1. Introduction and scope
1.1 Our commitment to privacy
Collectiva Technologies Limited ("Collectiva," "we," "us," or "our") is a financial technology company that builds and provides digital solutions for cooperative societies across Nigeria. Our mission is to empower cooperatives by offering secure, innovative tools that simplify savings, loans, contributions, and comprehensive financial management.
This Privacy Policy ("Policy") outlines how we collect, use, process, share, and protect your personal data when you access and use our cooperative management platform ("Platform") and related services ("Services").
1.2 Platform security overview
All financial transactions on our Platform are processed securely through industry-leading, trusted third-party payment processors. Your funds are protected by state-of-the-art encryption, multi-factor authentication, and advanced fraud detection systems. We do not directly handle or store your payment card details; instead, all payments are encrypted and processed via PCI-DSS compliant gateways, ensuring maximum security and regulatory compliance.
1.3 Legal compliance
We are committed to safeguarding your privacy and ensuring that your personal data is handled responsibly and in full compliance with applicable data protection laws, including:
- Nigerian Data Protection Regulation (NDPR) 2019
- Nigerian Data Protection Act 2023
- Other applicable international data protection standards
1.4 Applicability
This Policy applies to all users of our Platform, including:
- Individual cooperative society members
- Cooperative society administrators and officers
- Platform visitors and prospective users
- Third-party service providers accessing our systems
2. Definitions
For purposes of this Policy, the following terms have the meanings set forth below:
- "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification numbers, location data, online identifiers, or factors specific to physical, physiological, genetic, mental, economic, cultural, or social identity.
- "Processing" means any operation performed on personal data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, or destruction.
- "Data Controller" means Collectiva Technologies Limited, which determines the purposes and means of processing personal data.
- "Data Subject" means the individual whose personal data is being processed.
- "Consent" means freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data.
3. Data collection and categories
3.1 Personal identification information
We collect the following personal information necessary for account creation and identity verification:
Basic identity data
- Full legal name as it appears on official documents
- Date of birth and age verification
- Gender and marital status (where relevant for cooperative policies)
- Government-issued identification numbers (NIN, BVN, etc.)
- Passport photograph or biometric data for verification
Contact information
- Primary and secondary email addresses
- Mobile phone number(s) and landline (if applicable)
- Residential address and postal code
- Emergency contact information
- Next of kin details (as required by cooperative policies)
3.2 Financial and transaction information
Banking and payment data
- Bank account details for disbursements and collections
- Bank Verification Number (BVN) for identity confirmation
- Payment method preferences (bank transfer, card, mobile money)
- Transaction histories including deposits, withdrawals, and transfers
- Loan application details, approval status, and repayment records
- Savings account balances and contribution histories
- Credit score and financial assessment information
Cooperative-specific financial data
- Membership fees and contribution schedules
- Share capital investments and dividend records
- Penalty fees and fine payment histories
- Cooperative loan terms, collateral information, and guarantor details
3.3 Technical and usage information
Device and access data
- Device type, model, and operating system version
- Web browser type and version
- IP address, MAC address, and device identifiers
- Geographic location data (with your consent)
- Network connection information and service provider
Platform usage analytics
- Login timestamps and session durations
- Feature usage patterns and navigation behavior
- App or web platform performance metrics
- Error logs and crash reports
- User interaction data and click-stream information
3.4 Communication and interaction data
- Messages sent through our Platform communication tools
- Customer service inquiries and support ticket histories
- Feedback, surveys, and user-generated content
- Marketing preferences and communication consents
- Social media interactions related to our services
3.5 Data minimization principle
We only collect personal data that is necessary, relevant, and adequate for the specific purposes outlined in this Policy and for the effective operation of cooperative societies using our Platform.
4. Purposes of data processing
4.1 Core service delivery
Account management and authentication
- Creating and maintaining user accounts and profiles
- Verifying identity and preventing unauthorized access
- Managing user authentication and security credentials
- Processing account updates and modifications
Financial services processing
- Facilitating secure savings collection and management
- Processing loan applications, approvals, and disbursements
- Managing contribution schedules and payment processing
- Generating financial statements and transaction records
- Calculating interest, dividends, and fee assessments
4.2 Communication and engagement
- Sending transactional notifications and confirmations
- Providing cooperative announcements and updates
- Delivering educational content and financial literacy materials
- Responding to customer service inquiries and support requests
- Conducting user satisfaction surveys and feedback collection
4.3 Security and fraud prevention
- Monitoring for suspicious activities and potential fraud
- Implementing risk assessment and management protocols
- Maintaining audit trails for regulatory compliance
- Preventing money laundering and other financial crimes
- Protecting against cyber security threats and data breaches
4.4 Analytics and service improvement
- Analyzing user behavior to improve service delivery
- Conducting performance monitoring and system optimization
- Developing new features and service enhancements
- Measuring user engagement and satisfaction metrics
- Conducting research for product development
4.5 Legal and regulatory compliance
- Meeting know-your-customer (KYC) requirements
- Complying with anti-money laundering (AML) regulations
- Fulfilling tax reporting and documentation requirements
- Responding to legal requests and regulatory inquiries
- Maintaining records as required by applicable laws
5. Legal basis for data processing
We process your personal data based on the following legal grounds:
- 5.1 Contract performance. Processing necessary for the performance of our service agreements with cooperative societies and individual users, including account management, transaction processing, and service delivery.
- 5.2 Legal obligations. Processing required to comply with applicable laws and regulations, including financial services regulations, tax obligations, and data protection requirements.
- 5.3 Legitimate interests. Processing for our legitimate business interests, including fraud prevention, security monitoring, service improvement, and direct marketing (where not overridden by your interests or fundamental rights).
- 5.4 Consent. Processing based on your explicit consent, which you may withdraw at any time, including for marketing communications, location tracking, and optional service features.
6. Data sharing and disclosure
6.1 Third-party payment processors
Your payment and financial transaction data is securely shared with trusted third-party payment processors, including but not limited to:
- Paystack and other licensed payment service providers
- Banking partners and financial institutions
- Mobile money operators and fintech platforms
These processors are bound by strict contractual obligations and utilize industry-standard encryption, PCI-DSS compliance, and fraud prevention practices to protect your financial information.
6.2 Cooperative society sharing
We may share relevant member information with your cooperative society for:
- Membership verification and governance purposes
- Financial reporting and transparency requirements
- Leaderboard displays and member recognition programs
- General meeting notices and voting procedures
- Compliance with cooperative bylaws and policies
6.3 Government and regulatory authorities
We may disclose personal data to government agencies, regulatory bodies, and law enforcement when:
- Legally required for audits, investigations, or regulatory compliance
- Responding to court orders, subpoenas, or legal processes
- Cooperating with anti-money laundering (AML) investigations
- Complying with tax reporting and documentation requirements
- Protecting against fraud, abuse, or illegal activities
6.4 Vetted service providers
We may share data with carefully selected service providers who assist in Platform operations, including:
- Cloud hosting and infrastructure providers
- Data analytics and business intelligence services
- Customer support and communication platforms
- Security monitoring and fraud detection services
- Marketing and customer engagement platforms
All service providers are bound by strict confidentiality agreements and data processing terms consistent with this Policy.
6.5 Business transfers
In the event of a merger, acquisition, or sale of business assets, personal data may be transferred to the acquiring entity, subject to the same privacy protections outlined in this Policy.
6.6 Data sale prohibition
We do not sell, rent, or lease your personal data to third parties for marketing or commercial purposes.
7. Data storage, security, and retention
7.1 Data storage infrastructure
- All personal and financial data is encrypted using industry-standard AES-256 encryption protocols
- Data is stored on secure, access-controlled servers with multiple layers of security
- Database access is restricted to authorized personnel with legitimate business needs
- Regular security audits and vulnerability assessments are conducted
Data is primarily stored within Nigeria and may be processed in other jurisdictions with adequate data protection standards. Cross-border transfers are conducted in accordance with applicable data protection laws.
7.2 Security measures
Technical safeguards
- Multi-factor authentication for administrative access
- Regular security patches and system updates
- Intrusion detection and prevention systems
- Automated backup and disaster recovery procedures
- Network segmentation and access controls
Administrative safeguards
- Comprehensive employee training on data protection
- Background checks for personnel with data access
- Incident response and breach notification procedures
- Regular privacy and security policy reviews
7.3 Payment data protection
Payment card information is not stored on our servers. All payment processing is handled by PCI-DSS compliant third-party processors who maintain the highest security standards for financial data protection.
7.4 Data retention periods
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:
- Active account data: retained while your account is active and for legitimate business purposes
- Financial records: retained for seven (7) years or as required by applicable financial regulations
- Marketing data: retained until consent is withdrawn or legitimate interest no longer applies
- Legal compliance data: retained as required by applicable laws and regulations
8. Your rights and choices
8.1 Access rights
You have the right to:
- Request confirmation of whether we process your personal data
- Obtain a copy of your personal data in our possession
- Receive information about the purposes and methods of processing
- Request details about data sharing and retention periods
8.2 Correction and update rights
You may:
- Correct inaccurate or incomplete personal data
- Update your contact information and preferences
- Modify your account settings and privacy preferences
- Request verification of data accuracy
8.3 Deletion rights
You may request deletion of your personal data when:
- The data is no longer necessary for the original purpose
- You withdraw consent and no other legal basis exists
- The data has been unlawfully processed
- Deletion is required for compliance with legal obligations
We may retain data when required by law, for legitimate business interests, or to protect legal rights.
8.4 Data portability
You have the right to:
- Receive your personal data in a structured, commonly used format
- Transmit your data to another service provider where technically feasible
- Request direct transfer of data between controllers when possible
8.5 Processing restrictions
You may request restriction of processing when:
- You contest the accuracy of personal data
- Processing is unlawful but you prefer restriction over deletion
- We no longer need the data but you require it for legal claims
- You object to processing pending verification of legitimate interests
8.6 Objection rights
You have the right to object to processing based on:
- Legitimate interests (including profiling)
- Direct marketing communications
- Scientific or historical research purposes
- Performance of tasks in the public interest
8.7 Consent withdrawal
Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.
9. Exercising your rights
9.1 Contact methods
To exercise any of your privacy rights, email [email protected] with the subject line "Privacy Rights Request". You can also call +234 901 635 8263, or write to Collectiva Technologies Limited, 8, Oluwalogbon Street, Ibadan, Oyo State, Federal Republic of Nigeria.
9.2 Request processing
We will respond to privacy rights requests within thirty (30) days of receipt. Complex requests may require additional time, not exceeding sixty (60) days total.
To protect your privacy, we may require identity verification before processing requests involving access to or modification of personal data. Please provide:
- Full name and contact information
- Specific right you wish to exercise
- Detailed description of your request
- Proof of identity as required
9.3 Appeal process
If you are unsatisfied with our response to your privacy rights request, you may:
- Contact our Data Protection Officer for review
- File a complaint with the Nigerian Data Protection Commission (NDPC)
- Seek legal remedies as provided by applicable law
10. Cookies and tracking technologies
10.1 Types of cookies used
Essential cookies
- Authentication and session management
- Security and fraud prevention
- Platform functionality and navigation
- Load balancing and performance optimization
Analytics cookies
- Usage statistics and performance monitoring
- User behavior analysis and service improvement
- Error tracking and debugging information
- Traffic analysis and demographic insights
Marketing cookies
- Personalized content and recommendations
- Targeted advertising and campaign measurement
- Social media integration and sharing features
- Cross-platform user recognition
10.2 Cookie management
You can manage cookies through your browser settings by:
- Accepting or rejecting all cookies
- Setting preferences for specific cookie types
- Deleting existing cookies from your device
- Receiving notifications when cookies are set
Our Platform provides cookie preference settings where you can:
- Choose which types of cookies to allow
- Update your preferences at any time
- Opt out of non-essential tracking
- Access detailed information about each cookie type
10.3 Third-party cookies
We may use third-party services that set cookies on our Platform, including:
- Google Analytics for usage analysis
- Social media platforms for content sharing
- Advertising networks for targeted marketing
- Customer support tools for service delivery
10.4 Impact of cookie restrictions
Disabling or restricting certain cookies may affect Platform functionality, including:
- Automatic login and session persistence
- Personalized user experience and preferences
- Analytics and performance monitoring capabilities
- Targeted content and feature recommendations
11. International data transfers
11.1 Transfer necessity
In the course of providing our services, we may transfer your personal data outside Nigeria to:
- Cloud service providers with international infrastructure
- Payment processors with global operations
- Analytics and security service providers
- Other jurisdictions for legitimate business purposes
11.2 Transfer safeguards
When transferring data internationally, we ensure adequate protection through:
- Adequacy decisions by relevant data protection authorities
- Standard contractual clauses approved by regulatory bodies
- Binding corporate rules and certification mechanisms
- Specific authorization for transfers in individual cases
11.3 Your rights regarding transfers
You have the right to:
- Receive information about international transfers of your data
- Obtain copies of safeguards implemented for data protection
- Object to transfers that do not meet adequacy requirements
- Request alternative processing arrangements where possible
12. Data breach notification
12.1 Our commitment to security
While we implement robust security measures to protect your data, we recognize that no system is completely immune to security incidents.
12.2 Incident response
In the event of a data breach that poses risks to your rights and freedoms, we will:
- Conduct immediate investigation and containment measures
- Assess the scope, impact, and risks associated with the breach
- Implement remedial actions to prevent further unauthorized access
- Document the incident and response measures taken
12.3 Notification procedures
We will notify the Nigerian Data Protection Commission (NDPC) within 72 hours of becoming aware of a qualifying data breach.
We will notify affected users without undue delay when the breach poses high risks to their rights and freedoms, providing:
- Clear description of the nature of the breach
- Likely consequences and potential impact
- Measures taken to address the breach and mitigate risks
- Contact information for questions and further information
- Recommendations for protective actions users can take
13. Children's privacy
13.1 Age restrictions
Our Platform is designed for adult users aged 18 years and above. We do not knowingly collect personal data from children under 18 years of age.
13.2 Parental consent
If we become aware that we have inadvertently collected personal data from a child under 18, we will:
- Delete the information immediately upon discovery
- Notify the child's parent or legal guardian if contact information is available
- Implement additional safeguards to prevent future collection from minors
- Review our age verification processes to prevent recurrence
13.3 Educational outreach
We may engage in financial literacy and cooperative education programs that involve minors, but such activities:
- Do not involve personal data collection or processing
- Require explicit parental consent for participation
- Are conducted in partnership with educational institutions
- Focus solely on educational content delivery
14. Privacy policy updates and changes
14.1 Policy modification rights
We reserve the right to modify this Privacy Policy at any time to reflect:
- Changes in our data processing practices
- Updates to applicable laws and regulations
- Introduction of new services or features
- Feedback from users and regulatory guidance
- Best practice developments in data protection
14.2 Notification of changes
For significant modifications that affect your rights or our use of your data, we will provide notice through:
- Email notification to registered users at least 30 days in advance
- Prominent notices on our Platform homepage and user dashboards
- In-app notifications and alerts
- SMS notifications for critical privacy updates
Minor clarifications, formatting improvements, and administrative updates will be reflected in the updated Policy with a revised effective date.
14.3 Acceptance of changes
Your continued use of our Platform following notification of Policy changes constitutes acceptance of the modified terms. If you do not agree to material changes, you may:
- Contact us to discuss your concerns
- Adjust your privacy settings to limit data processing
- Request deletion of your account and personal data
- Cease using our Platform and services
14.4 Policy version control
We maintain records of all Policy versions and will make previous versions available upon reasonable request for transparency and compliance purposes.
15. Contact information and Data Protection Officer
15.1 Privacy inquiries
For questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact:
- Data Protection Officer: [email protected] (subject line "Privacy Inquiry"), +234 901 635 8263
- Customer support: [email protected], +234 901 635 8263
15.2 Business hours and response times
Customer support hours
- Monday to Friday: 9:00 AM to 6:00 PM (West Africa Time)
- Saturday: 10:00 AM to 4:00 PM (West Africa Time)
- Sunday: emergency support only
Response times
- General inquiries: within 2 business days
- Privacy rights requests: within 30 days
- Data breach reports: immediate acknowledgment, full response within 72 hours
- Urgent security concerns: within 24 hours
15.3 Regulatory contact information
Nigerian Data Protection Commission (NDPC): www.ndpc.gov.ng, [email protected], +234 9 461 9368. For complaints regarding our data processing practices that cannot be resolved directly with Collectiva, you may file a complaint with the NDPC.
16. Effective date and acknowledgment
16.1 Policy effective date
This Privacy Policy is effective as of 9 June 2025 and applies to all personal data processing activities conducted by Collectiva Technologies Limited from that date forward.
16.2 User acknowledgment
By using our Platform and services, you acknowledge that you have:
- Read and understood this Privacy Policy in its entirety
- Been informed about our data collection and processing practices
- Had the opportunity to ask questions about our privacy practices
- Provided necessary consents for data processing activities
- Understood your rights and how to exercise them
16.3 Policy accessibility
This Privacy Policy is available on our website, within our mobile application settings, upon request in alternative formats for accessibility, and in both English and local languages upon request.
BY USING THE COLLECTIVA PLATFORM, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO THE TERMS OF THIS PRIVACY POLICY.