Privacy Policy.

At ProvidusUnity Bank we collect and process your Personal Data in accordance with this privacy notice (including our Terms and Conditions) and in compliance with the relevant data protection regulations and laws. This notice provides you with the necessary information regarding your rights and our obligations, and explains how, why and when we process your personal data.

This privacy policy is addressed to:

• Recruitment Candidates
• Customers
• Vendors
• Website Visitors
• ATM Users
• POS Merchant Users
• CCTV Surveillance Subjects
• Influencers and Testimonial Data
• SME Program Data & Partners for CSR Programs
• Events Participants
• Recipients of electronic or other communications which contain or refer to this Privacy Policy

We process your Personal Data to provide our products and services. We collect only necessary personal data and process it as specified in this Policy. We take your data privacy seriously and will not disclose, share or sell your data without your consent, unless required by law.

Recruitment Candidates

We process: name, address, phone number, email, passport photograph, CV/resume, academic qualifications and certifications, employment history and medical information. Purpose: to conduct recruitment exercises and communicate with applicants. Lawful basis: consent and legal obligation.

Customers

We process: name, BVN, address, email, phone number, passport photograph, date of birth, card preferences, employment details, next-of-kin details, voice, card details and mobile device information. Purposes:

• To provide tailored products and services (lawful basis: contract)
• To provide support services via our business concierge
• To fulfil our KYC obligations (lawful basis: legal obligation)
• To send electronic marketing communications (lawful basis: consent)
• To issue debit/credit cards and facilitate payment processing (lawful basis: consent)
• To conduct customer surveys (lawful basis: consent)

Vendors

We process: name, phone number, email address. Purpose: to establish communication and ensure delivery of contracted goods and services. Lawful basis: performance of a contract.

Website Visitors

We process: name, number, email, location, unique ID, IP address and browser information. Purposes: to address requests submitted via website forms (lawful basis: consent), to generate statistics on website usage, and to improve and customise your experience on our website.

ATM Users

We process: image snapshots. Purposes: to verify that the person using the ATM card is the authorised user (lawful basis: legal obligation), and to assist investigations when a transaction dispute occurs.

POS Merchant Users

We process: Business Name, Merchant Trade Name, Type of Business, Category, Office Address, LGA, State, contact person names and designations, phone numbers, email, signatures, terminal locations and settlement account details. Purpose: to onboard a merchant for POS services. Lawful basis: performance of a contract.

SME Programs Data

We process: Title, Name, Gender, Marital Status, Phone Number, Age Range, Home Address, Date of Birth, Email, State of Origin/Residence, Nationality, Education, Company details, Business Sector and Social Media. Purpose: to provide bank services for SME activities. Lawful basis: performance of a contract.

Events Participants

We process: Name, Contact number, Email, Gender, Preferred location. Purpose: for marketing purposes. Lawful basis: consent.

Please note that the personal data elements listed above are not exhaustive.

We collect information through the following channels:

• Online forms
• Website interactions
• Hard copy forms
• Email communications
• Employment CVs
• Mobile camera (with permission)
• CCTV surveillance

Notification: You will be notified of the presence and purpose of CCTV cameras at all times.

ProvidusUnity Bank only retains personal data for as long as necessary under applicable regulations. The length of time your personal data is stored depends on the purpose of data processing, with the data being retained only as long as reasonably required by law or best practice.

Our website and application are not intended for use by children under the age of 18. Children's accounts are processed in line with the consent of parents or legal guardians.

We do not knowingly collect personal information directly from children under 18. If we learn that we have collected personal information from a child under 18, we will promptly delete it.

You have the right to access any Personal Data that we process about you and to request information about:

• What personal data we hold about you
• The purposes of the processing
• The categories of personal data concerned
• The recipients to whom your personal data has been or will be disclosed
• How long we intend to store your personal data
• The source of data if we did not collect it directly from you

If you believe we hold incomplete or inaccurate data about you, you have the right to ask us to correct and/or complete the information. We will strive to correct it as quickly as possible unless there is a valid reason not to do so, in which case you will be notified.

In some circumstances you also have a right to request a portable extract of your personal data, and a right to lodge a complaint to the Nigeria Data Protection Commission. You also have the right to request erasure of your personal data, to restrict processing, to object to certain processing operations, and not to be subject to any automated decision-making.

We do not share or disclose any of your Personal Data without your consent, other than for the purposes specified in this notice or where there is a legal requirement.

We use data processors (third parties) to provide some services and business functions. However, all data processors acting on our behalf are required to only process your data in accordance with instructions from us, and to comply fully with this privacy notice and all applicable data protection laws.

Under certain circumstances, we may be required to disclose your Personal Data if required to do so by law, or in response to valid requests by public authorities (such as a court or a government agency).

We may use third-party services on our website or applications. These services may collect and process personal information on our behalf. We ensure that all third-party services are reputable and comply with applicable data protection laws. Third-party processors include:

• External Auditors
• Credit Agencies
• Correspondent Banks

We take your privacy seriously and take every reasonable measure and precaution to protect and secure your personal data. We work hard to protect you from unauthorised access, alteration, disclosure or destruction.

We have implemented security controls at several layers of our IT infrastructure, including network security, encryption, restricted access, firewalls, anti-virus/malware and other security forms to ensure that your data is protected.

We require all parties — including our staff and third parties — to comply with relevant policies and guidelines to ensure confidentiality and protection of information in use, during storage and during transmission. Our security controls are regularly updated to meet and exceed industry standards.

ProvidusUnity Bank puts in place safeguards to ensure that the recipient adequately protects your personal data. With respect to transfers of personal data from Nigeria to outside the country, ProvidusUnity Bank will not transfer your personal data to another country unless the recipient country is subject to a law, binding corporate rules, contractual clauses, code of conduct or certification mechanism that affords an adequate level of protection in accordance with the Nigeria Data Protection Act.

For more information about specific transfer mechanisms, including information on existing safeguards, please contact us at dpo@providusunitybank.com.

As noted in the Information We Collect section, we occasionally process your Personal Data under the 'legitimate interests' basis. We ensure we have weighed your interests and any risk posed to you against our own interests, ensuring they are proportionate and appropriate.

Where you have consented to us using your details for direct marketing, we will keep such data until you notify us otherwise and/or withdraw your consent.

Owing to our legal and regulatory obligations, ProvidusUnity Bank sometimes needs to process sensitive Personal Data about you — for example, to uniquely identify or distinguish you, and sometimes for regulatory reasons.

Where we collect such information, we will only request and process the minimum necessary for the specified purpose and identify a compliant legal basis for doing so. Where we rely on your consent for processing sensitive data, we will obtain your explicit consent. You can modify or withdraw consent at any time, which we will act on immediately unless there is a legitimate or legal reason not to do so.

Our website may contain links to other sites that are not operated by us. When you click on such links, you will be directed to that third party's site.

We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

We will let you know via email and/or a prominent notice on our service, prior to the change becoming effective, and update the "Last Updated" date at the top of this Privacy Policy. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

If you have any questions or requests relating to this Privacy Policy or your personal data, please contact our Data Protection Officer:

• Email: dpo@providusunitybank.com
• Address: 114, Adeola Odeku Street, Victoria Island, Lagos
• Phone: +234 700 PROVIDUS

You also have the right to lodge a complaint with the Nigeria Data Protection Commission if you believe your data protection rights have been infringed.