Privacy Policy

1. Introduction

Riverly Finance Company Limited (“Riverly”, “we”, “us”, “our”) respects your privacy and is committed to protecting your personal data in accordance with the Nigeria Data Protection Act, 2023 (the “NDPA”), the regulations and directives issued under it, applicable Central Bank of Nigeria guidelines, and other relevant Nigerian legislation. This Privacy Policy explains how we collect, use, share, and protect personal data when you use the Riverly Personal Application or Riverly Business (each an “App” and together the “Apps”).

2. Scope

This Policy applies to the personal data we collect through the Apps, including during registration, identity and business verification, and your ongoing use of our Services. It should be read together with our Terms and Conditions.

The Riverly Personal Application is provided to individuals. Riverly Business is provided to registered businesses, and this Policy applies to the personal data of the individuals connected to a business account, including its directors, shareholders, beneficial owners, authorised signatories, and any employees or representatives granted access. Where information relates to a business rather than to an identified or identifiable individual, it does not constitute personal data under the NDPA, but we treat it as confidential and handle it in line with this Policy.

3. Our Role in Processing Your Data

Riverly is the data controller for the personal data processed through the Apps, meaning that we determine the purposes for which, and the manner in which, that data is processed. Where a business uses Riverly Business to transmit or store the personal data of its own customers, suppliers, or employees, that business remains the controller of that data and we act as a processor on its instructions in respect of it.

4. Information We Collect

The categories of personal data we collect depend on the App you use and the products you apply for.

Personal users (Riverly Personal Application)

• Identity information, including full name, date of birth, gender, phone number, email address, and residential address;
• Passport photograph or selfie and liveness data;
• Government-issued identification details, including your Bank Verification Number (BVN) and/or National Identification Number (NIN);
• Account and wallet details, transaction history, and income information; and
• Where applicable to a lending product, employment and bank statement information.

Business users (Riverly Business)

• Business information, including registered business name, RC number, Tax Identification Number, business address, nature of business, and registration documents filed with the Corporate Affairs Commission;
• Personal data of directors, shareholders, beneficial owners, and authorised signatories, including names, dates of birth, addresses, identification details, BVN and/or NIN, and photographs or selfie and liveness data;
• Details of employees or representatives authorised to operate the business account, including their names, roles, contact details, and access permissions;
• Business account and wallet details, transaction history, invoices, purchase orders, and supporting trade documents; and
• Where applicable to a lending or trade finance product, financial statements, bank statement information, and details of counterparties.

Information we collect from all users

• Device and technical information, including device identifiers, IP address, operating system, App version, and log data;
• Usage information, including how you interact with the App, the features you use, and session activity; and
• Records of your correspondence with us, including support enquiries and complaints.

5. How We Collect Information

We collect personal data directly from you when you register, apply for a product, or contact us; automatically through your use of the Apps; and from third parties such as credit bureaux, identity and business verification providers, the Corporate Affairs Commission, and our banking and technology partners, where necessary to verify identity, confirm the existence, ownership, and control structure of a business, or assess an application.

Where you provide us with the personal data of another individual, including a director, signatory, or employee, you confirm that you are permitted to do so and that you have made that individual aware of this Policy.

6. How We Use Your Information

We use your personal data to:

• verify your identity and, where applicable, the identity, ownership, and control structure of your business, and carry out KYC, KYB, and AML/CFT checks;
• open and administer your Account and process your Transactions;
• assess and administer applications for savings, investment, lending, and trade finance products;
• manage user roles, access rights, and approval limits on a business account;
• detect, investigate, and prevent fraud, money laundering, terrorism financing, and other financial crime;
• comply with legal and regulatory obligations, including reporting to the Central Bank of Nigeria, the Nigerian Financial Intelligence Unit, and other competent authorities;
• communicate with you about your Account, Transactions, and our Services;
• maintain and improve the security and performance of the Apps; and
• where you have given consent, send you marketing communications about products that may interest you, which you may opt out of at any time.

7. Legal Basis for Processing

We process your personal data on one or more of the following legal bases: performance of a contract with you, or steps taken at your request before entering into a contract; compliance with a legal or regulatory obligation; our legitimate interests in operating and securing a safe financial platform, provided these interests do not override your rights; and, where applicable, your consent.

8. Automated Processing and Credit Decisions

Certain of our processes, including fraud and sanctions screening and the initial assessment of a credit or trade finance application, may involve the automated processing of your personal data. Where a decision that produces a legal or similarly significant effect is based solely on automated processing, you may request human review of that decision, express your point of view, and contest the outcome by contacting us using the details in Section 18.

9. Sharing and Disclosure of Information

We may share your personal data with:

• our licensed banking and settlement partner, for the purpose of holding and processing funds;
• payment infrastructure, technology, and compliance verification providers engaged to deliver the Services;
• the Nigeria Inter-Bank Settlement System (NIBSS) and other payment schemes, for the processing of transfers;
• regulators and law enforcement, including the Central Bank of Nigeria, the Nigerian Financial Intelligence Unit, the Nigeria Data Protection Commission, and courts of competent jurisdiction, where required by law;
• credit bureaux, in connection with lending and trade finance products;
• other authorised users on the same business account, where you use Riverly Business, to the extent necessary for them to perform their role;
• counterparties to a Transaction, limited to the information required to identify the account and complete the transfer;
• our professional advisers and auditors, where necessary; and
• a successor entity, in the event of a merger, acquisition, or restructuring of our business, subject to equivalent data protection safeguards.

We do not sell your personal data to third parties.

10. Obligations of Business Users

If you operate a business account, you are responsible for keeping the information you provide about your business and the individuals connected to it accurate and up to date, for notifying us promptly of any change in directors, beneficial owners, or authorised signatories, and for withdrawing access from users who are no longer entitled to it. Where you upload or transmit the personal data of your own customers, suppliers, or employees, you confirm that you have a lawful basis for doing so and that you have provided the notices required under the NDPA.

11. Data Storage and Security

We implement administrative, technical, and physical safeguards designed to protect your personal data against unauthorised access, loss, misuse, or alteration, including encryption, access controls, role-based permissions, and ongoing security monitoring. While we work continuously to strengthen our information security practices, no system can be guaranteed to be completely secure. You are responsible for keeping your login credentials, transaction PIN, and one-time passwords confidential.

12. Data Retention

We retain your personal data for as long as your Account remains active, and thereafter for the period required to meet our legal, regulatory, tax, and audit obligations, or to resolve disputes, after which it will be securely deleted or anonymised. Records relating to identity and business verification, Transactions, and AML/CFT obligations are retained for the minimum periods prescribed by applicable Nigerian law and regulation.

13. Your Rights

Subject to applicable law, you have the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your data, where we are not required to retain it for legal or regulatory purposes;
• object to, or request restriction of, certain processing;
• request a copy of your data in a portable format; and
• withdraw consent, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

These rights belong to individuals. Where a business account is involved, a request may be made by the individual whose personal data is concerned, and we may require confirmation of that individual’s connection to the account before responding. To exercise any of these rights, please contact us using the details in Section 18.

14. Cookies and Similar Technologies

The Apps and our website at www.riverly.ng may use cookies, analytics, and similar technologies to understand usage patterns, remember your preferences, and improve performance and security. You may be able to manage certain preferences through your device or browser settings, although disabling them may affect the functionality available to you.

15. Children’s Privacy

The Apps are not intended for individuals under the age of 18, and we do not knowingly collect personal data from minors. If we become aware that we have collected such data, we will take steps to delete it.

16. International Data Transfers

Where your personal data is processed or stored outside Nigeria, including through cloud or technology infrastructure providers, we take steps to ensure that such transfers are subject to an adequate level of protection consistent with the requirements of the Nigeria Data Protection Act, 2023.

17. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. We will notify you of material changes through the Apps or by other reasonable means, and the Effective Date at the top of this document will indicate when it was last revised.

18. How to Contact Us

If you have questions, requests, or complaints about this Privacy Policy or how we handle your personal data, please contact our Data Protection Officer, our support team, or reach us through either App. You may also lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data protection rights have been infringed.