Privacy Policy

Kobo Vault Technology Limited (“Kobo Vault”, “KoboVault”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal data entrusted to us.

KoboVault is part of the Kobo Super App.

This Privacy Policy explains how we collect, use, disclose, store and protect personal data when you use our mobile applications, websites, digital platforms, products and services (collectively, the “Services”), or otherwise interact with us.

We process personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Act General Application and Implementation Directive (GAID) 2025, applicable regulations and guidance issued by the Nigeria Data Protection Commission (NDPC), and other applicable laws.

This Privacy Policy should be read together with any applicable Terms and Conditions and other privacy notices we may provide in connection with specific Services.

Kobo Vault Technology Limited is responsible for determining how and why personal data is processed in connection with our Services where we act as a Data Controller.

In certain circumstances, we may process personal data on behalf of another organisation as a Data Processor. Where this applies, the relevant organisation remains responsible for determining the purposes and means of processing.

For privacy-related questions or requests, you may contact us using the details provided in Section 16.

3.1 Information we collect

Depending on the Services you use and how you interact with us, we may collect the following categories of personal data:

3.1.1 Personal and Account Information

1. Full name;
2. Date of birth;
3. Email address;
4. Telephone number;
5. Residential or business address;
6. Account and profile information;
7. Login and authentication information;
8. Employment or business information.

3.1.2 Identity and KYC Information

Where required, we may collect:

1. Bank Verification Number (BVN);
2. National Identification Number (NIN);
3. Government-issued identification information;
4. Identification documents;
5. Photographs or verification images;
6. Address-verification information;
7. Know-Your-Customer (KYC) information;
8. Customer due-diligence information;
9. Biometric or biometric-related information.

3.1.3 Financial crime checks

We may also process information necessary for anti-money laundering (AML), counter-terrorist financing (CFT), sanctions and fraud-prevention checks.

3.1.4 Financial and Transaction Information

Depending on the Services you use, this may include:

1. Account information;
2. Bank account details;
3. Card and payment information;
4. Account balances;
5. Transaction history;
6. Transfers and payment instructions;
7. Beneficiary information;
8. Payment references and confirmations;
9. Fees and payment records;
10. Refunds, reversals and disputes.

3.1.5 Device and Usage Information

We may automatically collect information such as:

1. Device type and model;
2. Operating system;
3. Application and browser information;
4. IP address;
5. Device identifiers;
6. Network information;
7. Log and security information;
8. Crash and diagnostic information;
9. Information about how you use and interact with our Services.

3.1.6 Information From Third Parties

Where permitted by law, we may receive information from banks, payment providers, identity-verification providers, fraud-prevention providers, regulators, government authorities, business partners and other service providers.

3.2 Sensitive Personal Data and Identity Verification

To verify your identity, we may ask you to complete a liveness or facial-matching check using a photograph or video of your face. This is biometric data, which the Nigeria Data Protection Act 2023 treats as sensitive personal data.

We process this data only with your explicit consent, which we ask for in the app before the check begins, or where another condition for processing sensitive personal data applies under the NDPA.

We use your BVN, NIN and verification images only to confirm who you are and to meet our legal and regulatory obligations. We share them with our identity-verification provider (Dojah Technologies Limited) and, where needed to open or operate your account, with our banking partner (Safe Haven Microfinance Bank). We do not use them for marketing.

You can withdraw your consent at any time by contacting us. If you do, we may be unable to open or keep your account, because we are required to verify the identity of our customers. Verification records are kept for the period stated in Section 9.

We may collect personal data directly from you, automatically through your use of our Services, or from authorised third parties and other lawful sources.

1. We may use personal data to:

1. Create and manage your account;
2. Provide and administer our Services;
3. Process payments, transfers and other transactions;
4. Verify your identity and perform KYC checks;
5. Meet AML, CFT and other regulatory requirements;
6. Detect and prevent fraud, financial crime and unauthorised activity;
7. Protect your account, our systems and our customers;
8. Provide customer support;
9. Send transaction, security and service-related communications;
10. Improve, test and develop our products and Services;
11. Analyse usage and system performance;
12. Resolve complaints and disputes;
13. Maintain financial, accounting and business records;
14. Establish, exercise or defend legal claims;
15. Comply with applicable laws, regulations and lawful requests from authorities.

2. Where appropriate, we may use aggregated, anonymised or de-identified information for analytics, research, security and service improvement.

We process personal data only where we have a lawful basis to do so under applicable law.

Depending on the circumstances, this may include:

1. Performance of a contract: where processing is necessary to provide a Service you have requested or to perform our agreement with you;
2. Legal obligations: where processing is necessary to comply with applicable laws, regulations, regulatory requirements or legal obligations;
3. Consent: where we are required to obtain your consent for a particular processing activity;
4. Legitimate interests: where processing is necessary for legitimate interests pursued by us or a third party, provided those interests do not override your applicable rights and freedoms;
5. Vital interests or public interest: where processing is permitted or required on these grounds under applicable law.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal will not affect processing carried out before the withdrawal.

We do not sell your personal data. We share it only where needed to provide our Services, meet legal obligations or protect our customers. The main recipients are:

1. our banking partner (Safe Haven Microfinance Bank), which holds customer accounts and processes transfers;
2. our identity verification provider (Dojah Technologies Limited);
3. our bill payment provider (Broadshift Technologies Limited, operator of VTpass) for airtime, data, electricity, cable TV and similar purchases;
4. our card issuing partner (Sudo Africa Limited), once card services are available;
5. cloud, technology, communications and customer-support providers;
6. professional advisers such as lawyers and auditors; and
7. regulators, courts and law enforcement agencies where the law requires or permits it.

Partners that process data on our behalf must protect it and use it only for the purpose we give them. Some partners may process data outside Nigeria (see Section 11). Where a partner is itself responsible for your data, for example a bank, its own privacy notice also applies.

As a financial technology business, we may process personal and transactional information to prevent, detect and investigate fraud, money laundering, terrorist financing, sanctions violations, identity theft, account takeover and other unlawful or suspicious activities.

We may use internal systems and third-party solutions to verify identities, monitor transactions, assess risks and detect unusual activity.

We maintain reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure or destruction. These measures may include access controls, authentication, encryption, monitoring, logging, security testing, fraud monitoring and incident-response procedures.

You are responsible for keeping your passwords, PINs, OTPs and other account-security information confidential.

Kobo Vault will not ask you to disclose your PIN, password or OTP through unsolicited communication.

Our websites, applications and other digital Services may use cookies, device identifiers, software development kits, pixels, analytics tools and similar technologies.

We may use these technologies to:

1. Operate and secure our Services;
2. Authenticate users;
3. Remember preferences;
4. Detect fraud;
5. Understand how our Services are used;
6. Measure performance;
7. Diagnose technical problems; and
8. Improve functionality and user experience.

Where required by law, we will provide appropriate information and choices concerning non-essential cookies and similar technologies.

We keep personal data only for as long as we need it for the purposes in this Policy, or for longer where the law requires.

Identity (KYC), account and transaction records are kept for at least 5 years after our relationship with you ends, because anti-money-laundering rules and our banking and payment partners require it. Other personal data is kept for 12 months after you close your account or stop using our Services, or until you withdraw your consent where consent was the basis for using it.

If you ask us to delete your data, we will do so unless we must keep it for the reasons above. In that case we will tell you what we are keeping and why, and we will not use it for any other purpose.

When personal data is no longer needed, we securely delete, destroy or anonymise it.

Closing your account does not mean we delete all your data straight away.

Subject to applicable law and lawful limitations, you may have the right to:

1. Request access to personal data we hold about you;
2. Request correction of inaccurate or incomplete information;
3. Request deletion of personal data where legally permitted;
4. Request restriction of certain processing;
5. Object to certain processing activities;
6. Request portability of your personal data where applicable;
7. Withdraw consent where processing is based on consent;
8. Exercise applicable rights relating to solely automated decision-making; and
9. Lodge a complaint concerning our processing of your personal data.

These rights are not absolute and may be limited where we are legally required or permitted to retain or process information, including for regulatory compliance, fraud prevention, legal claims or the protection of another person’s rights.

We may need to verify your identity before processing certain privacy requests.

Some of our technology, infrastructure, payment, identity-verification, communication or other service providers may process personal data outside Nigeria.

Where personal data is transferred outside Nigeria, we will take appropriate steps to ensure that the transfer complies with applicable Nigerian data-protection requirements. This may include relying on an applicable adequacy decision, approved transfer mechanism, contractual safeguards or another lawful basis recognised under applicable law.

We maintain procedures for identifying, assessing, containing and responding to personal data breaches.

If a breach is likely to put your rights and freedoms at risk, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to you, we will also tell you without undue delay. Our message will explain what happened, what data is involved, what we have done about it and what you can do to protect yourself.

Our service providers must tell us promptly if a breach affects data they handle for us.

If you think your account or personal data has been compromised, contact us immediately at hi@kobovault.com.

Our Services are for people aged 18 and over. We do not knowingly open accounts for, or collect personal data from, anyone under 18.

If we learn that we have collected personal data from a person under 18, we will close the account and delete the data, unless the law requires us to keep it. If you believe a child has used our Services, please contact us at hi@kobovault.com.

We may update this Privacy Policy from time to time to reflect changes to our Services, data-processing practices, applicable laws, regulatory requirements or security practices.

Where required, we will provide appropriate notice of material changes.

The latest version will be made available through our website, application or other appropriate channels.

The “Effective Date” and “Last Updated” dates at the beginning of this Policy indicate when the current version took effect and was last revised.

This Privacy Policy is governed by the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act 2023 and the NDPC's General Application and Implementation Directive 2025 (GAID 2025). If any part of this Policy conflicts with the law, the law shall prevail.

If you are unhappy with how we handle your personal data, please contact us first at hi@kobovault.com. You also have the right to complain to the Nigeria Data Protection Commission at any time, and nothing in this Policy limits that right or your right to go to court.

If you have a question, privacy request or complaint concerning the processing of your personal data, please contact:

• Privacy Team: Kobo Vault Technology Limited
• Email: hi@kobovault.com
• Website: kobovault.com
• Address: 135 POWA Plaza, Bar Beach Police Barracks, Victoria Island, Lagos State