PENAID LIMITED PRIVACY NOTICE

Effective Date: This Privacy Notice was last updated August, 2025

At Penaid Limited ("Penaid", "we", "our", or "us"), your privacy and the security of your personal data are of utmost importance to us. We are committed to handling your personal data responsibly and in accordance with the Nigeria Data Protection Act 2023 ("NDPA 2023") and other data protection regulations. This Privacy Notice explains how we collect, use, disclose, and protect your personal data, as well as your rights under the law.

By accessing our website or using our services, you acknowledge and consent to the practices described in this Privacy Notice.

1. INTRODUCTION

This Privacy Notice informs you about:

The types of personal data we collect and process;
The legal basis for processing your data;
How we use and protect your data;
Your rights as a data subject;
How to contact our Data Protection Officer (DPO) for concerns regarding privacy rights;
The procedure for escalating unresolved complaints to the Nigeria Data Protection Commission (NDPC).

If you do not agree with any part of this Privacy Notice, kindly discontinue the use of our website and services.

2. DATA WE COLLECT

We collect and process different categories of personal data, including but not limited to:

2.1. Personal Data You Provide

Name, email address, phone number, date of birth, government issued ID, residential address
Financial details (for loan processing and transactions)
Employment and academic records (for relevant services)
Any other information you provide to us voluntarily

2.2. Data We Collect Automatically

IP address, browser type, and device information
Website usage statistics (e.g., pages visited, time spent on our site)

3. APPLICABLE LEGAL BASES FOR PROCESSING DATA

We process personal data under the following lawful bases:

3.1. Contractual Necessity

To provide financial and related services to pensioners and students
To process loan applications and manage accounts

3.2. Consent

When you opt into receiving marketing communications
When you provide information voluntarily through website forms

3.3. Legitimate Interests

To improve our website functionality and services
To protect against fraud and unauthorized access

3.4. Legal Obligation

To comply with applicable regulatory requirements and reporting obligations

4. DATA SHARING AND DISCLOSURE

We do not sell or trade your personal data. However, we may disclose your data in the following circumstances:

To service providers who assist in delivering our services (under strict data processing and confidentiality agreements);
To regulatory authorities where legally required;
In legal proceedings to protect our rights and interests.

5. DATA RETENTION

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Typically:

Loan application data is stored for up to five (5) years after the loan repayment process is completed to the extent necessary to comply with regulatory and anti-money laundering obligations.
Contact information is retained for marketing and communication purposes until you opt out.

6. YOUR RIGHTS UNDER THE NIGERIA DATA PROTECTION ACT 2023

As a data subject, you have the following rights:

Right to Access: Request details of personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure (Right to be Forgotten): Request deletion of your personal data under certain conditions.
Right to Restriction of Processing: Limit the way we process your data.
Right to Data Portability: Request transfer of your data to another organization.
Right to Object: Object to data processing based on legitimate interests.
Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

You can exercise your rights without any cost. However, by law, we are allowed to refuse your request or charge a reasonable fee if your request is excessive, clearly unreasonable, or would impose an undue burden on us. If we decide to charge a fee, we will notify you before processing your request.

If you wish to exercise any of your rights set out above, please contact our Data Protection Officer (DPO) at:

Email: dpo@penaid.ng
Address: 10, Bode Thomas Street, Surulere, Lagos, Nigeria

7. HOW TO REPORT PRIVACY CONCERNS

If you believe your data privacy rights have been violated or have any concerns about how we handle your data, you may contact our DPO through the contact details provided above.

If you are not satisfied with our response, you have the right to escalate the matter to the Nigeria Data Protection Commission (NDPC).

8. SECURITY MEASURES

We implement robust security measures to protect your data, including:

Encryption of sensitive data
Secure data storage and restricted access
Regular security audits and compliance checks

However, no system is completely secure, and we encourage you to take precautions, such as safeguarding login credentials.

9. UPDATES TO THIS PRIVACY NOTICE

We may update this Privacy Notice periodically. The latest version will always be available on our website. Continued use of our website or services after changes means you accept the revised Privacy Notice.

For any further inquiries regarding this Privacy Notice, please contact us at dpo@penaid.ng.