Privacy Notice

HyCoop ("Hyves") is a limited liability company incorporated under Part A of the Companies and Allied Matters Act, Cap C20, the Laws of the Federal Republic of Nigeria and having its corporate office at 1, Sanni Close, Ogudu, Lagos, Nigeria. Hyves is committed to safeguarding the privacy of our employees, clients, partners and visitors to our websites and users of our products and services.

When this Privacy Notice (the "Notice") mentions "we," "us," or "our," it refers to Hyves, which is the controller of your personal data. This notice governs your use of our website: https://www.hyves.ng ("the Website") and your rights regarding our collection, use, storage and protection of your data. Your privacy is important to us.

Personal information is any information about you that may be used to directly or indirectly identify you. In connection with the service we provide and the products we offer, we collect personal and financial information from you while you use our products, services and websites. Most of this collection occurs during registration or onboarding for individuals or cooperatives under our different products and services and while using our website.

• Your first, middle and last names
• Your contact details, such as mobile or telephone numbers and email addresses
• Your date of birth
• Your gender
• Your local government and state of origin
• Next of kin details
• Your home address and telephone number for borrower or lender registration
• Your bank account information, including but not limited to Bank Verification Number (BVN), account name and number, and credit history
• ATM card details, including card number, expiry date and CVV
• The domain name of the Internet service provider (ISP)
• The Internet protocol address used to connect your device to the Internet
• Date and time of your visits
• Web pages visited, duration and frequency of visit
• Your login email address and password
• Additional personal information from third-party applications and other identification or verification services, for example from your financial institution or a Credit Bureau

The principles below guide our use of your personal data:

• Your personal data will be processed in a lawful, fair, and transparent manner.
• Your personal data will be processed for a specific purpose and not in a way that is incompatible with the purpose for which it is collected.
• Processing of your personal data will be adequate, relevant and limited to what is necessary for the purposes it is processed.
• The user's personal data will be kept accurate and, where necessary, kept up to date.
• The user's personal data will be held for no longer than it is required for the purposes for which it is processed.
• The user's personal data will be kept secure.

Cookies are tools that we use to collect information from the user when the user visits our website automatically. Cookies help make our websites work and provide information to us about how users interact with our site. We use this information for the improvement of user experience on our website. The cookies we use help to provide us with anonymized, aggregated technical information.

We collect your data for the following purposes and lawful bases:

Whenever we process your personal data based on consent, we will give you the option to accept or reject such processing. When you give your consent, we process your personal data for the stated purpose.

You have a right to withdraw the consent at any time and we will cease to process your personal data for the purpose we processed them. You can withdraw your personal data at any time by sending an email to us.

However, when you withdraw your consent, it does not affect the validity of the processing done before the withdrawal.

As a data subject, the law provides you with certain rights concerning the processing of your personal data. They include the right to:

• Confirm whether or not the user's personal data is being processed and, where so, access personal data we hold about the user by requesting a copy.
• Rectify and complete the user's personal data where the user believes it to be inaccurate or incomplete.
• Restrict the processing of the user's personal data in certain circumstances.
• Object to the processing of the user's data where we intend to process such data for marketing purposes.
• Where feasible, receive all personal data the user has provided to us in a structured, commonly used, and machine-readable format and transmit the information to another data controller.
• Request the erasure of the user's personal data, also known as the right to be forgotten.
• Lodge a complaint with a relevant authority where you have reason to believe that we have violated the terms of this privacy notice by sending an email to dpo@ndpb.gov.ng.

You may complain or seek redress from us within 30 days from the time you first detected the alleged violation. To exercise any of the above, send an email to us at info@hyves.ng or call us on 07058789944. The user may also visit our office at 1, Sanni Close, Ogudu, Lagos, Nigeria.

• Hyves infrastructure for hosting services
• Zoom and Slack for communications within the organisation
• Mailchimp for email services
• Paystack, Interswitch and Flutterwave for payment services
• Google for the use of Google APIs and services on our website
• Jquery to make the use of Javascript on our website easier
• Cloudflare and Bootstrap for fast and reliable content delivery on our website

Note that we may disclose the user's data to legal or regulatory authorities if we believe it is reasonably necessary to comply with a law, regulation, order, subpoena, audit, or to protect the safety of any person, to address fraud, security or technical issues.

Prior to sending direct marketing communications to the user, we will seek the user's consent. The user may choose to opt out of our marketing emails by clicking on the unsubscribe button at the bottom of the page.

The user's personal data or any other information collected will be stored for as long as necessary to fulfil the purposes described in this notice. However, we will also retain data subject to relevant provisions of applicable laws, resolve disputes, and enforce our legal agreements and policies.

We delete the user's data for targeted marketing purposes once the user unsubscribes from our marketing communications.

Please note that the user's data may be retained for a more extended period, notwithstanding the user's request to remove the user's data, where there is a legal requirement to do so.

The personal information we collect from the user through our website is stored within the HYVES Ecosystem and they are processed at our office in Nigeria and any other data processing platforms used by our identifiable third parties. We protect the user's data using physical, technical, and administrative security measures to reduce the risks of loss, misuse, unauthorized access, disclosure and alteration. Some of the safeguards we use are firewalls and data encryption, physical access controls, information access authorization controls, and globally trusted information security management systems.

In the event of an actual or suspected data breach capable of causing harm to the user's rights and freedoms, we will notify the user without undue delay and use our best effort to remedy the violation within one (1) month from the date we notify the user.

To achieve the purposes described in this notice, we may transfer the user's data to countries that are not considered to have sufficient law by the Nigerian Data Protection Bureau (NDPB). Where personal data is to be transferred to a country outside Nigeria, we shall put adequate measures to ensure data security.

Our data transfers to the countries that do not offer an adequate protection level are subject to the conditions under the Nigeria Data Protection Regulation (NDPR). We will therefore only transfer Personal Data out of Nigeria on one of the following conditions:

• Your consent has been obtained.
• The transfer is necessary for the performance of a contract between us and the user or implementation of pre-contractual measures taken at the user's request.
• The transfer is necessary to conclude a contract between us and the third party in the user's interest.
• The transfer is necessary for reasons of public interest.
• The transfer is for the establishment, exercise or defence of legal claims.
• The transfer is essential to protect your vital interests or other persons, where the data subject is physically or legally incapable of giving consent.

To obtain any relevant information regarding any transfers of your Personal Data to third countries, including the appropriate transfer mechanisms, please contact us.

Our Anti-Money Laundering (AML) and Combating Financing of Terrorism (CFT) policies are tailored to the recommendations of the Central Bank of Nigeria. We conduct client due diligence enquiries about each new client and people connected with them and conduct ongoing monitoring of existing clients. These enquiries are based on the Money Laundering (Prevention and Prohibition) Act, 2022 ("MLPPA") and Terrorism (Prevention and Prohibition) Act 2022 ("TPPA"), although if additional information is required by CBN guidelines on same, that information will also be obtained.

Where necessary for these purposes, we seek relevant information from third-party data suppliers. Where individuals have supplied personal data for this purpose, we will only use it for that purpose and will keep it only as long as the relevant AML and CFT data protection legislations require.

We also have internal procedures to ensure that any suspicion of money laundering and terrorism is reported to the appropriate authorities where there is an obligation to do so. Our legal team and other relevant staff are provided with training in these issues.

We are hopeful that the user will not have a cause to be displeased about how we manage the user's data. However, in the unlikely event that the user has a concern over how the user's information is being managed, processed or where it is missing, the user can reach our Data Protection Officer (DPO) at info@hyves.ng.

We may change this notice from time to time by updating this page. We do not undertake to send a written notification of changes to this notice. Whenever the user visits our website, do check the last date of update.