GAP FINANCE PRIVACY POLICY

Gap Finance Technologies Limited (hereinafter called “Gap Finance”, “we”, “us”, or “our”) is committed to protecting the privacy and personal data of users, customers, partners, and other stakeholders who interact with our platforms, products, and services.

This Privacy Policy explains how we collect, use, store, disclose, and protect personal data in accordance with the Nigeria Data Protection Act (NDPA) 2023, the General Application and Implementation Directive (GAID), applicable regulations issued by the Central Bank of Nigeria, and guidance provided by the Nigeria Data Protection Bureau.

• Scope of This Policy:

This Privacy Policy applies to all personal data processed by Gap Finance in connection with its websites, digital platforms, physical office operations, customer onboarding activities, financial services, technology services, and related business operations.

•  Personal Data We Collect:

Gap Finance collects personal data through multiple channels depending on how you interact with us. This includes information provided directly by you during account registration, service applications, form submissions, customer support interactions, and ongoing use of our products and services.

The personal data we collect may include identifying information such as your name, email address, telephone number, and onboarding or identification details required under applicable laws. We also process transactional and account-related data generated through your use of our financial services.

Where applicable, Gap Finance collects visual data through CCTV cameras installed at our physical office, which are used exclusively for security, fraud prevention, safety monitoring, and regulatory compliance. Access to CCTV footage is restricted to authorized personnel, and retention is limited to a period necessary to achieve the intended purpose.

Certain areas of our website may be accessed anonymously where functionality permits.

•  Lawful Basis for Processing:

Gap Finance processes personal data only where a lawful basis exists under the NDPA and GAID. Processing may occur where it is necessary for the performance of a contract with you, for compliance with legal or regulatory obligations, or where you have provided valid consent.

We may also process personal data where it is necessary for the legitimate interests of Gap Finance, such as fraud prevention, risk management, service improvement, and operational efficiency, provided such interests do not override your fundamental rights and freedoms.

•  Use of Personal Data:

Personal data processed by Gap Finance is used to support core business and regulatory functions. This includes establishing and verifying customer identity, onboarding customers, administering accounts, processing transactions, providing financial and technology services, and managing customer relationships.

Your personal data is also used to meet regulatory reporting requirements, support risk management and fraud detection activities, investigate suspicious or unlawful activity, and maintain the security and integrity of our systems and physical premises.

Gap Finance employs automated credit scoring models and algorithms to assess creditworthiness, evaluate loan eligibility, manage risk exposure, support fraud prevention and improve operational efficiency. These automated processes are supplemented by human oversight as required, and Data Subjects may request review of automated decisions affecting them.

We may also process personal data to carry out marketing and profiling activities. Profiling is conducted in a manner compliant with the NDPA and GAID, to understand customer needs, improve service delivery, and tailor communications and to inform you about products or services that may be relevant to your relationship with us. You retain the right to opt out of marketing communications where applicable.

• Data Security and Protection Measures:

Gap Finance implements appropriate technical, administrative, and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or unlawful disclosure.

Payment-related and sensitive transactional data is processed through Providus, a PCI-DSS–compliant payment service provider. Gap Finance does not store customers’ card details or sensitive payment credentials on its internal systems.

Access to personal data is restricted to authorized personnel and third parties who are subject to confidentiality and data protection obligations.

• Sharing and Disclosure of Personal Data:

Gap Finance does not sell or rent personal data. Personal data may be disclosed where necessary to trusted third-party service providers, correspondent banks, payment processors, and technology partners who support the delivery of our services. Such disclosures occur strictly on documented instructions and subject to confidentiality, security, and data protection obligations. Personal data may also be disclosed to regulators, supervisory authorities, law enforcement agencies, or courts where required by law, regulatory directive, or valid legal process.

• Cross-Border Transfers:

 Where personal data is transferred outside Nigeria, Gap Finance ensures that such transfers are lawfully justified under the NDPA and GAID, for example, via contractual safeguards, explicit consent, or regulatory requirements. All cross-border transfers are communicated to Data Subjects through this Privacy Policy.

Personal data may also be disclosed to regulators, supervisory authorities, law enforcement agencies, or courts where required by law, regulatory directive, or valid legal process.

• Data Retention:

Personal data is retained only for as long as necessary to fulfil the purpose for which it was collected, meet legal and regulatory requirements, satisfy audit obligations, resolve disputes, or enforce agreements.

Where data is no longer required, it is securely deleted or destroyed in accordance with internal retention policies and applicable law.

• Data Subject Rights:

You have the right to request confirmation as to whether Gap Finance processes personal data relating to you. Where such processing occurs, you may request access to information regarding the purpose of processing, categories of personal data involved, recipients or categories of recipients, and applicable retention periods.

You may also request correction of inaccurate or incomplete personal data, request deletion where legally permissible, and object to or restrict certain processing activities. Requests are subject to lawful limitations, including where disclosure would infringe the rights of others or conflict with regulatory obligations.

• Exercising Data Subject Rights:

Requests relating to personal data may be submitted using the contact details provided below. Gap Finance may require identity verification before processing any request. All requests are handled within timelines prescribed by applicable data protection laws.

• Data Protection Contact:

Gap Finance has designated a contact point for all data protection and privacy-related matters.

      Email : dataprotection@gapfinance.com

      Address : 2a, Adewole Kuku Street, Lekki Phase 1, Lagos

Requests and enquiries will be handled in accordance with the NDPA and GAID, subject to lawful limitations.

Data subjects may contact us to exercise their data protection rights, submit data access, correction, or deletion requests, make privacy-related enquiries or complaints.

• Lawful Restrictions:

Access to personal data may be restricted where disclosure would conflict with legal or regulatory obligations, compromise security or fraud prevention measures, or infringe the rights and freedoms of other individuals.

Any restriction will be applied proportionately and in accordance with applicable law.

•  Children’s Data:

Gap Finance does not knowingly collect or process personal data relating to children under the age of 16. Our services are intended for individuals aged 16 years and above.

•  What We Do Not Do With Personal Data:

Gap Finance does not sell personal data, share personal data for third-party marketing, or process personal data beyond disclosed lawful purposes.

• Updates to This Privacy Policy:

This Privacy Policy may be reviewed and updated periodically to reflect regulatory, operational, or legal changes. Updates will be published on this page and take effect upon posting.

Version 2 - Last updated on February 17, 2026.