This Privacy Policy explains how Fortis Mobile Money Ltd (“Fortis Mobile Money”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects personal data obtained from customers, employees, partners, vendors, and other individuals (“data subjects”).

Fortis Mobile Money is committed to protecting your privacy and ensuring transparency in accordance with the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR), and other applicable data privacy and financial services laws and regulations.

1. FORTIS MOBILE MONEY AND YOU

This Privacy Policy governs the manner in which Fortis Mobile Money processes personal data in the course of providing financial and related services across all delivery channels, including mobile applications, websites, APIs, physical service points, and customer support channels (collectively referred to as the “Services”).

By using our Services, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy.

2. ROLES AND RESPONSIBILITIES

2.1 Data Protection Officer (DPO)

Fortis Mobile Money has appointed a Data Protection Officer (DPO) who is responsible for:

• Ensuring compliance with NDPA, NDPR, and other applicable data protection laws
• Keeping this Privacy Policy accurate, current, and effective
• Ensuring data subjects are properly informed prior to the collection and processing of personal data
• Serving as the primary contact point for data protection inquiries, complaints, and regulatory engagements

2.2 Staff and Third-Party Responsibility

All employees, contractors, agents, and third parties who process personal data on behalf of Fortis Mobile Money are required to:

• Comply with this Privacy Policy
• Process personal data strictly on a need-to-know basis
• Observe confidentiality and security obligations

3. PERSONAL INFORMATION WE COLLECT

We collect personal data through application forms, digital platforms, correspondence, customer support interactions, service points, and other lawful channels.

3.1 Categories of Personal Data

3.2 Use of Facial and Biometric Data

Why We Capture Facial Data: Facial recognition technology is used to verify user identity, confirm liveness, and reduce fraud during onboarding and authentication.

How Facial Data Is Processed: Facial data is processed locally on the user’s device solely for authentication and liveness detection.

Storage and Sharing: Facial data is not stored by Fortis Mobile Money and is not shared with any third party.

4. WHY WE NEED YOUR DATA

Fortis Mobile Money collects and processes personal data only where it is:

• Necessary for service delivery
• Required by law or regulation
• Essential for fraud prevention and risk management
• Relevant for improving customer experience

We do not collect or process more data than is reasonably required for a given purpose.

5. LEGAL BASIS FOR PROCESSING

Personal data is processed only on one or more lawful bases, including:

• Consent of the data subject
• Performance of a contract
• Compliance with legal obligations (e.g. AML, KYC, regulatory reporting)
• Protection of vital interests
• Public interest or official authority
• Processing permitted under national law, including biometric data

Each processing activity is documented and assessed prior to implementation.

6. CONSENT AND WITHDRAWAL

Where processing is based on consent:

• Consent is explicit, informed, and freely given
• Data subjects may withdraw consent at any time
• Withdrawal does not affect processing required by law or regulation

Failure to provide required consent may limit access to certain Services.

7. USE OF YOUR INFORMATION

We use personal data to:

• Provide and manage financial services
• Fulfil contractual obligations
• Prevent fraud and manage risk
• Improve products, platforms, and customer experience
• Maintain accurate records
• Communicate with customers
• Comply with laws, regulations, and internal policies

8. COOKIES AND TRACKING TECHNOLOGIES

Our website and digital platforms use:

• Functional cookies to remember user preferences
• Performance and analytical cookies to analyze website usage

Cookies help us:

• Recognize returning devices
• Improve usability and performance
• Secure our platforms

Further details are available in our Cookies Policy.

9. DATA SHARING AND DISCLOSURE

Fortis Mobile Money does not sell or rent personal data.

Personal data may be shared where:

• Consent has been provided
• Required by law or regulatory authorities
• Necessary for audits, investigations, or enforcement of rights
• Required for service delivery by trusted third-party providers

All third parties are subject to confidentiality and data protection obligations.

10. CROSS-BORDER DATA TRANSFERS

Where personal data is processed outside Nigeria, Fortis Mobile Money ensures:

• Adequate safeguards are in place
• Transfers comply with NDPA requirements
• Recipients meet applicable regulatory and security standards

11. INFORMATION SECURITY

We implement appropriate technical and organizational measures, including:

• Access controls and role-based permissions
• Encryption and secure storage
• System monitoring and incident response
• Staff training and awareness

Users are responsible for safeguarding their authentication credentials, including PINs, passwords, and OTPs.

12. DATA RETENTION

Personal data is retained only for as long as necessary to meet:

• Legal and regulatory requirements
• Contractual obligations
• Operational and audit needs

Data is securely destroyed once retention periods expire.

13. DATA SUBJECT RIGHTS

Under the NDPA 2023, data subjects have the right to:

• Access personal data
• Correct inaccurate or incomplete data
• Request erasure (subject to legal obligations)
• Restrict processing
• Request data portability
• Object to direct marketing
• Object to automated decision-making and profiling
• Lodge complaints and seek judicial remedies

14. COMPLAINTS AND REMEDIES

Data subjects may lodge complaints with:

• Fortis Mobile Money Data Protection Officer, or
• Nigeria Data Protection Commission (NDPC)

Complaints will be handled promptly and fairly.

15. CONTACT INFORMATION

Email: [email protected]

Phone: 02013301805

Address: Suite 402, 4th Floor, The Capital Hub, Ahmadu Bello Way, Mabushi, Abuja FCT, Nigeria

16. UPDATES TO THIS POLICY

We may update this Privacy Policy periodically. Material changes will be communicated through our official platforms.