Echezona Privacy Policy

1.1 Changes to the data privacy policy

This privacy policy may be revised in the course of time if new features are added, or if proposals from our customers are implemented. We reserve the right to change this privacy policy at any time, and to place the revised version on our website. The revised version becomes effective upon the expiration of a period of 30 days after it has been changed on the website. It will be assumed that you have agreed to all changes to the privacy policy if you continue to use the services after this period. If you do not agree to the provisions of the privacy policy, you can cancel your account at any time.

1.2 Links on the Echezona Website.

Some sections of our website contain links to the websites of third parties. These pages are subject to their own privacy policies. Echezona is not responsible for its operation, including data handling. Users who send information to or via such third-party sites should check the privacy policies of these sites before they share information with them. It is hereby clarified that these privacy policies do not represent any framework agreement within the meaning of the NCS and its transposition laws in the Nigerian Central Switching ISO 8583. Our services are available in compliance with the legal data protection provisions, which are described in the NCS and Nigerian Data Protection Act, 2023.

2.1 Required Information

We will only collect your personal data if you voluntarily share it with us, for example via our website, by email, or by telephone. To process payments with Echezona, you must also specify your bank account information. We additionally require more information about yourself and your company if you want to use our service in its entirety. For tests only, a valid email address and a password are required.

Under some circumstances, we will also ask you certain security questions. We need this information to process transactions, assign new passwords, carry out checks to protect you from credit card and bank account fraud if you have forgotten your current password, and connect you with the administration of your account or of our services.

If you are transferring or receiving sums of money exceeding the amounts stipulated by anti-money laundering regulations, we may require more information about you or your company in order to meet the legal requirements.

2.2 Transaction Data.

If you use our service, we may request to store some information, including:

• Your name, mailing address, city, state, zip code, email address, phone number, BVN, and IP address
• Your credit or debit card or bank account numbers, expiration date and card holder or account holder name
• Social Security Number (SSN) and/or employer identification number (EIN);
• Unique identifiers such as user name, account number, and password
• IP address and other information about your computer, or the device that you use to access your user account, in order to monitor your account in relation to unauthorized access

2.3Information about you from third parties

To protect against potential fraud, with the help of payment processors and/or credit agencies, we check the information you have provided in the list that is within the section "Use and disclosure of information" (see below). In the course of this verification, we will receive personally identifiable information about you via these services. If you owe money to Echezona, we are authorized to perform a review of your credit rating, within the legal limits, by obtaining additional information about you from the credit agency. At its sole discretion, Echezona also, reserves the right, after conducting its own test, to periodically retrieve from a credit agency a business or customer credit report for each account, examine it and close accounts based on the information obtained during the credit check process.

2.4 Additional Verification.

If we cannot verify the information you have provided, or if we need additional information regarding your company, we will ask you to send additional information by email, scan, or post (such as disclosure of all shareholders, excerpt from the commercial register not older than 3 months, account or credit card statement, or other information that places you in connection with the appropriate address), or we will perform a postal identity check. Echezona reserves the right under some circumstances to make an onsite visit to your company.

2.5 Correspondence with Customer Service.

If you send us correspondence, including emails, social media messages, and faxes, they will be stored in your account. We also save the entire customer service correspondence and other correspondence from Echezona addressed to you. We store this data to document our customer relationships, evaluate and improve our customer service, and investigate potential fraud or violations of our terms of use. The data will of course be deleted or blocked under applicable legislation.

3.1 Data Usage.

You agree that we may use and store your personal information for the following purposes:

• Internal use;
• Providing the services and customer services you have requested;
• Resolving conflicts, collection of fees, troubleshooting problems;
• Prevention of potentially illegal or prohibited activities;
• Enforcing our terms of use;
• Adjustment, review, and improvement of our services;
• Comparison of information for determining accuracy and validation using third parties.

Disclosure of customer information via financial institutions: Please be advised that financial institutions from whom you purchase and with whom you concluded a contract, may have their privacy policies and that Echezona is not liable for their application and manner of operation. Under some circumstances within the privacy policy, your information may be accessed by additional third parties. Therefore, please check whether you agree with the respective financial institution or third party's privacy policy.

3.2 Disclosure of data to third parties.

Echezona does not sell or rent any personal information to third parties for their marketing purposes. Disclosure takes place solely for the purposes described in this policy. You expressly agree and indicate to Echezona, that the following measures will be taken:

• Disclosure of information, including, but not limited to transaction data, accounts, personal data, and the exchange of information with police, security forces, state, inter-governmental and supra-national institutions, agencies (except tax authorities), departments or regulatory authorities, or organizations (including but not limited to the authorities listed below in the table, under the heading "Authorities"), or third parties, including group corporations, regarding whom we believe there is cause for investigating cases of fraud or other unlawful or potentially unlawful activity, as well as violations of our terms of use (including your debit card, credit card or Platinum or Gold card provider, or other account payment source). If you have given us false or inaccurate information and we determine that there is an instance of fraud, we will disclose the relevant data to appropriate credit agencies for the prevention of fraud, or to law enforcement agencies. We and other organizations may use this data (including data from other countries) to prevent fraud and money laundering.
• Disclosure due to credit card regulations or because of a criminal or civil process. In this table, the phrase ‘All account information’ includes: name, address, email address, telephone number, IP address, account number, BVN, account type, details of funding instruments associated with the account, details of payment transactions, details of commercial transactions, customer information, and reports, account settings, customer data that we have received in the course of the legal obligation to identify our customers, and customer correspondence.
• With regard to the section "Purpose", all third-party providers, except for the authorities and group corporations, are obliged to conform to their contractual obligations over and against Echezona, as listed at the end of this table. The authorities are obliged to fulfill their regulatory objectives and provisions.
• Disclosure of information to your agent or legal representative (such as the holder of power of attorney granted by you or a guardian appointed for you).
• Disclosure of aggregated statistics to our business partners or PR partners. This summarized information is fully anonymous and does not contain any personal information.

Like with other companies, it is possible that Echezona will enter into joint ventures in the future, or be acquired by another company. If such an acquisition takes place, you agree that the subsequent company will gain access to the information managed by Echezona, including information regarding member accounts. The subsequent company will still be bound by the privacy policy unless it is changed accordingly.

3.3 Our Contact with Financial Institutions.

We generally communicate with financial institutions via email or phone to provide requested services: in the processing of customer complaints, to reply to customer inquiries, to inform you that in our view your user account is being used for an unauthorized purpose, to confirm information concerning your person, to confirm your business or banking transactions, for the collection of receivables, to conduct customer surveys, or to investigate suspicious transactions.

We use your email address or postal address to confirm your user account, to send you notifications about for example, the entrance or the debiting of payments via Echezona, to inform you about important changes to our products and services, and to send you notices and other legally prescribed announcements. In general, members cannot choose what messages they will receive. The messages are mainly sent for informational purposes and not for advertising purposes.

In connection with independent audits of our financial statements and transactions, auditors may contact some of our customers to confirm the correctness of our documents. The auditors may use any personal data for secondary purposes.

6.1 Basic principle: trustworthy handling of your data.

Echezona handles the data you provide carefully and conscientiously. Collection, processing, and use of your data only proceeds in the context of the legal provisions, or in the case of your explicit consent. Your personal data and the personal data of others that you provide us with, will not be sold, rented, or disclosed to third parties for other commercial reasons, such as for marketing purposes. Personal data consists of individual details about your personal or factual circumstances. Once personal data regarding a person or transaction is transmitted to Echezona, it will only be used for processing contracts paid via Echezona Digital Gateway Limited.

6.2 Technical, Organizational Data Protection.

Our own standard is that our measures are always above the industry standard (‘best practice’). To this end, we require that anyone who may come in contact with your personal data, commit to maintaining data confidentiality. These obligations also remain in force after the termination of activities with Echezona Digital Gateway Limited.