Information Security

1. Our Commitment to Information Security

At Riverly Finance Company Limited, the security of information entrusted to us by our customers, partners, and stakeholders is a fundamental business priority. We operate a certified Information Security Management System (ISMS) aligned to ISO 27001:2022 and maintain compliance with NDPC standards, reflecting our commitment to the highest levels of information security governance.

2. Governance and Oversight

Our information security programme is overseen by senior management and governed by a formal ISMS. We conduct annual management reviews of our security posture, set measurable information security objectives, and continuously improve our controls in line with ISO 27001:2022 requirements.

3. Data Classification and Handling

All information we handle is classified according to its sensitivity and managed in line with defined handling procedures. Access to sensitive information is restricted to authorised personnel with a legitimate business need.

4. Access Control

We enforce strict access controls across all our systems, including multi-factor authentication, role-based access, and the principle of least privilege. Access rights are reviewed quarterly and revoked immediately upon a staff member’s departure.

5. Risk Management

We conduct planned risk assessments following recognised methodologies to identify and address emerging threats and vulnerabilities. Risk treatment plans are maintained and reviewed regularly.

6. Third-Party Security

All third-party providers who handle data on our behalf are subject to formal due diligence, contractual security obligations, and periodic vendor risk assessments. We require all third parties to maintain security standards consistent with our own.

7. Incident Management

We maintain a formal incident response programme with defined escalation procedures, 24/7 monitoring capabilities, and clear notification processes. In the event of a security incident affecting your data, we will notify affected parties in accordance with applicable regulatory requirements.

8. Business Continuity

We maintain documented business continuity and disaster recovery plans that are tested regularly to ensure the continued availability of our services in the event of a disruption.

9. Regulatory Compliance

Riverly Finance Company Limited operates in accordance with applicable Nigerian regulatory requirements, including the Nigeria Data Protection Regulation (NDPR) and the Central Bank of Nigeria (CBN) cybersecurity framework. We maintain NDPA compliance in relation to the privacy of our customer information and payment processing operations.

10. Security Awareness

All Riverly Finance staff complete mandatory information security awareness training upon joining the organisation and annually thereafter. Our security programme is continuously updated to address the evolving threat landscape.

11. Your Responsibilities as a Partner or Customer

We ask that organisations working with Riverly Finance Company Limited uphold equivalent information security standards when handling any data shared with them. All third-party agreements with Riverly Finance Company Limited include explicit data protection and security obligations.

12. Data Protection

We process personal data lawfully, fairly, and transparently, in accordance with the NDPA. If you have questions about how we handle your data or wish to exercise your data protection rights, please contact us at [email protected]. You can also read our Privacy Policy for full detail on how we collect, use, and share personal data.

13. Reporting a Security Concern

If you believe you have identified a security vulnerability or concern involving Riverly Finance, please contact us at [email protected].

Riverly Finance Company Limited is committed to maintaining the confidentiality, integrity, and availability of all information in our care. Our information security practices are reviewed and updated regularly to reflect changes in the threat landscape, regulatory requirements, and business objectives.