Privacy Policy
- Introduction/Scope
This document is prepared in accordance with the provisions of the Nigeria Data Protection Act (NDPA). It sets out how Boji Boji MFB Ltd applies and complies with the data privacy principles in processing the personal data of customers, staff, visitors, and even third parties that interact with the bank.
For personal data of individuals, this document also highlights their rights and covers the data subject(s) whose personal data is collected and processed, in compliance with the NDPA.
This privacy policy describes why and how we collect and use personal information about our customers, clients, vendors, and visitors (data subjects). It also highlights with whom we might share Personal Information and how long we keep such information. It also makes data subjects aware of their rights under the regulation. - Roles/Responsibilities
Boji Boji MFB Data Protection Officer (DPO) is responsible for ensuring that this document is correct and up-to-date. The DPO also ensures that data subjects are duly notified prior to the collection and processing of their personal data by the Bank, including data collected via the Boji Boji MFB’s website. All employees/staff who interact with personal data must also ensure to follow the provisions in this policy document. - Policy Statement
Boji Boji MFB Ltd is committed to protecting the privacy and security of our personal data. We are responsible for determining how we hold and use personal information about our data subjects. According to the Nigeria Data Protection Act (NDPA), the Bank is required to notify data subjects of the information contained in this document.
3.1 About Boji Boji MFB Ltd
Boji Boji Microfinance Bank is duly licensed by the Central Bank of Nigeria and registered with the Corporate Affairs Commission, Abuja. Under the Microfinance policy, regulatory and Supervisory framework for Nigeria, Microfinance Banks are allowed to render payment services such as payment of salaries, gratuities and pensions for workers of various tiers of Government.
Due to the nature of the bank’s business and the fact that Boji Boji MFB provides financial services, the Bank is mandated to collect and process personal data of Nigerian individuals.
3.2 What Personal Data Do We Need?
The personal data we would collect and process, depending on the particular processing requirement, are under the following categories:
Data Type Description of Data
Identity Data Full Name, maiden name, marital status, title, biometric information, national identification number (NIN), passport details, driver’s licence details, date of birth, gender, address, employment history and citizenship.
Contact Data Address, Email Address and Telephone Numbers
Information received during contact with face-to-face meetings, phone calls, emails, letters and SMS
Financial Data Bank account information and bank statements, Bank verification Number (BVN), income and outgoings, financial position, status, and credit history, debit or credit card information and account number.
Transaction Data Information regarding the products and services a data subject may have benefited from by using Boji Boji MFB and any of its subsidiaries, transactional information in respect of products purchased.
Profile Data includes username and password.
Job Application Data
data submitted throughout the recruitment process e.g.: name, email address. Any personal information you provide to Boji Boji MFB Ltd as part of the recruitment process.
Usage Data includes information about how data subject uses our website, products and services
Where the personal data we need to collect may fall under a special category of sensitive personal data, the Bank’s lawful basis of processing will be the explicit consent of the individual, or where applicable, compliance with a legal obligation, or for legal proceedings/advice.
- Why We Need the Data
Boji Boji MFB ensures that the personal data collected and processed is necessary for the purpose of collection, and shall not collect or process more data than is reasonably required for a particular processing activity. - Legal Grounds for Processing
The Bank identifies, establishes, defines, and documents the specific purpose of processing and the legal basis for processing personal data (including any special categories of personal data processed) before any processing operation takes place under:
• Consent obtained from the data subject
• Performance of a contract where the data subject is a party
• Legal obligation that the Bank is required to meet
• Protect the vital interests of the data subject, including the protection of rights and freedom of the Data Subject
• Official authority of the Bank or to carry out the processing that is in the public interest
• National law such as biometric data.
In addition, every processing purpose has at least one lawful basis for processing to safeguard the rights of the data subjects, as listed below:
Purpose of Processing Lawful Basis of Processing
Account creation, identity verification and maintenance of records Contract
Vendor validation/information processing Contract
Employment Contract - Processing of Personal Data Based on Consent
Where applicable, Boji Boji MFB will require the explicit consent of customers, visitors, and other relevant stakeholders to process collected personal data.
Visitors to the bank’s website are expected to read and understand the website privacy notice, and then agreeing to the website’s terms of use. And by consenting to the privacy policy, data subjects are giving Boji Boji MFB the permission to use/process their personal data specifically for the purpose identified before collection.
On this ground, if any data subject (customer, client, visitor, staff, or third party) does not agree to Boji Boji MFB collecting and processing their personal data, such individual is not allowed to enjoy the Bank’s service(s) where applicable.
If, for any reason, the Bank is requesting sensitive personal data from its stakeholders (external and internal), the individuals will be rightly notified why and how the information will be used.
Where processing relates to a child under 18 years old, as in the case of NDPA or 16 years in the case of GDPR, Boji Boji MFB shall demonstrate that consent has been provided by the person who holds parental responsibility over the child. The Bank shall demonstrate that reasonable efforts have been made to verify the age of the child and establish the authenticity of the parental responsibility taking into consideration available technology.
6.1 Withdrawal of Consent
Irrespective of initial consent given, an individual can withdraw their consent at any time by making a withdrawal of consent request.
Boji Boji MFB demonstrates the data subject (customer, client, visitor, staff, or third party) has withdrawn consent to the processing of his or her personal data with a written instruction from the data subject.
For child consent, Boji Boji MFB shall demonstrate that the holder of parental responsibility over the specified child has withdrawn consent via a written instruction from the parent. The Bank will also demonstrate that reasonable efforts have been made to establish the authenticity of the parental responsibility, when withdrawing consent for the specified child, considering available technology.
Where applicable, the Data Protection Officer will inform the relevant process owner of this change, and the processing activities that relied upon the consent is stopped immediately, in accordance with the relevant process. - Disclosure to Third-Parties
Aside situations where the Bank may be required to disclose personal data of individuals in accordance to a legal obligation in response to requests by government authorities or law courts on matters involving national security or law enforcement requirements, Boji Boji MFB will not pass on its data subjects’ personal data to third parties without first obtaining consent.
In situations where the processing of personal data will involve investigation of potential violations of the Bank’s Terms of Service, fraud prevention/mitigation, security issues management, and the preservation of the rights and freedom of staff, customers, and clients, the Bank shall establish an appropriate legal ground for such data transfers.
Boji Boji MFB has put in place, to the best of its ability and in line with standard global practices, physical, technical, and organisational measures (including secure encryption) to ensure the optimum protection of personal data. - Retention of Records
Boji Boji MFB stores a broad spectrum of personal information. All information the Bank holds is stored and retained, stored and destroyed in compliance with NDPA’s guideline on the retention of records and personal data.
Boji Boji MFB will retain your personal data as long as the information is active on the Bank’s systems and necessary for the Bank’s service delivery purposes. - Data Subject Rights
At any point while Boji Boji MFB is in possession of or processing personal data, the data subject, has the right to:
• Request a copy of the information that the Bank holds about them
• Correct the data that is inaccurate or incomplete
• Ask for their data to be erased from the Bank’s systems/records
• Restrict processing of their personal data where certain conditions apply
• Have their data transferred to another organisation
• Object to automated processing like profiling, as well as the right to be subject to the legal effects of automated processing or profiling
• Complain and pursue judicial review in the event that the Bank refuses their request under rights of access without a clear and justifiable reason as to why - Complaints
If for any reason a customer or staff wishes to make a complaint about how Boji Boji MFB (or any of the bank’s third parties) handles or have handled their personal data, or how their complaint has been handled, they have the right to lodge a complaint directly to Data Protection Office.