Privacy notice

1. Who we are

Viscount Microfinance Bank Limited ("Viscount", "we", "us") is a microfinance bank licensed by the Central Bank of Nigeria (CBN MFB code 051126) with its head office at 13, Yalinga Street, Off Ademola Adetokunbo, Wuse 2, Abuja, FCT. For the purposes of the Nigeria Data Protection Act 2023 ("NDPA") and the regulations and directives of the Nigeria Data Protection Commission ("NDPC"), Viscount is the data controller of the personal data described in this notice.

We have appointed a Data Protection Officer. You can reach the Data Protection Officer through the support portal at support.viscountbank.com by selecting the Data protection category.

2. Scope

This notice applies to anyone whose personal data we process, including customers and prospective customers, signatories and authorised users of business accounts, directors and beneficial owners of corporate customers, guarantors, next of kin and beneficiaries, parents and guardians operating accounts for minors, payers to and payees from Viscount accounts, cashiers and staff of businesses using our merchant tools, visitors to our websites and app, and anyone who contacts us. It applies to the Viscount app, internet banking, our websites, our merchant and developer platforms, and our dealings with you by any other means.

It does not apply to data processed by other members of the Viscount Group or by third parties under their own notices, except to the extent we share data with them as described in section 5.

3. Data we collect

We collect the following categories of personal data. The source is you unless stated otherwise.

We do not seek sensitive personal data as defined in the NDPA (such as health, religious or biometric data) except that identity verification uses a facial image and liveness check, which we process with your consent and as required by the CBN's know-your-customer rules.

4. Why we use it and our lawful basis

The NDPA requires a lawful basis for every use of personal data. Ours are set out below.

Where we rely on legitimate interest we have assessed that our interest is not overridden by your rights and freedoms. You may ask us for a summary of that assessment through the support portal.

5. Who we share it with

We share personal data only where necessary for the purposes above, and only with recipients bound by law or contract to protect it. We do not sell personal data. Recipients include:

• Regulators and authorities: the Central Bank of Nigeria, the Nigeria Deposit Insurance Corporation, the Nigerian Financial Intelligence Unit, the Nigeria Data Protection Commission, the Federal Inland Revenue Service and state tax authorities, the Economic and Financial Crimes Commission and other law-enforcement agencies, and courts, where the law requires or permits.
• Payment and identity infrastructure: the Nigeria Inter-Bank Settlement System for BVN validation, account-name verification and instant payments; the National Identity Management Commission for NIN verification; the Corporate Affairs Commission for business verification; card schemes and their processors, including Verve and Interswitch, for card issuance and transactions.
• Other banks and financial institutions: to the extent needed to execute, trace or recall a payment you have made or received, and under the CBN's Global Standing Instruction where you have consented to it in a credit agreement.
• Credit bureaux: as described in section 6.
• Service providers acting on our instructions under written contracts: cloud hosting and data-centre providers, SMS, email and push-notification providers, identity-verification and screening providers, card personalisation and courier providers, our support-portal platform, and professional advisers. They may use the data only to provide the service to us.
• The Viscount Group: other group companies for group risk management, audit and compliance, and, with your consent, to tell you about their services.
• Your business: if you are an authorised user, cashier or signatory of a business account, the business and its other authorised users can see your activity on that account as the business's controls allow.
• People you pay or who pay you: your name and account details appear to them as part of a transfer, as the payments system requires.
• Prospective buyers or partners in a merger, acquisition or restructuring, subject to confidentiality and the CBN's prior approval where required.

6. Credit bureaux

Nigerian law requires us to obtain reports from at least two licensed credit bureaux before granting credit and to report every credit facility and its performance to them. We currently exchange data with CRC Credit Bureau, FirstCentral Credit Bureau and CreditRegistry. The data shared includes your identity, the facilities you hold, amounts outstanding, repayment conduct, defaults and settlements. The bureaux keep this data under the Credit Reporting Act 2017 and their own licences and make it available to other lenders who are entitled to it. On-time repayment is reported as well as default, so your record reflects both.

7. How long we keep it

We keep personal data for as long as you have a relationship with us and afterwards for as long as the law requires. In particular, the Money Laundering (Prevention and Prohibition) Act 2022 and CBN regulations require us to retain customer identification records and transaction records for at least five years after the relationship ends or the transaction is completed, and longer where a regulator or court requires. Records of complaints are kept for the period required by the CBN Consumer Protection Regulations. Credit data is reported to the bureaux for the periods the Credit Reporting Act allows. When data is no longer required, it is deleted or irreversibly anonymised.

Where you have applied for an account or a facility and not proceeded, we keep the application data for up to twelve months, or longer if a regulator requires it.

8. Where it is processed

Our core banking systems are hosted in Nigeria. Some service providers, such as cloud, email and notification platforms, process data in other countries. Where personal data is transferred outside Nigeria we do so only under the conditions the NDPA permits: to a country the NDPC has recognised as providing adequate protection, or under binding contractual safeguards that give the data equivalent protection, or with your explicit consent for a specific transfer, or where the transfer is necessary to perform our contract with you (for example, an international card transaction you initiate).

9. How we protect it

We apply technical and organisational measures appropriate to the sensitivity of financial data, including encryption of data at rest and in transit, strong authentication for customers and staff, role-based access limited to those who need it for their work, logging and monitoring of access, segregation of production systems, secure development practices, regular independent security testing, vendor due diligence, staff training, and business-continuity and disaster-recovery arrangements that meet CBN requirements. Card data is handled in line with the card schemes' security standards.

No system is perfectly secure. You help protect your data by keeping your PIN, password and one-time passcodes to yourself, securing your phone and SIM, and reporting anything unusual immediately. See the Security centre.

10. Your rights

Under the NDPA you have the right to:

• Access the personal data we hold about you and receive a copy.
• Rectification of data that is inaccurate or incomplete. You can update most details in the app.
• Erasure of data we no longer have a lawful basis to keep. We cannot erase data we are required by law to retain, including identification and transaction records within the statutory retention period. To close your account and delete your data, see Delete your account.
• Restriction of processing in certain circumstances, for example while a dispute about accuracy is resolved.
• Portability: to receive data you provided to us in a structured, commonly used, machine-readable format, including your statements.
• Object to processing based on legitimate interest, and to direct marketing at any time.
• Withdraw consent where processing is based on consent, without affecting processing before withdrawal.
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except as described in section 14.
• Lodge a complaint with the Nigeria Data Protection Commission.

To exercise any right, open a ticket on the support portal under the Data protection category. We will verify your identity before acting, respond within the time the NDPA allows, and tell you if we cannot comply in full and why. There is no charge unless a request is manifestly unfounded or excessive.

11. Marketing

We send marketing about Viscount products only with your consent, which you can give or withdraw in the app under Settings, or by following the opt-out instruction in any message. Withdrawing consent stops marketing but not service messages about your account, security and changes to terms, which we are required to send. We do not share your data with third parties for their own marketing.

12. Cookies and similar technologies

Our websites use two kinds of cookies and similar technologies:

• Essential cookies, which are needed for the site and internet banking to work, including session, security and load-balancing cookies, and the cookie that records your cookie choice. These do not require consent.
• Analytics cookies, which tell us how the site is used so we can improve it. These are set only if you choose Accept all on the cookie notice. Choosing Essential only prevents them.

Your choice is stored in your browser for 180 days, after which we ask again. You can change it at any time by clearing the site's data in your browser, and you can block cookies in your browser settings, although blocking essential cookies will stop internet banking from working. The Viscount app uses device identifiers and push-notification tokens for security and to deliver alerts; it does not use advertising identifiers.

13. Children

Accounts for persons under eighteen are opened and operated by a parent or legal guardian, who provides the child's identity data and consents to its processing on the child's behalf. We process the child's data only for the purposes of the account and any educational content provided with it, and we do not send marketing to children. When the account holder reaches eighteen the account converts to one in their own name and this notice applies to them directly.

14. Automated decisions

Some decisions are made automatically, including transaction-monitoring holds, screening matches, and credit decisions for existing customers based on account history and credit-bureau data. Where an automated decision affects you significantly, such as declining a credit application or holding a payment, you may ask through the support portal for the decision to be reviewed by a person, and you may give us information you think we should take into account.

15. Data breaches

If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it as the NDPA requires, notify the CBN as its rules require, and tell you without undue delay where the risk to you is high, with advice on what to do.

16. Complaints

If you are unhappy with how we have handled your personal data, open a ticket on the support portal under the Data protection category and you will receive a reference number. If we do not resolve your complaint, you may complain to the Nigeria Data Protection Commission. Complaints about banking services, as distinct from data protection, follow the process in our terms and conditions and may be escalated to the CBN's Consumer Protection Department.

17. Changes to this notice

We will update this notice when our processing or the law changes. The effective date and version appear at the top. We will tell you about material changes through the app or by email at least thirty days before they take effect, and the current version will always be at viscountbank.com.

18. Contact

Data Protection Officer, Viscount Microfinance Bank Limited, 13, Yalinga Street, Off Ademola Adetokunbo, Wuse 2, Abuja, FCT, Nigeria. Contact through the support portal at support.viscountbank.com, Data protection category, 7am to 8pm WAT every day.

Nigeria Data Protection Commission: ndpc.gov.ng.