Privacy Policy

Effective Date: July 31, 2026  ·  Last Updated: September 19, 2026

1. Introduction

NESTPOINT FINANCE THRIFT AND CREDIT CO-OPERATIVE SOCIETY LIMITED ("Nestpoint Finance", "we", "us" or "our") is committed to protecting the privacy, confidentiality and security of the personal information entrusted to us by our members, customers, prospective customers, employees, business partners and visitors to our website and digital platforms.

This Privacy Policy explains how we collect, use, disclose, store and protect personal data when you interact with Nestpoint Finance, including when you:

• visit our website;
• register as a member;
• apply for or obtain a loan;
• make savings or investment-related transactions;
• use our financial services;
• communicate with us;
• submit forms or documents to us; or
• otherwise interact with our services and representatives.

We process personal data in accordance with applicable Nigerian data-protection laws and regulations, including the Nigeria Data Protection Act 2023 (NDP Act) and applicable guidance issued by the Nigeria Data Protection Commission (NDPC).

2. Who We Are

Data Controller:

For privacy-related enquiries, complaints or requests concerning your personal data, please contact us using the details above.

3. Personal Data We Collect

Depending on the nature of your relationship with us, we may collect and process the following categories of personal data:

A. Identification Information

This may include:

• Full name;
• Date of birth;
• Gender;
• Nationality;
• Residential address;
• Telephone number;
• Email address;
• Signature;
• Passport photograph;
• Means of identification;
• NIN and/or other identification information;
• BVN where applicable;
• Tax identification information where applicable.

B. Contact Information

We may collect:

• Telephone numbers;
• Email addresses;
• Residential and office addresses;
• Emergency contact information;
• Next-of-kin information.

C. Financial Information

Where relevant to our services, we may collect:

• Bank account details;
• Bank statements;
• Salary information;
• Income and expenditure information;
• Savings records;
• Loan records;
• Repayment history;
• Credit information;
• Investment information;
• Transaction history;
• Payment information;
• Assets and liabilities;
• Financial obligations.

D. Employment Information

For products requiring employment or income verification, we may collect:

• Employer details;
• Employment status;
• Staff identification information;
• Job title;
• Salary information;
• Payroll information;
• Length of employment;
• Employment confirmation;
• Salary-deduction information.

E. Loan and Credit Information

If you apply for or receive credit from Nestpoint Finance, we may process:

• Loan application information;
• Requested loan amount;
• Loan purpose;
• Repayment capacity;
• Credit history;
• Existing obligations;
• Guarantor information;
• Collateral information;
• Repayment history;
• Default information;
• Credit scores and risk assessments;
• Information obtained from credit bureaux or other authorised sources.

F. Technical and Website Information

When you use our website or digital platforms, we may collect:

• IP address;
• Browser type;
• Device information;
• Operating system;
• Website activity;
• Login information;
• Cookies and similar technologies;
• Date and time of access;
• Security and authentication information.

4. How We Collect Personal Data

We may collect personal data:

• directly from you;
• through membership and registration forms;
• through loan applications;
• through our website and digital platforms;
• through telephone, email, WhatsApp or other communications;
• from your employer where authorised and necessary;
• from financial institutions;
• from credit bureaux;
• from guarantors or referees;
• from publicly available sources;
• from regulators and government agencies where permitted;
• from service providers and business partners; and
• from other lawful sources.

Where we obtain personal data from another person or organisation, we will take reasonable steps to ensure that the processing is lawful.

5. Purposes for Processing Personal Data

We may process your personal data for the following purposes:

1. Registering and managing membership accounts;
2. Providing financial and cooperative services;
3. Processing loan applications;
4. Assessing creditworthiness and repayment capacity;
5. Conducting customer and member verification;
6. Performing Know Your Customer (KYC) procedures;
7. Preventing fraud, money laundering and other financial crimes;
8. Processing payments and transactions;
9. Managing savings and loan accounts;
10. Monitoring loan repayments;
11. Communicating with customers and members;
12. Providing customer support;
13. Managing complaints and disputes;
14. Maintaining accounting and financial records;
15. Complying with applicable laws and regulatory requirements;
16. Responding to lawful requests from regulators and government authorities;
17. Managing risks and conducting internal audits;
18. Improving our products and services;
19. Protecting our systems, customers and organisation against fraud and security

threats;

1. Sending service-related communications;
2. Sending marketing communications where permitted by law and, where required,

with your consent;

1. Conducting research and analytics;
2. Enforcing contractual rights;
3. Establishing, exercising or defending legal claims; and
4. Performing other legitimate activities connected with our business.

6. Lawful Basis for Processing

Nestpoint Finance will process personal data only where there is a lawful basis for doing so.

Depending on the circumstances, our lawful bases may include:

Consent

Where required by law, we may obtain your consent before processing certain personal data.

You may withdraw consent where processing is based on consent, although withdrawal will not affect processing that occurred lawfully before the withdrawal.

Contractual Necessity

We may process personal data where processing is necessary to enter into or perform a contract with you, including membership, savings, lending and other financial-service agreements.

Legal Obligation

We may process personal data where necessary to comply with applicable legal, regulatory, accounting, tax, anti-money-laundering, financial-sector or other obligations.

Legitimate Interests

We may process personal data where necessary for legitimate business interests, provided that such interests do not override your applicable data-protection rights.

Protection of Rights and Legal Claims

We may process information where necessary to establish, exercise or defend legal claims or protect the rights, property and security of Nestpoint Finance, our members, customers or other persons.

7. Credit Information and Credit Reporting

Where applicable and permitted by law, Nestpoint Finance may obtain and process information relating to your credit history and financial obligations.

This may include information from authorised credit bureaux and other lawful sources.

Where required, we may provide relevant credit information to authorised credit-reporting agencies or regulatory systems for purposes including:

• credit assessment;
• responsible lending;
• fraud prevention;
• credit-risk management;
• regulatory compliance;
• debt management; and
• maintaining accurate credit records.

Where applicable, information may be reported in accordance with Nigerian law and regulatory requirements.

8. Sharing of Personal Data

We do not sell your personal data.

However, we may disclose or share personal data where necessary and lawful with:

• banks and payment service providers;
• authorised credit bureaux;
• regulators and government authorities;
• law-enforcement agencies where legally required;
• professional advisers;
• auditors;
• legal advisers;
• technology and IT service providers;
• cloud and hosting providers;
• identity-verification providers;
• debt-recovery service providers;
• insurance providers where relevant;
• authorised agents and contractors;
• business partners where necessary for providing requested services; and
• other parties where disclosure is authorised or required by law.

Third parties receiving personal data are expected to process it only for legitimate purposes and to maintain appropriate confidentiality and security.

9. International or Cross-Border Data Transfers

Where personal data is transferred outside Nigeria, Nestpoint Finance will take reasonable steps to ensure that the transfer is carried out in accordance with applicable Nigerian data-protection requirements.

Where appropriate, we may use contractual, organisational or other safeguards designed to protect personal data during such transfers.

10. Data Security

Nestpoint Finance takes reasonable technical and organisational measures to protect personal data against:

• unauthorised access;
• unlawful processing;
• accidental loss;
• destruction;
• alteration;
• disclosure;
• misuse; and
• other security threats.

Security measures may include access controls, authentication procedures, encryption where appropriate, secure systems, staff confidentiality obligations, monitoring and other safeguards appropriate to the nature of the information.

However, no electronic system or method of transmission over the internet can be guaranteed to be completely secure.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected or as required by applicable law, regulatory requirements, contractual obligations, legitimate business requirements or dispute-resolution purposes.

The retention period may vary depending on:

• the nature of the information;
• the type of service provided;
• legal and regulatory requirements;
• accounting requirements;
• outstanding contractual obligations;
• dispute or litigation requirements; and
• fraud-prevention and risk-management requirements.

When personal data is no longer required, we will take reasonable steps to securely delete, destroy or anonymise it, subject to applicable legal and regulatory requirements.

12. Your Data-Protection Rights

Subject to applicable law and any lawful limitations, you may have rights including:

Right to Information

You have the right to receive clear information about how your personal data is processed.

Right of Access

You may request access to personal data we hold about you.

Right to Rectification

You may request correction of inaccurate, incomplete or outdated personal data.

Right to Erasure

In circumstances permitted by law, you may request deletion of your personal data.

Right to Restrict Processing

You may request restriction of processing in circumstances permitted by applicable law.

Right to Object

You may object to certain types of processing where the law gives you that right.

Right to Data Portability

Where applicable, you may request your personal data in a structured and commonly used format and request its transfer to another controller where legally applicable.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw your consent.

Rights Relating to Automated Decision-Making

Where applicable, you may have rights concerning decisions made solely through automated processing that produce legal or similarly significant effects.

These rights are not absolute and may be subject to lawful exceptions.

13. How to Exercise Your Rights

To exercise your privacy rights, contact Nestpoint Finance through:

Email: info@nestpointfinance.com

Telephone: +234 916 149 6106

Office Address: Suite TF-B4, 4th Floor, Mall of Dubai, Gimbiya Street, Area 11, Garki, Abuja

Data Protection / Privacy Contact: Onyekeja Ugochukwu Stephen, stephenlegalservices@gmail.com, 0906 403 5713

Your request should provide sufficient information to enable us to identify you and understand the nature of your request.

For security reasons, we may request reasonable verification of your identity before processing certain requests.

We will handle requests within the timeframes required by applicable law.

14. Marketing Communications

Where permitted by law, Nestpoint Finance may send you information about our products, services, promotions and other relevant financial or cooperative offerings.

You may opt out of marketing communications by:

• using the unsubscribe option where available;
• contacting us directly; or
• following the instructions provided in the relevant communication.

Opting out of marketing communications will not prevent us from sending essential service, transaction, security or legally required communications.

15. Cookies

Our website may use cookies and similar technologies to:

• operate the website;
• improve functionality;
• understand website usage;
• maintain security;
• remember preferences; and
• improve user experience.

Where required, we will obtain appropriate consent for non-essential cookies.

You may be able to manage cookies through your browser settings.

16. Children's Data

Our services are primarily intended for adults and persons legally capable of entering into financial or cooperative arrangements.

We do not knowingly collect children's personal data for purposes that are not permitted by law.

Where processing of a child's personal data is required or permitted, we will take appropriate steps to comply with applicable legal requirements.

17. Data Breaches

Nestpoint Finance maintains procedures for identifying, assessing, managing and responding to personal-data breaches.

Where a personal-data breach occurs, we will take appropriate steps to:

1. contain and investigate the incident;
2. assess the potential impact;
3. take corrective measures;
4. document the incident;
5. notify relevant authorities where required; and
6. notify affected data subjects where required by applicable law.

18. Third-Party Websites

Our website may contain links to websites or services operated by third parties.

Nestpoint Finance is not responsible for the privacy practices, content or security of third-party websites.

We encourage users to review the privacy policies of third-party websites before providing personal information.

19. Confidentiality

Nestpoint Finance requires employees, agents, contractors and other authorised persons who have access to personal data to maintain appropriate confidentiality and process information only for authorised purposes.

Unauthorised access, use or disclosure of personal data may result in disciplinary, contractual, civil or other appropriate action.

20. Data Protection Officer / Privacy Contact

Nestpoint Finance will maintain an appropriate privacy and data-protection contact responsible for coordinating privacy-related matters and supporting compliance with applicable data-protection requirements.

Data Protection / Privacy Contact:

21. Complaints

If you believe that Nestpoint Finance has processed your personal data unlawfully or has otherwise violated your privacy rights, you should first contact us so that we can investigate and attempt to resolve the matter.

If you are dissatisfied with our response or where otherwise permitted by law, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC).

The NDPC provides mechanisms for data-protection complaints and privacy violations.

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes in our services;
• changes in technology;
• changes in applicable laws or regulations;
• regulatory guidance; or
• improvements to our privacy practices.

Where appropriate, we will publish the updated Privacy Policy on our website and update the "Last Updated" date.

You are encouraged to review this Privacy Policy periodically.

23. Contact Us

If you have questions, concerns or requests regarding this Privacy Policy or the processing of your personal data, please contact us:

Acknowledgement

By using our website or services, you acknowledge that you have had an opportunity to review this Privacy Policy.

Where consent is required by applicable law, Nestpoint Finance will obtain the appropriate consent before processing your personal data on that basis.