EqualX Privacy Policy
This Privacy Policy (the “Policy”) applies only to all our products and services provided by Equal X Limited (“EqualX” or the “Company”)and is valid for visitors to our website, mobile apps, and API (“Sites”) and offices with regards to the information that they shared and/or collect in EqualX . This Policy discloses our data protection practices on our Sites, products and services, including the type of personal data that we collect, our method of collection of personal data, use of personal data and procedures for sharing personal data with third parties. We are committed to protecting your personal data in accordance with the provisions of Nigeria Data Protection Act 2023 and other applicable data protection laws and regulations (“Data Protection Laws”).
Kindly note that by visiting the Site, you agree to this Privacy Policy, and by continuing to visit our website and use our services you accept and consent to the practices contained in our privacy policy.
Lawful Basis for Collecting and Processing Personal Data
In compliance with the provisions of Data Protection Laws, we process your personal data in line with the following legal basis:
- 1.
Consent: where you have consented to our processing of your personal data for one or more specific reasons. Such consent is given by you through your continuous use of the Services and the Sites.
- 2.
Performance of a contract: in order to perform a contract we have with you or a contract to which you are a party to and in order to take necessary steps at your request prior to entering into such a contract.
- 3.
Legal obligation: where processing of personal data is required by law. We are required by law to retain certain account opening information and personal data of our customers beyond the date such customers cease to carry on business with us.
- 4.
Legitimate interest: in order to protect legitimate interests of data subjects, and in order to carry out the purposes of our business, such as account opening, and processing financial transactions. In addition to this, we have a legitimate interest to prevent fraud, money laundering and to verify identity of data subjects, in order to protect our customers and business, to understand how people interact with our Sites, to provide communication which we think will be of interest to you and to determine the effectiveness of promotional campaigns and advertising.
- 5.
Vital interest: in order to process data for data subjects when they are in critical life threatening situations where they may not be able to provide consent for data processing, and which may be vital for the subjects survival.
- 6.
Public interest: such processing is necessary for the performance of a task carried out in the interest of the public on in exercise of an official public mandate vested on us.
1. Privacy Right
- 1.1.
This Privacy Policy describes your privacy rights regarding our collection, use, storage, sharing and protection of your personal information.
- 1.2.
If you have created a username, identification code, password or any other piece of information as part of our access security measures, you must treat such information as confidential, and you must not disclose it to any third party.
- 1.3.
We reserve the right to disable any user identification code or password, whether chosen by you or allocated by us, at any time, if in our opinion you have failed to comply with any of the provisions of this Policy.
- 1.4.
If you know or suspect that anyone other than you knows your security details, you must promptly notify us by sending an email to “info@equalx.tech” or call “+234 816 505 0647”.
2. Consent
By using the Platform or any of our services, you hereby consent to our Policy and any other modification to it from time to time. We may amend this privacy policy at any time by posting a revised version on our website, or placing such notice at conspicuous points at our office facilities. The revised version will be effective 7 days after publication.
3. Information We Collect
The personal information that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your personal information. If you register on the Site, you will be required to provide your full name, username, password, your email address, phone number.
If you contact us directly, we may receive additional information about you such as your name, email address, phone number, the contents of the message and/or attachments you may send us, and any other information you may choose to provide. For payment processing, you will be required to provide your bank account details including the bank name, account name and account number. For compliance and KYC purposes, you may be required to provide more personal information and documents like your ID and BVN. To fully access our products and services, we may request you to provide payment card information, identification documents, preferences, interests, feedback, survey responses, marketing communication preferences (including preferences for receiving marketing information from us or third parties), and communication preferences, among others
Information We May Collect About You
We may collect, use, process, store, or transfer personal information such as:
- 1.
Contact Data: This is data that is needed to reach out to you, such as your contact address, email address, telephone number, details of the device you use, and billing details;
- 2.
Identification documents: (such as your passport or any Government-issued identity card), a photograph (if applicable), and any other registration information you may provide to prove you are eligible to use our services;
- 3.
Log/Technical information: When you access EqualX services, our servers automatically record information that your browser sends whenever you visit a website, links you have clicked on, length of visit on certain pages, unique device identifier, log-in information, location, and other device details.
- 4.
Financial Data: Information, such as personal account number, the merchant's name and location, the date and the total amount of transaction, and other information provided by financial institutions or merchants when we act on their behalf;
- 5.
Transactional Data: These are information relating to payment when you as a merchant (using one or more of our payment processing services) or as a customer, are using our products or services;
- 6.
Marketing and Communications Data: This includes both a record of your decision to subscribe or to withdraw from receiving marketing materials from us or from our third parties.
- 7.
Records of your discussions with us, if we contact you, and if you contact us.
- 8.
Other unique identifiers such as but not limited to MAC address, IP address, IMEI number, IMSI number, SIM.
- 9.
We may also collect, store, use, and transfer non-personal information or anonymized data such as statistical or demographic data.
This Policy applies to EqualX services only. We do not exercise control over the sites displayed or linked from within our various services. These other sites may place their own cookies, plug-ins, or other files on your computer, collect data or solicit personal information from you. The Company does not control these third-party websites and we are not responsible for their privacy statements. Please consult such third parties’ privacy statements.
4. How We Use Your Information
We use the information we collect in various ways, including to:
- a.
Provide, operate, and maintain our website;
- b.
Ensure compliance with regulations;
- c.
Provide our services and support;
- d.
Verify your identity;
- e.
Resolve disputes and troubleshoot problems;
- f.
Improve, personalize, and expand our website;
- g.
Understand and analyze how you use our website;
- h.
Develop new products, services, features, and functionality;
- i.
Communicate with you, either directly or through one of our partners, including for customer service, to provide you with updates and other information relating to the website, and for marketing and promotional purposes;
- j.
Send you emails;
- k.
Find and prevent fraudulent activities; and
- l.
As Equal X believes to be necessary or appropriate:
i. To comply with a legal obligation. This applies where the processing is necessary for Equal X to comply with the law;
ii. To protect Equal X's legitimate interests, privacy, property or safety, and/or those of a third party as long as your rights do not override those interests; and
iii. To protect your vital interests.
We may monitor and record our communications with you, including e-mails and phone conversations for training, quality assurance purposes, and to meet our legal and regulatory obligations in general.
Whenever we use your information for our legitimate interests, we will ensure that your information is processed on an anonymised basis and displayed at aggregated levels, which will not be linked back to you or to any living individual.
Your Rights as a Data Subject
Your personal data is protected by legal rights enshrined in Data Protection Laws. These rights include the following:
As a data subject, you have the following rights regarding your personal data:
- 1.
Right to be informed: You have the right to know whether the data controller or a data processor acting on its behalf is storing or processing your personal data.
- 2.
Right to access: You can request a copy of your personal data in a commonly used electronic format, unless fulfilling the request would cause unreasonable costs to the data controller. In such cases, you may be asked to cover some or all of the costs.
- 3.
Right to correction: You can request the correction of inaccurate, outdated, incomplete, or misleading personal data. If correction is not feasible or appropriate, you may request the deletion of such data.
- 4.
Right to erasure: You can request the deletion of your personal data without undue delay.
- 5.
Right to withdraw consent: You have the right to withdraw your consent to the processing of your personal data at any time, as outlined under the Nigeria Data Protection Act 2023.
- 6.
Right to object: You can object to the processing of your personal data.
- 7.
Right to object to automated decisions: You can object to decisions made based on automated processing of your personal data, including profiling.
- 8.
Right to data portability: You have the right to request your personal data in a format that allows it to be transferred to another service provider.
- 9.
Right to lodge a complaint: You can file a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated.
To exercise any of the above rights, please follow these steps:
Submit your request in writing via your usual registered channel (e.g., registered email) and clearly specify the right you wish to exercise.
For further information or to exercise your data protection rights, please contact our Data Protection Officer at compliance@equalx.tech.
We will make every effort to process your request within 30 days. If we need more time, we will notify you through existing communication channels, at no cost. Please note that you may continue to receive communications for a brief period as we update your preferences.
5. Log Files
The Company, through its products and services, follows a standard procedure of using log files. These files log visitors when they visit websites. All hosting companies do this and a part of hosting services' analytics. The information collected by log files include internet protocol (IP) addresses, browser type, Internet Service Provider (ISP), date and time stamp, referring/exit pages, and possibly the number of clicks. These are not linked to any information that is personally identifiable. The purpose of the information is for analyzing trends, administering the site, tracking users' movement on the website, and gathering demographic information.
6. Cookies
Cookies are small files placed on your computer's hard drive that enables the website to identify your computer as you view different pages. Cookies allow websites and applications to store your preferences in order to present contents, options or functions that are specific to you. Like most interactive websites, our website uses cookies to enable the tracking of your activity for the duration of a session. Our website uses only encrypted session cookies which are erased either after a predefined timeout period or once the user logs out of the platform and closes the browser. Session cookies do not collect information from the user's computer. They will typically store information in the form of a session identification that does not personally identify the user.
The types of cookies we use are:
- Necessary Cookies, which are essential for the website to function properly and cannot be disabled.
- Performance and Analytics Cookies, which help us analyse site performance and improve its functionality.
- Advertising and Targeting Cookies, to deliver relevant advertisements to you.
We use cookies to provide tailored content and advertisements based on your preferences, ensure safe and secure access to our website, to collect data about website traffic and user behaviour for continuous improvement, and to remember your preferences and provide a seamless user experience. Note that you can manage your cookie preferences by enabling or disabling the cookies, deleting cookies stored on your device, or adjusting browser settings to notify you before accepting cookies.
7. Data Security and Intelligence
The security of your Personal Information is important to the Company. We maintain appropriate Internal, technical, and physical controls to ensure that your data are kept safe at the Company. Other security measures include but are not limited to, secure servers, firewalls, data encryption, and granting access only to designated employees. On your part strive to ensure your passwords to your EqualX Accounts are safe. We will only retain personal information on our servers for as long as is reasonably necessary as long as we are providing Services to you. When you close your EqualX's Account, your information is stored on our servers to the extent necessary to comply with regulatory obligations and for the purpose of fraud monitoring, detection, and prevention. Where we retain your Business Information/data, we do so in compliance with limitation periods under the applicable law.
8. Data Transfer and Sharing
Bearing in mind that we operate in a regulated environment, we cannot ensure that all your private communications and other personally identifiable information will never be disclosed in ways not otherwise described in this Policy. For example, we may be required to disclose information to the government, regulatory bodies, law enforcement agencies, and third parties for the performance of a task carried out in the interest of the public interest.
We may need to pass your information to third party service providers which maintain, administer or develop the Sites on our behalf and the information will only be provided for such limited purposes and as detailed below. Additionally, we may provide aggregate statistics about our customers, sales, traffic patterns and related website information to reputable third-parties, but you can rest assured that these statistics will include no personally identifiable information.
Equal X may transfer your personal data to third parties (“Third Party Providers”) including companies providing identity or financial validation services;
- financial product providers;
- payment services companies acting on your, or our behalf;
- banks;
- companies providing analytics services;
- data, service and software providers;
- Regulatory and law enforcement bodies.
A few of our identity verification Third Party Providers collect your personal data via our Sites through the use of Apple Inc.'s (“Apple”) TrueDepth Application Programming Interface (“TrueDepth API”). As a result of the integration of our Sites with such Third Party Providers, our Sites make use of automatically collected information using the device camera on your Apple mobile device and the TrueDepth API provided by Apple.
The use of your personal data collected as a result of this is to track your facial features, and control the augmented reality (AR) experience. We use ARKit to capture your face 3D spatial orientation and facial expressions. In doing this, we use this data to ensure that the picture (selfie) being taken is of a live user for authentication and fraud reduction purposes. The ARKit information is processed entirely locally and the spatial orientation/facial expression data is not submitted to any third (or first) parties. None of the information collected by the TrueDepth API ever leaves your mobile device nor is it persistently stored on the device.
We will do our reasonable best to ensure personal data provided by you to us and shared with a Third Party Provider is done in accordance with the provisions of Data Protection Laws. We will also reasonably ensure that such Third Party Providers with whom we share your personal data will ensure the security of the same as provided by this Policy and in accordance with Data Protection Laws.
9. NDPR Data Protection Rights
We would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:
- 1.
The right to access - You have the right to request copies of your personal data. We may charge you a small fee for this service.
- 2.
The right to rectification - You have the right to request that we correct any information you believe is inaccurate. You also have the right to request that we complete the information you think is incomplete.
- 3.
The right to erasure - You have the right to request that we erase your personal data, under certain conditions
- 4.
The right to restrict processing - You have the right to request that we restrict the processing of your personal data, under certain conditions.
- 5.
The right to object to processing - You have the right to object to our processing of your personal data, under certain conditions.
- 6.
The right to data portability - You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
- 7.
The right to data portability - You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us.
10. Retention of Personal Data
We will only retain your personal information for as long as reasonably necessary to
- a) Provide our services to you,
- b) Archiving purposes to detect and investigate fraudulent transactions,
- c) Comply with our legal obligations under financial or anti-money laundering laws.
- d) Satisfying any tax, accounting or reporting requirements and.
- e) Upon our reasonable belief that there is a prospect of litigation in respect to our relationship with you..
Once we determine that personal data is no longer required to be retained, or upon your request for deletion in accordance with your rights under Data Protection Laws, we ensure that the personal data is securely deleted, anonymized, or destroyed.
Please find below the details of our data retention and disposal process:
| Type of Data | Retention Period | Disposal Process |
|---|---|---|
| Hard Copy | 10 years | Cross-cut shredded/incinerated, pulped |
| Soft Copy | Programmatic (automatic) process to remove, at least on a quarterly basis, personal data that exceeds business retention requirements/reviews conducted at least on a quarterly basis | |
| Tape Media | Physically destroy | |
| Hard drives | Secure wipe program/degauss | |
| System and network logs | 1 year |
At least quarterly, we systematically remove and destroy all cardholder data that has surpassed its retention period. We also conduct reviews to the effect that any remaining stored cardholder data complies with formal retention requirements.
Where the Primary Account Number (PAN) is stored, whether electronically or on paper, it is masked so that only the first six and last four digits are visible. However, please note that certain members of our operations and service delivery teams, who have a legitimate business need, may access the PAN when addressing customer or cardholder inquiries. But you can rest assured that all PANs stored (including in logs, removable media, etc.) are rendered unreadable through one-way hashing techniques. Cardholder data is never stored on removable media, and any physical storage media (including documents, faxes, and electronic media) that is no longer required, once its retention period has expired, is securely destroyed.
11. Children’s Information
EqualX does not knowingly collect any Personal Identifiable Information from children under the age of 13, and our service is not available for individuals under the age of 18. If you think that your child provided this kind of information on our website, we strongly encourage you to contact us immediately and we will do our best efforts to promptly remove such information from our records.
12. Amendments To Our Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. We will let you know via email and/or a prominent notice on our Service, prior to the change becoming effective and update “effective date” at the top of this Privacy Policy. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.
13. Contact Details
Data Protection Officer,
EqualX Limited,
7, Asa Afariogun Street, Ajao Estate, Lagos State, Nigeria
compliance@equalx.tech
Kindly let us know if you have any questions, comments and requests regarding your privacy and rights and we'll be happy to help.