Privacy Policy

1. Introduction

This Privacy Policy governs the manner in which Pecantrust Microfinance Bank Limited ("Pecan Bank," "we," "our," and "us") collects, uses, stores and discloses information collected from our users ("you"). This policy describes what information we collect about you, how we collect and use the information you share with us, and with whom we share that information. You don't have to share any information with us, but to use our services, we'll need some information from you. This policy contains information about when we share your personal information with third parties (such as our credit bureaus and service providers).

This Privacy Policy applies to our websites, applications and/or any related services, sales, marketing, promotional or events, and social media activities (collectively, our “Services”). It applies to your use of our services, regardless of the means of access. It also applies to offline interactions with Pecan Bank. By accessing or using our services, you agree to this Privacy Policy.

We may update this Privacy Policy from time to time to reflect current privacy practices. When we make changes to this policy, we will notify you by revising the “effective date” at the top of this policy, and in some cases, we may provide you with additional notice (such as adding a statement to the homepages of our mobile application or website).

2. Consent

By accessing or using our services or otherwise providing your personal data, you accept this Privacy Policy and consent to the processing and transfer of your personal data when you sign up, and use our website, mobile application, including but not limited to related sites, applications, promotional activities and offline interactions or visits to our office(s).

The personal data we collect is governed by the Nigeria Data Protection Act 2023 (NDPA).

3. What information we collect

You may be asked to provide your information, including personal data, anytime you contact us or otherwise, to help us provide better services, including but not limited to adverts and content, performance evaluations, improving communication, performing due diligence (legal and business), and developing new services for all our users.

Categories of personal data

We collect the personal data you provide to us depending on the products and services. This applies to opening a Pecan Bank account or when you communicate with us about your Pecan Bank account. The type of personal data we may collect includes:

Account and Contact Information: name, email address, postal address, residential address, phone number, date of birth, means of identification (identification document number, passport number and/or national identification number (NIN) as required); billing information, next-of-kin information, financial information, and any other information required to comply with regulatory requirements.
Financial Information: Bank Verification Number, personal bank account number, credit card details, financial history (including information to determine your creditworthiness), and other information provided by financial institutions or merchants when we act on their behalf.
Biometric Information: such as images of you, fingerprints, face recognition and speech recognition, used to identify you for any form of account or during interaction with our customer service team.
Transaction Information: includes details about your transactions.
Device Information: includes information on the devices with which you access our products, website or application.
Profile Information: includes your username, password, transaction history, your interests, feedback and survey information.
Usage Information: includes your use of our products and services, the record of correspondence with us online and offline, page response times, download errors, page interaction information and browser methods. We may use your usage information to aggregate the percentage of users accessing our products and/or specific website features.
Marketing and Communications Information: includes information related to your interaction with our social media accounts, content and marketing campaigns (including details provided by you for a market survey) and our third parties, and your communication preferences.
Views, Opinions and Preferences: includes information regarding your views, opinions and preferences (such as surveys, feedback regarding our products or services, or online-based behaviour). We may also collect, use, store and share aggregated data such as demographic or statistical data for any purpose.
Third-Party Information: includes information collected about you from other companies (such as credit bureau agencies and collection agencies, to report account information as permitted by law; banking partners, as required for credit/debit card association rules; law enforcement, government officials or other third parties, pursuant to a subpoena, court order or other legal process applicable to us or one of our affiliates), as well as information provided to our affiliates and other trusted businesses or persons to process for us based on our instructions and in compliance with our privacy policy and any other confidentiality and security measures. This includes, without limitation, service providers who help deliver our products and services, conduct due diligence, improve our internal business processes, and offer additional support to customers, as well as users' personal information filled in as next-of-kin.

4. Personal data we collect

We (or our service providers acting on our behalf) may collect information about your use of our services. This information may include personal information as well as statistical information that does not identify you (“Analytics”). Some Analytics may be correlated with personal information. Where Analytics are, directly or indirectly, associated or combined with personal information, such Analytics will be considered personal information for the purposes of this Privacy Policy.

Device information

This includes device-specific information (such as hardware model, operating system version, unique device identifiers, and mobile network information, including your phone number). We may associate your device identifiers or mobile phone number with your Pecan Bank account.

Log information

We may record or log information from your devices, their software, and your activity accessing or using our services. This information may include:

The device's Internet Protocol (“IP”) address
Identification numbers associated with your devices
Device event information such as crashes, system activity and hardware settings
System configuration information
Date and time stamps of transactions
Other interactions with our service

Location information

Information regarding your current location, disclosed by GPS technology and other sensor data from your device; offline address; IP address; information about things near your device, such as Wi-Fi access points and cell towers; browser plug-in types and versions; system activity; crash reports; and date, time and referrer Uniform Resource Locators (URLs) in your clickstream, including the date and time of your request, collected with your prior consent. Any information collected via your use of Google Maps is transmitted directly to Google and is not collected by us. Please refer to Google's privacy policy for details about their collection, use and sharing of that information.

5. Use of cookies and other tracking technologies

We use cookies to personalise and improve our services for you, and to collect aggregate information about the usage of our services. A cookie is a text file or other local storage identifier provided by your browser or associated applications. We use cookies for record-keeping purposes, to enhance the quality of your use of our services. We may also collect information using web beacons (also known as “tracking pixels”). These are electronic images that may be used in our services or emails to help deliver cookies, count visits, understand usage and campaign effectiveness, and determine whether an email has been opened and acted upon.

6. How we use your personal information

We may use your information, including personal data, as follows:

Provide, maintain and improve our services
Carry out our obligations arising from any contracts entered into between you and us, and provide you with the information, products and services that you request from us
Notify you about changes to our service
Personalise and improve services, and provide content, advertisements or features that match your interests
Send you technical notices, updates, security alerts, and support and administrative messages
Monitor and analyse trends, usage and activities in connection with our services
Analyse internal operations for troubleshooting, data analysis, testing, research, and statistical and survey purposes
Make suggestions and recommendations to you about our services that may interest you
Carry out any other purpose for which the information was collected

We will use the information you provide to give you, or permit selected third parties to give you, information about goods or services we feel may interest you. If you are an existing customer, we will only contact you via electronic means (email or SMS) with information about goods and services similar to those which were the subject of a previous sale or negotiation of a sale to you. If you are a new customer, and where we permit selected third parties to use your data, we (or they) will contact you by electronic means only if you have consented to this. If you do not want us to use your data in this way, or to pass your details on to third parties for marketing purposes, you may unsubscribe from promotional emails via the link provided in each email.

7. How we share information

You agree that we have the right to share your information, and any other information you share with us:

If you request or authorise it
If the information provided is to help complete a transaction for you
For every business operation
With any of our affiliated companies or service providers
With non-financial companies, such as email service providers that perform branding and marketing services, and fraud-prevention service providers that use the information to provide services to us
With a non-affiliated third party, to access and transmit your personal and financial information according to the terms of their privacy policy
With selected third parties, including business partners and sub-contractors, for the performance of any contractual relationship established with them or you
In response to a request for information, if required, or if we believe disclosure is in accordance with applicable laws, rules, regulations, governmental and quasi-governmental requests, court orders, subpoenas or other legal processes
To protect our rights, property or safety, or the rights, property or safety of our users or others
For publication of our events and competitions on digital and print media
With law enforcement officials or third parties, such as auditors, if we believe it's appropriate to investigate fraud

8. Legal basis for the processing of personal information

We may process your personal data in the regular management of our business, and where we have a legal basis to do so. We consider the legal basis for using your personal data as set out in the Nigeria Data Protection Act 2023 (NDPA). These include:

To process personal information/data upon your consent
To perform a contract with you, or to take steps at your request before entering into a contract
To protect your interest, the interest of another data subject, or to perform a task carried out in the public interest or the legitimate interest of others
To maintain, monitor, improve and develop our business policies, systems and controls
To design, develop and test products, services and solutions
To customise products, services and solutions, messaging and advertising
To process and settle transactions and payments
To meet record-keeping obligations
To enable you to use value-added solutions and participate in reward programmes
To comply with integrity and business-conduct checks required for compliance purposes, including due diligence and onboarding processes, monitoring and assurance reviews, and conducting sanctions screening against any sanctions list
To comply with our legal and regulatory obligations
To detect, prevent and report theft, money laundering, terrorist financing, corruption or other potentially illegal activity, or activity that could lead to loss
To conduct research and analysis (which may include assessing product suitability, credit quality, insurance risks, market risks and affordability, and developing credit models and tools and obtaining related information)

9. Privacy by design

When designing and implementing a new business or technological process involving the collection, use or disclosure of personal data, we carefully consider the need for structured privacy planning for that process. For example, the Bank will assess the necessity of gathering solely the information essential for the initial business process.

10. Security of data

We have implemented thorough measures to safeguard your personal information from accidental loss, unauthorised access, or misuse by third parties. These measures include appropriate technical and organisational procedures, as well as security protocols. Our processes are designed specifically to protect your data from unauthorised access, unlawful processing, and accidental loss, damage or destruction. This includes restricting access to your personal data to only those employees, agents and third parties who have a legitimate business need to access it.

As part of our standard procedures, Pecan Bank adheres to global Information Security Management Systems (ISMS) protocols, and integrates both digital and physical security measures to mitigate or eliminate the risk of data-privacy breaches. Nevertheless, we strongly advise against sharing confidential information, including passwords, with anyone.

It is important to note that, despite our efforts to maintain a secure online environment, we cannot ensure 100% safety on the internet. As a precaution, we urge you to protect your Pecan Bank account login username and password, refrain from sharing them with others, and access our services within a secure setting. Where instructions are received using your Pecan Bank account login information, we will interpret this as authorisation for those instructions. By using our services, you agree to promptly notify us of any unauthorised use of your account or any security breach.

11. Disclosure of personal data

We may disclose information we collect about current and former customers to affiliates as follows:

If you request or authorise it
If the information is provided to help complete a transaction for you
If the disclosure is required by authorised employees of Pecan Bank, for the purpose of issues associated with the use of our services

If the information is required to:

Publicise our events and products on digital and print media
Examine data to enhance the optimisation of our corporate and product website
Comply with applicable laws, rules, regulations, governmental and quasi-governmental requests, court orders or subpoenas
Enforce our terms of use and other agreements
For everyday business purposes
Protect our rights, property or safety, or the rights of our users or others
Share with delivery companies, for dispatch of ATM cards upon your request
Share with third-party payment-processing services when you pay through our website or mobile application

We refrain from sharing your personal information with any third parties for marketing purposes.

12. Where we store your data

We transfer and store your personal information in our offices and authorised computer systems within Nigeria. By submitting your data, you consent to this transfer, storage and/or processing. We have implemented appropriate measures to ensure the secure treatment of your data in accordance with this Privacy Policy.

All the personal information you provide is stored on our secure servers. For added security, all transactions are encrypted using Secure Sockets Layer (SSL) technology.

13. Your rights

The Nigeria Data Protection Act 2023 (NDPA) gives you certain rights in respect of the information we hold about you. As a data subject, you have the following rights:

Right of Access. Data subjects have the right to obtain confirmation from Pecan Bank as to whether their personal data is being collected, stored or otherwise processed. Where such processing occurs, Pecan Bank shall grant access to the data. Pecan Bank shall respond to all valid subject access requests within the timelines prescribed under applicable regulations, and shall maintain records of such requests for audit and regulatory inspection.
Right to Rectification. Data subjects have the right to request correction or completion of inaccurate or incomplete personal data. Pecan Bank shall promptly verify the accuracy of the contested data and make any necessary adjustments.
Right to Erasure. Data subjects may request the deletion of their personal data where:
1. the data is no longer necessary for the purpose for which it was collected;
2. consent has been withdrawn and no other lawful basis exists;
3. processing is unlawful; or
4. deletion is required to comply with a legal or regulatory obligation.
Pecan Bank shall ensure such requests are honoured, unless retention is required by law, regulation, or an ongoing contractual obligation.
Right to Restriction of Processing. Data subjects can request that data processing be restricted in the following circumstances:
1. if the accuracy of the personal data is being contested;
2. if the data is no longer needed for the processing, but is required by the data subject for the establishment, exercise or defence of legal claims; or
3. if the data subject has objected to the processing, pending verification of that objection.
During restriction, Pecan Bank shall ensure the data is stored securely and not further processed, except as permitted by law.
Right to Object to Processing of Data. Data subjects may object to the processing of their personal data on legitimate grounds, including objections to processing for direct marketing, market research or profiling purposes. Unless Pecan Bank can demonstrate overriding legal or regulatory grounds, such objections shall be respected.
Right to Data Portability. Where personal data has been provided by the data subject and is processed by automated means under a contract or consent, the data subject has the right to receive the data in a structured, commonly used and machine-readable format. Upon request, Pecan Bank shall facilitate the transfer of such data to another data controller, where technically feasible.
Right to Withdraw Consent. Where processing is based on consent, the data subject may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
Right to Lodge a Complaint. Data subjects have the right to lodge complaints with the Nigeria Data Protection Commission (NDPC), or any other relevant supervisory authority, regarding violations of their privacy rights. Pecan Bank also provides an internal complaints channel to address grievances promptly.
Right to Notification of a Data Breach. Where a data breach is likely to result in a high risk to the rights and freedoms of a data subject, Pecan Bank shall promptly notify the affected individual(s) in accordance with the NDPA, in addition to notifying regulators.

14. Children's privacy

Our services are not intended for children under the age of 18 without the approval of a parent or guardian. All personal information for such customers is provided by the guardian. It is essential for a parent or guardian to thoroughly review this policy, to understand how we collect, use and disclose all personal information provided.

Except as it pertains to the services or products of the Bank, we do not knowingly collect personal information from children under the age of 18, except under the conditions stated above. If we become aware that we have collected personal data from anyone without verification of parental consent, we take appropriate steps to remove that information from our servers. Please contact us as provided in the “Contact Us” section below for further assistance.

15. Retention of information

Your personal data will only be retained to achieve the purposes for which it was collected, for as long as it is active or required to provide you with our services, or to comply with our legal and statutory obligations.

16. Breach of data privacy

While Pecan Bank takes reasonable precautions to minimise the occurrence and impact of personal-data breaches, the risk cannot be completely eliminated. Where there is reasonable suspicion or awareness of a personal-data breach, or a compromise of the integrity or confidentiality of personal data, Pecan Bank will, within 72 hours of such knowledge, report the details of the breach to the Nigeria Data Protection Commission (NDPC).

Where it is determined that such a breach poses a risk to your rights and freedoms, Pecan Bank will, within 7 days of such knowledge, take steps to inform you of the breach. This communication will include details of the breach, the potential risks to your rights and freedoms resulting from it, and any recommended course of action to remedy the situation.

17. Deletion of personal data

We store data until it is no longer necessary to provide our services and Pecan Bank products, or until your account is deleted, whichever occurs first. This differs case by case, depending on the nature of the data, why it was collected and processed, and relevant legal or operational retention needs. When you delete your account, we delete all financial transaction history and communications, and you will not be able to retrieve this information later. This policy does not apply to account deactivation.

18. Training

Pecan Bank ensures comprehensive training on data privacy and protection for all employees involved in collecting, accessing and processing personal data. This training equips them with the skills, knowledge and competence to effectively handle the compliance framework outlined in this Privacy Policy and the Nigeria Data Protection Act 2023 (NDPA). Pecan Bank also develops an annual capacity-building plan to enhance employees' understanding of data privacy and protection, in line with the requirements of the Nigeria Data Protection Act.

19. Changes to our Privacy Policy

We may update this Privacy Policy from time to time to reflect current privacy practices. When we make changes to this policy, we will revise the “effective date” of this policy and notify you by posting a notice on our website. You are advised to review this Privacy Policy periodically for any changes.

20. Contact us

If you have questions, complaints or suggestions relating to the processing of your personal information by Pecantrust Microfinance Bank, or require clarification regarding this Privacy Policy, you can contact us using any of the details below:

Email: info@mypecanbank.com
Office: No. 32, Grace Anjous Drive, Lekki Phase 1, Lagos State.