User Privacy and Data Protection Policy

1. Overview

This Privacy Policy explains how Buga Technology Co., Ltd. collects, handles, stores, shares, and protects your personal information when you use BugaCredit.

BugaCredit provides digital lending services, including identity verification, credit assessment, loan disbursement, repayment management, account support, and fraud prevention.

By installing, registering for, or using BugaCredit, you acknowledge that you have read and understood the data practices described in this Policy.

Where your consent is required for a specific data-processing activity or device function, we will request your permission before the relevant processing begins.

2. Regulatory Framework

We process personal information in accordance with applicable Nigerian laws and regulatory requirements, including:

2.1 Data Protection Laws

• Nigeria Data Protection Regulation 2019;
• Nigeria Data Protection Act 2023; and
• relevant data-protection implementation requirements.

2.2 Financial Compliance and KYC

• Money Laundering (Prevention and Prohibition) Act 2022;
• applicable Central Bank of Nigeria anti-money laundering requirements;
• applicable Central Bank of Nigeria Know Your Customer requirements; and
• relevant Financial Action Task Force standards.

3. Data Controller

4. Legal Grounds for Processing

We process personal information based on one or more of the following lawful grounds:

• Service Performance: To review loan applications, provide approved loans, manage loan accounts, and process repayments.
• Legal Requirements: To meet identity-verification, KYC, anti-money laundering, fraud-prevention, financial reporting, and regulatory obligations.
• User Consent: Where specific permission is required for a device function or data-processing activity.
• Legitimate Interests: To maintain platform security, prevent identity theft and misuse, improve BugaCredit, and protect our users, provided that your rights are not overridden.

5. Information We Collect

We collect personal information that is necessary for service delivery, identity verification, credit assessment, legal compliance, security, and fraud prevention.

5.1 Information You Provide

We may collect the following information:

• Identity Information: Full legal name, gender, date of birth, nationality, marital or family status, and National Identification Number.
• Employment and Income Information: Current occupation, monthly income, employment information, and employer details.
• Financial Information: Bank Verification Number, bank name, designated bank account number, loan information, repayment information, and related financial transaction records.

5.2 Emergency and Reference Contacts

Emergency or reference-contact information must be entered manually by you.

We do not:

• retrieve or scan your full address book;
• use reference-contact information for marketing or advertising;
• require reference contacts to repay your loan;
• threaten, shame, harass, or place improper pressure on you or your reference contacts; or
• publicly disclose reference-contact information.

5.3 Identity and Biometric Verification

For identity-verification and fraud-prevention purposes, we may require:

• a live selfie;
• an image of a government-issued identity document;
• facial-verification results; and
• biometric signatures or facial templates generated during verification.

Biometric signatures and facial templates generated during the verification process will be permanently deleted from our records within 24 hours after verification.

Identity-document images may be retained separately in accordance with the retention periods described in Section 9.

5.4 Device and Technical Information

We may collect limited device and technical information, including:

• device manufacturer and model;
• operating-system type and version;
• language settings;
• network configuration;
• application version;
• technical device identifiers; and
• information used to identify suspicious or fraudulent activity.

This information is used for security, fraud prevention, technical support, and service improvement.

5.5 Information We Do Not Collect

BugaCredit does not collect, scan, copy, or upload:

• your device contact list;
• your personal photo or video gallery;
• general SMS content or SMS logs;
• browser history;
• call history; or
• information through hidden monitoring software or spyware.

Where you separately grant permission relating to a specific financial alert, only information covered by that permission will be processed.

BugaCredit does not use such permission to access unrelated personal messages.

6. Purpose of Data Usage

Your personal information may be used to:

• verify your identity;
• conduct KYC checks;
• assess your creditworthiness;
• support automated credit decisions;
• review and process loan applications;
• determine loan eligibility;
• disburse approved loans;
• manage your loan account;
• process loan repayments;
• send account and transaction notifications;
• send repayment reminders;
• provide customer support;
• maintain and improve BugaCredit;
• detect and prevent fraud, identity theft, or misuse;
• protect the platform against unauthorised access; and
• fulfil applicable legal and regulatory obligations.

7. Data Sharing Practices

We do not sell your personal information.

We only share personal information where necessary for service delivery, legal compliance, security, or fraud prevention.

7.1 Service Providers

Third-party service providers may process information strictly to support BugaCredit’s core services, including:

• cloud hosting;
• SMS and communications;
• payment processing; and
• technical infrastructure.

These providers are required to protect your information and process it only for authorised purposes.

7.2 Credit Bureaus

We may share relevant loan and repayment information with licensed Nigerian credit bureaus, including:

• FirstCentral Credit Bureau; and
• CRC Credit Bureau.

Information shared may include identity information, loan status, repayment performance, overdue information, and settlement records.

7.3 Regulatory and Legal Authorities

We may disclose information when required by law, regulation, court order, or a valid request from an authorised body, including:

• the Central Bank of Nigeria;
• the Nigeria Data Protection Commission;
• the Nigeria Financial Intelligence Unit;
• tax authorities;
• courts;
• law-enforcement agencies; and
• other legally authorised regulatory bodies.

We do not:

• sell personal information;
• share personal information for third-party marketing or advertising; or
• permit service providers or other recipients to misuse user information.

8. Data Storage and Cross-Border Transfers

Your personal information is stored using secure cloud infrastructure and appropriate protection measures.

If personal information is transferred outside Nigeria, the transfer will be handled in accordance with the applicable cross-border data-transfer requirements of the Nigeria Data Protection Act 2023.

Appropriate safeguards will be applied to protect information during storage and international transfer.

9. Data Retention Policy

We retain personal information only for as long as necessary for service delivery, legal compliance, fraud prevention, financial record keeping, and dispute resolution.

Our standard retention periods are:

• Account and Registration Information: For the duration of the account and up to six years after account closure.
• Identity Documents and KYC Records: Up to six years after the end of the account relationship.
• Biometric Signatures and Facial Templates: Permanently deleted within 24 hours after verification.
• Loan and Financial Transaction Records: Up to six years.
• Device and Technical Information: Up to twelve rolling months.
• Manually Entered Emergency or Reference Contacts: Deleted when the account is terminated.

Information may be retained for longer where reasonably necessary for a legal investigation, regulatory request, fraud investigation, or dispute.

After the applicable retention period, personal information will be securely deleted or permanently anonymised.

10. Your Data Protection Rights

Subject to applicable law and legal retention requirements, you may have the right to:

• access your personal information;
• request a copy or summary of your information;
• correct inaccurate, incomplete, or outdated information;
• request deletion of information that is no longer required;
• object to certain types of processing;
• request data portability where applicable;
• withdraw consent where processing is based on consent; and
• submit a complaint to the Nigeria Data Protection Commission.

Some information may continue to be retained where required for:

• KYC and anti-money laundering compliance;
• an outstanding loan;
• financial record keeping;
• fraud prevention;
• regulatory investigations; or
• legal proceedings.

To exercise your rights, contact:

BugaCreditCustomerService@gmail.com

We may require identity verification before processing a request in order to protect your account and personal information.

11. Account Deletion

You may request account deletion through the Delete Account function within the BugaCredit application.

You may also contact BugaCreditCustomerService@gmail.com regarding account closure or personal-data deletion.

Before deletion:

• identity verification may be required to prevent unauthorised deletion; and
• all outstanding loan balances must be settled before account closure can be completed.

After an account-deletion request is approved:

• access to the account will be terminated;
• active personal information that is no longer required will be deleted; and
• information required for legal, regulatory, fraud-prevention, financial-record, or dispute-resolution purposes may continue to be retained for the applicable retention period.

12. Data Security Measures

We implement technical and organisational measures designed to protect your personal information, including:

• TLS 1.3 encryption for information transmitted between your device and our systems;
• AES-256 encryption for information stored in our systems;
• access controls;
• multi-factor authentication for internal access;
• system monitoring; and
• measures designed to prevent unauthorised access, loss, misuse, alteration, or disclosure.

Despite these safeguards, no electronic system can be guaranteed to be completely secure.

You should protect your login information, verification codes, and other account credentials and contact us promptly if you suspect unauthorised activity.

13. Children’s Privacy

BugaCredit is intended only for individuals aged 18 and above.

We do not knowingly provide services to or collect personal information from anyone under the age of 18.

If we discover that an account belongs to a person under 18, we will terminate the account and delete the associated information unless retention is required by law.

14. Policy Updates

We may revise this Privacy Policy periodically to reflect changes in:

• applicable laws and regulations;
• our services;
• our data-processing practices; or
• our security and operational requirements.

Significant updates may be communicated through the BugaCredit application, email, or another appropriate channel.

The effective date displayed at the beginning of this Policy will be updated when a revised version takes effect.

Continued use of BugaCredit after an update means that you acknowledge the revised Policy.

15. Contact and Complaints

For questions, complaints, personal-data requests, or account-deletion requests, contact:

You may also submit a complaint to the Nigeria Data Protection Commission where appropriate.