN, and phone number) and the credit report returned
• Details of your customers, buyers, borrowers, or employees that you add while using our tools

Your organisation decides why this data is used and is responsible for having a lawful basis for it, including any consent required by the Credit Reporting Act 2017 before a credit report is obtained. We process it on your instructions and as this Policy describes.

Device & Technical Data

• IP addresses, browser and device type, and logs of activity on your account
• Sign-in cookies that keep you logged in, and a browser setting that remembers your active organisation
• Fraud detection and security signals, including unusual activity patterns

CreditVeto Business does not use advertising cookies or third-party advertising trackers.

How We Use Your Data

CreditVeto Africa uses collected data to:

• Create and operate your account and provide the products you sign up for
• Verify your business and the people behind it, and determine which features your business can use
• Run credit checks you request, and give lenders the application data they need to decide on credit you apply for
• Process payments, wallet credits, withdrawals, and refunds, and keep accurate financial records
• Detect and prevent fraud, money laundering, and other suspicious activity
• Send service messages, such as one-time codes, order updates, and changes to this Policy
• Respond to support requests and resolve disputes
• Improve our products and platform performance using aggregated or anonymised data
• Meet our legal and regulatory obligations

We will not use your data for any purpose not described in this Policy without first obtaining your separate, explicit consent.

Data Sharing: Third Parties & Service Providers

We do not sell personal data. To operate the platform, we share data only as needed with:

• Cloud infrastructure, data hosting, and email providers
• Identity and business verification providers (for BVN, NIN, and CAC checks only)
• Credit bureaus licensed by the Central Bank of Nigeria, when you run a Scorely credit check
• Bank account linking and payment providers, to link accounts, take payments, confirm account names, and send transfers
• Lenders you apply to and merchants you buy from, for that application or order only
• The field agent who onboarded your business, who sees your business name, when you joined, and your verification status, but not your documents or identity numbers
• Regulators, law enforcement agencies, and courts, where the law requires it

All service providers are contractually bound to handle your data securely and only for the specific purpose for which it was shared. Where a provider processes data outside Nigeria, we transfer it only as the NDPA 2023 allows.

Data Security

CreditVeto Africa implements reasonable technical and organisational measures to protect your data, including:

• Encrypted data transmission (TLS/SSL protocols)
• Secure cloud infrastructure with access controls
• Hashed passwords, and one-time codes sent by email before withdrawals
• Role-based access, so only the people in your organisation you allow can see or act on its data
• Internal access restrictions limiting data access to authorised personnel only
• Fraud monitoring and anomaly detection systems

By using this platform, you acknowledge that no digital system can guarantee absolute security and accept the residual risks associated with data transmission over the internet. If a personal data breach is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission and affected users as the NDPA 2023 requires.

Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required by law or necessary for legal proceedings. Identity verification and transaction records are kept for at least five years after our relationship ends, as anti-money laundering law requires.

Your Rights

Under the NDPA 2023, you have the right to:

• Know how your data is used and request a copy of it
• Have inaccurate or incomplete data corrected
• Request deletion of your data where we no longer have a reason to keep it
• Restrict or object to the processing of your data
• Receive your data in a common, machine-readable format
• Withdraw your consent at any time
• Request human review of a decision made solely by automated means that significantly affects you

To exercise any of these rights, contact us using the details below. If you are not satisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission.

Changes to This Policy

CreditVeto Africa reserves the right to amend this Privacy Policy to reflect changes in our practices, legal requirements, or advancements in technology. We will notify you via the platform or by email at least 14 days before they take effect. Continued use of the platform constitutes acceptance of the revised policy.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at [email protected].

Thank you for entrusting us with your information. We are committed to protecting your privacy and providing you with exceptional service.