Data Privacy Policy

4.0 Roles and Responsibilities

In compliance with the Regulation, below are some stakeholders and their responsibilities to drive the operationalization of the Policy and implementation of necessary data protection controls within the company.

8.0 Data Privacy Policy

8.1 Overview

The Bank considers customers data as confidential, and strives to adequately protect such data from unauthorized use and/or disclosure. The Bank shall ensure that the Data Subjects are provided with adequate information regarding the use of their data as well as secure their requisite consent, where necessary. Also, the Bank shall display a simple, visible and clear notice (Privacy policy) on any medium through which customers data is being collected or processed. The following information shall be considered for inclusion in the Privacy policy, as appropriate in distinct circumstances in order to ensure fair and transparent processing:

1. Data subjects’ consent.
2. Description of collectable information.
3. Purpose of collection of data.
4. Technical methods used to collect and store information, cookies, web tokens, etc.
5. Access, if any, of third parties to data and purposes of such access.
6. A highlight of the principles governing data processing.
7. Available remedies in event of a violation of the privacy policy.
8. The timeframe for remedy.
9. Any limitation clause, provided that such limitation clause does not exonerate the operator from breaches of the Regulation.

Pursuant to its statutory mandate of rendering Microfinance Banking Services in which the Bank received license from Central Bank of Nigeria to do, Polyunwana Microfinance Bank Nigeria Limited (the Bank) collects and takes custody of data of customers (personal, organization, company) and their related persons, such as beneficiaries and next-of-kins and their employers. The data include, but are not limited to, the biodata of customers and related persons.

This Data Privacy Policy (the Policy) is, therefore, instituted by the Bank to inform customers and other related persons of the protection of their data collected and stored by the bank’s pursuant to the performance of its business and service responsibilities. The Policy also explains how the data are collected, stored and used. It highlights the few exceptional instances for disclosed.

8.1.1. Nature and reason for collection of personal data

In order to provide adequate and satisfactory banking services and in line with extant regulations, the Bank collects data of customers and their related persons. These may include name, gender, marital status, date of birth, nationality, National Identification Number, employment information and Next-of-Kin Information, business name, address, Corporate Affairs Commission registration documents, Personal Details of Directors amongst others.

Data collected and processed by the Bank may include but are not limited to:

1. Contact data (e.g. name, telephone, e-mail, address, IP address).
2. Customer’s account details
3. Information about next of kin.
4. Disclosed information (from third parties).
5. Employee and prospective employee data collected for recruitment and onboarding purpose.

Methods adopted by the Bank in the collection and storage of data may include but are not limited to:

1. Cookies.
2. CCTV recordings.
3. Physical and Online Forms
4. External hard drive
5. Audio and video call recordings

The Bank collects the data of a customer or prospective customer and to render Banking services to the customer. In this regard, it is necessary, to collect some private data of customers to ensure that uniquely identifiable client are registered in the Bank’s Database. It also facilitates the accurate classification of customers and proper service rendition processes.

8.2 Consent of Data Subject

Collection of customers data by the Bank shall be subject to the consent and authorization of the Data Subjects. Consequently, account opening, loan application, loan renewal, overdraft, employee, atm request, ussd request, fixed deposit, fund transfer and client update forms, including the electronic formats, contain data authorization clauses which are activated when the data subject completes the form.

8.3.1 Procuring Consent

Where the processing of customers Data is based on consent, the Bank shall obtain the requisite consent of the data subjects at the time of collection of customer Data. In this regard, the Bank will ensure:

1. that Customer Data is not obtained except the specific purpose of collection is made known to the data subject
2. that the consent of Data Subject has been obtained without fraud, coercion, or undue influence
3. that the data subject has consented to processing of his or her data and has the legal capacity to give consent, where processing is based on consent
4. that request for consent is in a manner which is clearly distinguishable from other matters, in an intelligible and easily accessible form, using clear and plain language, where the data subject’s consent is given in the context of a written declaration
5. that the Data Subject is informed of his/her right.
6. that when assessing whether consent is freely given, the Bank shall take account of whether the performance of a contract, including the provision of a service, is conditional on consent to the processing of customer data that is either not necessary or excessive for the performance of the contract
7. that the consent of the data subject is obtained where data may be transferred to a third party for any reason.

8.3.2 Valid Consent

For consent to be valid, it must be given voluntarily by an appropriately informed Data Subject. In line with regulatory requirements, Consent cannot be implied. Silence, or inactivity does not constitute Consent under the NDPR.

8.3.3 Consent of Minors

The consent of minors (under the age of 18) will always be protected and obtained from minor’s representatives following applicable regulatory requirements.

8.6.0 Data Processing

8.6.1 Disclosure of Personal Data

Without prejudice to the foregoing provisions, however, the Bank may be obliged to disclose personal data in its custody in the following circumstances:

1. Where disclosure is made in compliance with statutory obligation or under an order of a court of competent jurisdiction.
2. Where the Data Owner has expressly consented to the disclosure or instructed that his/her data be fully or partially disclosed to a named person or organization; Provided that such consent or instruction may be withdrawn and communicated to the Bank in writing at any time before disclosure.

Where the disclosure is made to the named person or organization for his/her use or record.

8.6.2 Disclosure of Personal Data

Customer’s data can only be transferred to Third Party Data Processing Contracts. To ensure compliance with the Regulation, being a Data Controller, the Bank shall:

1. Ensure that a written contract is signed by a third party that will process personal data of individuals/organizations.
2. Ensure that such third party that will process the data obtained from data subjects, complies with applicable laws and regulations.

8.6.3 Transfer of Personal Data to Foreign Country

Where Customer Data is to be transferred to a country outside Nigeria, the Bank shall put adequate measures in place to ensure the security of such Customer Data. In particular, the Bank shall, among other things, conduct a detailed assessment of whether the said country is on the National Information Technology Development Agency (NITDA) White List of Countries with adequate data protection laws.

The Bank shall comply with the Regulation and any transfer of customer data that is undergoing processing or is intended for processing after transfer to a foreign country or an international organization, shall take place subject to the provisions of the Regulation.

8.6.4 Exceptions in Respect of Transfer to a Foreign Country

In the absence of any decision made by NITDA or the Honorable Attorney General of the Federation (HAGF) on the transfer of customer data to a foreign country, the operator shall initiate the transfer or set of transfers of customer data to such foreign country or an international organization only when:

1. The data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers to the data subject due to the absence of an adequate decision and appropriate safeguards and that there are no alternatives.
2. The transfer is necessary for the performance of a contract between the data subject and the Bank or the implementation of pre-contractual measures taken at the data subject's request
3. The transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the operator and another natural or legal person
4. The transfer is necessary for important reasons of public interest
5. The transfer is necessary for the establishment, exercise, or defense of legal claims
6. The transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent

The Bank, in compliance with the Regulation, shall explicitly communicate through clear warnings, the specific principle(s) of data protection that is likely to be violated in the event of a transfer to a third country.

11.0 Rights of Data Subjects

The Bank shall:

• Take appropriate measures to provide any information relating to processing, to the data subject in a concise, transparent, intelligible, and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child
• Provide such information in writing, or by other means, including, where appropriate, by electronic means
• Provide any information relating to the processing of data obtained from the data subject orally, at the request of the data subject, provided that the identity of the data subject is proven by other means
• Inform the data subject without delay and at least within one (1) month of receipt of a request relating to the processing of his/her data, the reasons for not providing the information and the possibility of lodging a complaint with the supervisory authority
• Provide information, any form of communication or any actions taken to a data subject free of charge
• Charge data subject if the request for his/her data is manifestly unfounded or excessive, in particular, because of his/her repetitive character. The charge shall be a reasonable fee considering the administrative costs of providing the information or communication or taking the action requested
• Write a letter to the data subject stating “refusal act” on the request and copy NITDA on every occasion through a dedicated channel which shall be provided for such purpose, provided that such request is excessive
• Bear the burden of demonstrating the manifestly unfounded or excessive character of the request
• Request for provision of additional information necessary to confirm the identity of the data subject where the operator has reasonable doubts concerning the identity of the requestor
• Provide the information in combination with standardized icons in order to give in an easily visible, intelligible, and legible manner, a meaningful overview of the intended processing and machine-readable format when presented electronically
• Provide the data subject with all of the following information, before collecting personal data:
• The contact details of the Data Protection Officer
• The purposes of the processing for which the customer data are intended as well as the legal basis for the processing
• The legitimate interests pursued by the operator or by a third party
• The recipients or categories of recipients of the customer data, if any
• The period for which the customer data will be stored, or if that is not possible, the criteria used to determine that period
• The existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal
• The right to lodge a complaint with a relevant authority
• Whether the provision of customer data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the customer data and of the possible consequences of failure to provide such data
• The existence of automated decision-making, including profiling and, at least, in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject
• Inform the data subject of the appropriate safeguards for data protection in the foreign country
• Rectify, without undue delay, inaccurate customer data concerning data subjects per their request
• Acknowledge the right of data subjects to have their incomplete data completed, including utilizing a supplementary statement
• Delete customer data where one of the following grounds applies:
• The customer data are no longer necessary in relation to the purposes for which they were collected or processed
• The data subject withdraws the consent on which the processing is based
• The data subject objects to the processing and there are no overriding legitimate grounds for the processing
• The customer data have been unlawfully processed
• The customer data have to be erased for compliance with a legal obligation in Nigeria
• Take all reasonable steps to delete all the customer data made public and inform other companies/Banks processing the customer data of the data subject’s request
• Acknowledge data subjects’ rights to obtain restriction of processing their data where one of the following applies:
• The accuracy of the data is contested by the data subject for a period enabling the operator to verify the accuracy of the data
• The processing is unlawful, and the data subject opposes the erasure of the data and requests the restriction of their use instead
• The Bank no longer needs the data for processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims
• The data subject has objected to processing pending the verification to confirm whether the legitimate grounds of the operator override those of the data subject
• Process data with the data subject’s consent, where processing has been restricted
• Communicate any rectification or erasure of data or restriction to each recipient to whom the data has been disclosed, unless this proves impossible or involves disproportionate effort
• Provide data concerning data subjects, in a structured manner, commonly used and machine-readable format to such data subjects
• Not hinder the data subject from transmitting those data in its database to another Bank/company where the processing is based on consent, on a contract and processing is carried out by automated means
• Execute data subjects’ requests on the transmission of their data to another company/Bank, where technically feasible.at a reasonable cost.

Data Subjects can exercise any of their rights by writing to the Bank of their intents via dataprotectionofficer@polyunwanamfb.com

13.0 Data Protection Impact Assessment

As part of the risk and audit assessment, the Bank shall carry out a Data Protection Impact Assessment (DPIA) in respect of any new project or IT system involving the processing of Customer Data to determine whenever a type of processing is likely to result in any risk to the rights and liberties of the Data Subject.

14.0 Data Security

All Customers Data must be kept securely and should not be stored any longer than necessary. The Bank will ensure that appropriate measures are employed against unauthorized access, accidental loss, damage, and destruction to data. This includes the use of password, encryption of databases for digital storage and locked cabinets for those using a paper form.

To ensure the security of Customer Data, the Bank will, among other things, implement the following appropriate technical controls:

1. Develop security measures including but not limited to protecting systems from hackers
2. Set up firewalls and protect email systems
3. Store data securely with limited access to specifically authorized individuals
4. Employ data encryption technologies on workstation/laptops. Also implementing encryption at rest including key management
5. Develop an organizational policy for handling customer data and other sensitive or confidential data
6. Continuously build capacity for all staff
7. Industry-accepted hardening standards i.e. enhancing the system’s security features which include (the use of strong passwords for authentication, minimizing unnecessary software etc.), for workstations, servers, and databases.
8. Restrict the use of removable media such as USB flash, disk drives.
9. Anonymization techniques on testing environments; and
10. Physical access control where Customer Data is stored in hardcopy.

15.0 Personnel Training

The Bank shall ensure that employees who collect, access and process Customers Data receive adequate data privacy and protection training in order to develop the necessary knowledge, skills and competence required to effectively manage the compliance framework under this Policy and the NDPR concerning the protection of Customer’s Data. On an annual basis, the Bank shall develop a capacity building plan for its employees on data privacy and protection in line with the NDPR.

16.0 Data Protection Audit Assessment

The Bank shall conduct periodic data protection audits through a licensed Data Protection Compliance Organization (DPCOs) to verify the company’s compliance with the provisions of the NDPR and other applicable data protection laws.

The audit report will be certified and filed by the DPCO to NITDA as required under the NDPR.