Àjọṣe - The Guaranteed Ajo Platform

This Privacy Policy sets out the statutory and operational framework under which [Àjọṣe Limited] ("Company", "We", "Us") collects, processes, stores, and transfers your personal and financial data. We are committed to strict compliance with the Nigeria Data Protection Act (NDPA) 2023 and the guidelines established by the Nigeria Data Protection Commission (NDPC).

Data Protection Officer (DPO): [Insert Email]

1. Open Banking Data Flows (Mono Integration)

1.1. Integration Nature: We utilize Mono, a licensed open-banking infrastructure provider, to securely interface with your primary financial institution.

1.2. Credential Security: The Company explicitly warrants that we do not view, process, transmit, or store your online banking passwords, personal identification numbers (PINs), or multifactor authentication tokens. Authentication occurs strictly via Mono’s secure API tokenization.

1.3. Data Processed: Upon your explicit digital mandate, we pull and process the following data streams via Mono: financial account metadata, transactional history, and electronic bank statements. We process this data strictly for the purposes of Know Your Customer (KYC) verification, algorithmic risk scoring, and monitoring the disbursement/contribution lifecycle of your Ajo groups.

2. NDPA Data Minimization vs. CBN Regulatory Retention

2.1. Statutory Conflict Resolution: The NDPA 2023 mandates the principle of data minimization and the prompt deletion of personal data when the original purpose of collection has been extinguished. However, as a CBN-licensed Payment Solution Service Provider (PSSP), we are concurrently bound by the Central Bank of Nigeria Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) Regulations.

2.2. Retention Period: In resolving this statutory overlap, we rely on the legal obligation basis for processing under the NDPA. Consequently, regardless of account closure or withdrawal of consent, all financial transaction data, identity verification records (BVN/NIN), and mandate logs shall be securely retained in our encrypted archives for a mandatory, non-negotiable period of five (5) years post-transaction, in strict accordance with CBN directives.

3. Lawful Basis and Data Subject Rights

3.1. Processing Basis: We process your data based on: (a) explicit consent, (b) the performance of a contract (facilitating the Ajo cycle), and (c) compliance with a legal obligation (CBN regulations).

3.2. Your Rights: Subject to the limitations set forth in Section 2.2, you retain the statutory right under the NDPA to request access to, rectification of, or restriction of processing concerning your personal data. Formal requests must be directed to our Data Protection Officer (DPO).