Data Protection / Privacy Policy

1. Introduction

Whitecrust Finance Company Limited is a finance company licensed in Nigeria by the Central Bank of Nigeria. We provide financial services to individuals, SMEs, corporates, and public sector entities through our branches and e-channels.

By opening an account and/or subscribing to our services, you provide personal data and consent to processing in line with this Privacy Policy.

2. Glossary

• Consent: Any freely given, specific, informed and unambiguous indication of a data subject's wishes for processing personal data.
• Data Subject: Any person identifiable directly or indirectly.
• Personal Data: Any information relating to an identified or identifiable natural person.
• PII: Information that can be used on its own or with other data to identify, contact, or locate an individual.
• Processing: Any operation performed on personal data including collection, storage, use, disclosure, and destruction.
• NDPR: Nigeria Data Protection Regulation, 2019.
• NDPA: Nigeria Data Protection Act, 2023.

3. Information Collection and Use

We collect data to provide and improve our services. Collection points include branches, head office, mobile app, websites, events (physical/virtual), and customer interactions.

Types of data collected include:

• Name and contact data
• Identification documents
• Credentials and security information
• Usage data and device data
• CCTV/video footage and call recordings
• Sensitive personal data where required by law/regulation

4. Analytics and Cookies

We may use third-party analytics tools (including Google Analytics) to monitor and improve service usage. You may accept/reject nonessential cookies and manage cookies in your browser settings.

5. Links to Other Sites

Our service may contain third-party links. We do not control and are not responsible for the privacy practices of third-party websites.

6. Use of Data

Your data may be used to:

• Provide and maintain services
• Enable account opening and transaction processing
• Deliver support and service communications
• Meet legal, regulatory, contractual and internal policy obligations
• Perform analytics, security, fraud prevention and risk controls
• Debt recovery and technical issue resolution
• Marketing/promotional activities (where lawful)

7. Basis for Lawful Processing

Processing is based on one or more lawful bases under NDPR/NDPA, including consent, contract, legal obligation, vital interest, public interest/official authority, and legitimate interest.

8. Transfer of Data

Where transfers are necessary (including cross-border transfers), Whitecrust applies safeguards in line with NDPR/NDPA. Transfers outside Nigeria will be subject to lawful transfer conditions and adequate data protection controls.

Where required, approvals may be obtained from relevant authorities before transfer.

9. Disclosure of Data

We may disclose data for:

• Performance of contractual obligations
• Compliance with law or legal process
• Protection of vital interests and legal rights
• Service providers/vendors under strict controls
• Business transfers (e.g., merger/acquisition)

We do not share/sell personal data for third-party promotional use except as permitted by law or with consent.

10. Security of Data

We implement technical and organizational measures to protect personal data. However, no internet-based transmission can be guaranteed 100% secure.

11. General Principles for Processing

Whitecrust applies the following principles:

• Lawfulness, fairness and transparency
• Data accuracy
• Purpose limitation
• Data minimization
• Integrity and confidentiality
• Retention limitation
• Accountability

12. Personal Data Retention

Data is retained only for as long as necessary for legal, regulatory, contractual, operational, and legitimate purposes. Data no longer required is deleted in line with applicable laws and company retention policy.

13. Children's Privacy

The Company offers a children's account (“EARLY STARTER”) operated by parent/guardian until maturity. Except for approved products and lawful situations, the company does not knowingly enter banking relationships with minors under 18.

14. Your Privacy Rights

Subject to law, you may have rights to:

• Access your data
• Rectify inaccurate data
• Erase data
• Restrict processing
• Data portability
• Object to processing in specific circumstances
• Withdraw consent (without affecting prior lawful processing)
• Lodge a complaint with the Nigeria Data Protection Commission

15. Account Information and Marketing Preferences

You may request account updates/closure and manage cookie/email marketing preferences through available channels and settings.

16. Automated Decision-Making or Profiling

We do not use automated processing systems for specific decisions, including profiling.

17. Training

Whitecrust provides periodic and annual data privacy/protection training for relevant employees.

18. Data Protection Officer (DPO)

The Company appoints a DPO to oversee data protection strategy, compliance, training, awareness, DPIA support, and records of processing activities.

19. Data Protection Audit

An annual data protection audit is conducted through a licensed Data Protection Compliance Organization (DPCO), and report filing is done as required by law.

20. Changes to This Privacy Policy

This policy may be updated from time to time and made available on our website and branches.

21. Contact Us

Email: info@whitecrustfinance.com

Address: Whitecrust Finance Company Limited, 402 Ikorodu Road, Ojota Bus Stop, Ojota, Lagos, Nigeria

Phone: 07026198185

DPO Contact

Email: privacy@whitecrustfinance.co

Address: Data Protection Officer, Whitecrust Finance Company Limited, 402 Ikorodu Road, Ojota, Lagos, Nigeria

Regulator Complaint Contact

Nigeria Data Protection Commission

Email: dpo@ndpc.gov.ng

Address: Data Privacy Service Unit, No. 12 Clement Isong Street, Asokoro, Abuja, Nigeria