Introduction

Welcome to Cashmatrix. The privacy of our (prospective) customers, users of our services, and their Personal Data is of utmost importance to us.

In line with our commitment to protecting your privacy, we have developed this Privacy Policy to explain our privacy practices, particularly regarding how we collect, process, retain, share, and protect your Personal Data when you visit our website, premises, or use our digital platforms (collectively, "the Platform" or "Services").

This Privacy Policy between Asset Matrix Microfinance Bank Limited ("Cashmatrix") and you constitutes our commitment to protecting user privacy and compliance with the relevant data protection laws on all our platforms. It is designed to provide information regarding our privacy practices and help you understand how we handle your data, in full compliance with the provisions of the Nigeria Data Protection Act 2023 (NDPA) and other applicable data protection regulations.

Definitions

"Personal Data" shall have the meaning stipulated by the NDPA and shall include any information relating to an identifiable natural person, which includes Customer Information or information that enables us to identify you personally.

"Cashmatrix", "We", "Us", or "Our" means Asset Matrix Microfinance Bank Limited, a company licensed by the Central Bank of Nigeria (CBN) and insured by the Nigeria Deposit Insurance Corporation (NDIC).

"Application" or "App" means the Cashmatrix mobile banking application available on iOS, Android, and web platforms.

"Services" means the financial services provided by Cashmatrix through the Application, including but not limited to savings, investments, bill payments, fund transfers, card services, and POS services.

"User", "You", or "Your" means any individual or entity that accesses or uses the Application or Services.

"Data Controller" means the natural or legal person who determines the purposes and means of processing Personal Data.

"Data Processor" means a natural or legal person who processes Personal Data on behalf of the Data Controller.

"NDPA" means the Nigeria Data Protection Act 2023.

"NDPC" means the Nigeria Data Protection Commission established under the NDPA.

Who We Are & How to Contact Us

Cashmatrix is a digital banking platform offering savings, investments, bill payments, fund transfers, card services, and POS services. We are licensed by the Central Bank of Nigeria (CBN) and insured by the Nigeria Deposit Insurance Corporation (NDIC).

If you have any questions or complaints about this Privacy Policy or our practices in relation to your Personal Data, please contact us at:

Email: hello@cashmatrix.ng

You may also contact us at our registered office address in Nigeria.

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at info@ndpc.gov.ng.

Lawful Basis for Processing Your Data

Depending on the circumstances of our interactions with you, our legal basis for processing your personal data may be one of the following:

For the performance of a contract we have or are about to enter with you;

Based on your consent; or

For our legitimate business interest or that of a third party.

You give your consent to our processing of your personal data when you access our platforms or, when you accept our cookies policy; or in particular, as you use the services offered on our website and digital platforms or visit any of our offices and submit your data for official or non-official purposes. You have the right to withdraw your consent at any time.

What Personal Data We Collect

We collect Personal Data about you when you use the services offered on our website and digital platform, including the following categories:

Identity Data: Full name, date of birth, gender, Bank Verification Number (BVN), National Identification Number (NIN), government-issued ID documents, photographs, live videos, and facial biometric data.

Contact Data: Your home address, work address, billing address, email address, and telephone numbers.

Financial Data: Your bank account and payment card details, statements about your wealth and financial situation.

Transaction Data: Details about payments to and from you, transaction history, merchant information, and data in respect of your transactions with third parties.

Technical Data: Internet protocol (IP) address, browser type and version, time zone setting, operating system, and other technology on the devices you use to access our services.

Device Data: Details of your handset/device, unique device identifiers (IMEI or serial number), information about the SIM card, mobile network, operating system, and browser settings.

Location Data: With your consent, we collect your GPS location data for identity verification, address verification, and compliance with applicable regulatory requirements.

Image Data: Your portrait images, selfies, and facial biometric data for account opening, KYC verification, and regulatory compliance.

Marketing and Communications Data: Your preferences in receiving marketing from us and your communication preferences.

Behavioural Data: Inferred or assumed information relating to your transaction pattern, behaviour, and interests, based on your online activity.

Information from Other Sources: We may collect information from NIBSS, credit bureaus, NIMC, or other third-party KYC verification service providers.

How We Use Your Personal Data and Why

We collect your personal data to provide you an efficient and secure customer experience. We may process your Personal Data for the following reasons:

Provide services, including to initiate a payment, send or request money, pay a bill, authenticate your access to an account, and communicate with you about your account.

Manage risk, fraud, and abuse of our services and prevent you from fraud by developing and adopting measures of verifying your identity.

Comply with our legal and regulatory obligations and to enforce the terms of our sites and services.

Trail and track information (data) breaches and remediate such identified breaches.

Resolve disputes and troubleshoot problems.

With your prior consent, market Cashmatrix and its affiliates' products and services to you.

With your prior consent, use cookies to provide a targeted display, feature, service, or offer to you.

KYC and location data are processed for identity verification, regulatory compliance, and fraud prevention.

Data Minimisation and Redundancy Control: We ensure that Personal Data processed is adequate, relevant, and limited to what is necessary for the purposes for which it is collected. We do not create or retain unnecessary duplicate copies of Personal Data, except where required for legitimate business purposes such as backup, security, or regulatory compliance.

Who We Share Your Personal Data With

We may share your Personal Data or other information about you with others for the following reasons:

With other entities of the Cashmatrix Group that are subject to the equivalent level of internal control: We may share your Personal Data with other entities under the Cashmatrix Group as necessary to enable the technical service you request, to manage risk, and to prevent potentially illegal and fraudulent acts.

With other companies that provide services to us: We may share Personal Data with third-party service providers that perform services and functions at our direction and on our behalf. These third-party service providers may, for example, provide you with services, verify your identity, assist in processing transactions, send you advertisements for our products and services, or provide customer support.

With other financial institutions: We may share Personal Data with other financial institutions that we have partnered with to offer Cashmatrix-related services, unless your consent extends to other uses.

With the other parties to transactions when you use the services, such as other users and their service providers. This includes other users you are sending or receiving funds from and their service providers.

Where permitted or required by law: We may share information about you with other parties for Cashmatrix's business purposes or as permitted or required by law, including compliance with court orders, legal processes, or applicable regulations.

With your consent: We also will share your Personal Data and other information with your consent or direction.

Data Minimisation & Redundancy Control

We ensure that Personal Data processed is adequate, relevant, and limited to what is necessary for the purposes for which it is collected.

We do not create or retain unnecessary duplicate copies of Personal Data, except where required for legitimate business purposes such as backup, security, or regulatory compliance.

Where duplication is necessary, we implement measures to ensure such data remains accurate, consistent, and securely maintained.

We adhere to the principles of data processing and ensure personal data is processed in a fair, lawful, and transparent manner; collected for specified, explicit, and legitimate purposes; adequate, relevant, and limited to the minimum necessary; and retained for not longer than is necessary.

Data Retention

We retain Personal Data in an identifiable format only for as long as required for our business purposes, with specific reference to the service rendered to you, and to fulfil our legal or regulatory obligations.

Subject to applicable law, which might, from time to time, oblige us to retain your Personal Data for a certain period of time, we will retain your Personal Data for as long as necessary to fulfil the purposes we collect it for, including the purposes of satisfying any legal, accounting, or reporting obligations.

Cashmatrix is required to retain the details of transactions (including personal data) or payments you make via Cashmatrix after the transaction is completed and for a minimum period of 5 years, per AML legislation and other requirements applicable to our business.

If you wish to delete your account or request that we stop processing your information, please contact us. We will respond to your request within a reasonable timeframe, subject to legal retention requirements.

Data Security

We maintain technical, physical, and administrative security measures designed to provide reasonable protection for your Personal Data against loss, misuse, unauthorized access, disclosure, and alteration.

The security measures include firewalls, data encryption, physical access controls to our premises, CCTV cameras for public safety and quality control, as well as information access authorization controls.

Your Personal Data is regarded as confidential and will not be divulged to any third party, except under legal and/or regulatory conditions.

While we are dedicated to securing our systems and services and safeguarding the information entrusted to us, your role in fulfilling confidentiality duties includes, but is not limited to, adopting and enforcing appropriate security measures such as securing and maintaining the privacy of your password(s) and account/profile registration information.

We will inform you of any breaches which may likely result in high risks to your rights and freedom.

International Data Transfers

Your personal data may be transferred to and stored in countries outside Nigeria. Where such transfers occur, we implement appropriate safeguards to protect your data, including Standard Contractual Clauses or other lawful transfer mechanisms.

Where Cashmatrix transfers your personal data to countries outside of Nigeria, such transfer shall be carried out in compliance with the NDPA, using appropriate safeguards which may include standard contractual clauses, intra-group agreements, or transfers to countries recognized as providing an adequate level of protection.

Where transfers are made to countries not recognized as adequate, Cashmatrix shall implement appropriate safeguards to ensure that personal data receives a level of protection equivalent to that afforded under the NDPA.

By continuing to use the Cashmatrix Digital Platform and related services you acknowledge that such transfers may occur.

Your Rights

Under the Nigeria Data Protection Act 2023, you have the following rights relating to your Personal Data:

Right to be Informed: You have the right to be informed about how we collect, use, and protect your Personal Data.

Right to Access: You have the right to ask us whether we hold any Personal Data relating to you and, if we do, to be provided with a copy of that Personal Data in electronic form.

Right to Rectification: You have the right to ask us to correct your Personal Data if it is inaccurate, or update outdated or incomplete Personal Data without undue delay.

Right to Erasure: You have the right to ask us to erase your Personal Data if it is no longer necessary for the purpose(s) it was collected for, if it has been unlawfully processed, or if you withdraw your consent.

Right to Restrict Processing: You have the right to ask us to restrict the processing of your Personal Data in certain circumstances, such as when you contest the accuracy of your data.

Right to Data Portability: You have the right to receive your Personal Data in a structured, commonly used, machine-readable electronic format.

Right to Object: You have the right to object at any time to the processing of your Personal Data, including for direct marketing purposes.

Right to Withdraw Consent: You have the right to withdraw your consent at any time, and we will stop processing your Personal Data unless another lawful basis exists.

How to Exercise Your Rights

If you wish to exercise any of the rights above, please contact us at hello@cashmatrix.ng.

You will not have to pay a fee to access your personal data (or to exercise any right), however, we may charge a reasonable fee where requests are clearly unfounded, repetitive or excessive.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it.

We aim to respond to all requests within one month, in line with applicable law. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests.

Cookies and Tracking

Cookies are small files placed on your device's browser that enable the website to identify your device as you view different pages.

Like most interactive websites, our website uses cookies to enable us to track your activity for the duration of a session. Our website uses only encrypted session cookies which are erased either after a predefined timeout period or once the user logs out of the platform and closes the browser.

Session cookies do not collect information from your device. They will typically store data in the form of a session identification that does not personally identify you.

Certain aspects of our website are only available through the use of cookies, so your use of our website may be limited or not possible if you choose to disable or decline cookies.

You may also choose to accept, decline, or manage cookie settings, which affects how you interact with our website and determines the functionality of the pages.

Automated Decision-Making & Profiling

Generally, you have the right to object to any decision concerning you or which otherwise significantly affects you if this is based solely on the automated processing of your Personal Data without human intervention. This includes automated decisions based on profiling.

However, we may use automated systems to make preliminary assessments or suggestions, for example, fraud risk scoring, transaction monitoring, and identity verification outcomes, to protect you and the integrity of our platform.

These automated assessments are reviewed by our staff before any consequential decision is made.

Where automated decision-making is used for fraud detection, we may use your personal data to assess whether an account or transaction is potentially associated with fraud, money laundering, or terrorist financing. If we determine a risk of fraud or unauthorized activity, we may suspend activity on the account, block a transaction, or restrict access to services.

You have the right to request human review of any automated decision that significantly affects you by contacting us at hello@cashmatrix.ng.

Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18 without verifiable parental or guardian consent.

If you are under the age of 18, you may only be eligible to use the service offered on our digital platform under the supervision and with the consent of your parent(s) or guardian(s), subject to existing laws.

If we become aware that we have collected personal information from a child under 18 without such consent, we will take steps to delete such information promptly.

If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us so that we can take appropriate action.

Your Responsibilities

You are responsible for ensuring that the information you provide to Cashmatrix is accurate, complete, and kept up to date. You must inform us as soon as possible if any of your personal data changes, including your contact details or identity information, so that we can maintain accurate records.

If you provide us with personal data about another person (for example, a beneficiary or business partner), you must direct that person to this Privacy Policy and ensure they understand and agree to how their information will be used by Cashmatrix as set out herein.

You are responsible for protection of your password or PIN in its entirety as communicated in our Terms and Conditions. You must not share your Cashmatrix password or PIN with anyone.

We will never request your PIN or password via email, SMS, or any other means. In the event you receive such communication, please disregard and contact us at hello@cashmatrix.ng.

In the event you share your password with a third party, you will be solely responsible for any consequence and loss arising thereof. If you believe your password or PIN has been compromised, please change it immediately and contact us.

Changes to This Policy

This privacy policy is reviewed periodically and when there is any substantial change to business or regulatory requirements. The revised Privacy Policy will be effective as of the published updated date.

At the minimum, we shall review this annually and communicate via our communication channels such as Website, Social Media Accounts, etc.

If the revised version includes a substantial change, we may notify you of the change using emails or other means.

Any updates or modifications to this Privacy Policy will be reflected on this page, and you may be notified through our standard communication channels, such as email or in-app notifications, where applicable.

If you are opposed to the changes, you may contact us at hello@cashmatrix.ng for any queries or close your account. Continuous usage of Cashmatrix services after receipt of notification means you have understood the modifications or changes without reservation.

Business Transfers

If Cashmatrix is involved in a merger, acquisition, reorganization, or sale of all or substantially all of its assets or business, your personal information and any related rights and obligations under this Privacy Policy may be transferred to or assumed by the successor or acquiring entity.

We will ensure that any such entity will continue to honor the commitments described in this Privacy Policy with respect to your personal information.

As part of any such transfer, the successor company may have access to the information maintained by Cashmatrix, including customer Account Information, and such successor company would continue to process data in line with the provisions of this Privacy Policy unless and until it is amended.

Contact Us

If you have any general questions or concerns about this Privacy Policy or the way in which we handle your Personal Data, kindly contact us via the details below:

Email: hello@cashmatrix.ng

We will acknowledge receipt of your complaint within 24 hours and aim to resolve it within 14 business days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at info@ndpc.gov.ng or through their official channels.

You may also contact us at our registered office address in Nigeria.