Privacy Policy

1. Introduction

This Privacy Policy explains how SWAVE collects, uses, stores, shares, and protects personal information when you use SWAVE Money and related services, including wallet, payments, international remittance, SME soft loans, savings plans, and index-linked investment access. By registering for or using SWAVE Money, you acknowledge that you have read and understood this Privacy Policy, and you agree to the handling of your personal data as described here, in accordance with applicable data protection laws, including the Nigeria Data Protection Act (NDPA).

2. Data Controller and Contact

The primary data controller responsible for your personal data in relation to SWAVE Money is Exemplar Projects Consort LTD. If you have questions about this Privacy Policy or how your data is processed, you can contact us at support@swaveafrica.com or contactline@exemplarproject.org.

3. Scope

This Privacy Policy applies to users of SWAVE Money and SWAVE Market, whether individuals, businesses, vendors, or agents, and to visitors to SWAVE websites, mobile applications, and digital platforms. It also applies to interactions with SWAVE via customer support channels and official communications.

4. Information We Collect

• Identification and Contact Information: name, address, phone number, email address, date of birth, and similar details used to identify and contact you.
• Regulatory and KYC Information: BVN, NIN, ID document details, selfies or biometric data, proof of address, and occupation or business details used to verify your identity and meet KYC/AML obligations.
• Financial and Transaction Information: wallet balance, transaction history, funding sources, merchant payments, bill payments, remittances, savings contributions, loan disbursements and repayments, and investment orders.
• Device and Usage Information: device type, operating system, browser type, IP address, login times, app interaction patterns, and error logs used to secure and improve our services.
• Communication and Support Information: content of your messages, call notes or recordings (where legally permissible), and metadata such as date and time of contact.
• Vendor and Agent Information: business registration documents, tax IDs, bank account details, and other information needed to onboard and manage business relationships.
• Creditworthiness and Underwriting Data: for loan products, we may collect information about income, expenses, bank statements, credit bureau reports, and repayment performance.
• Beneficiary and Counterparty Data: for remittance and transfers, we collect beneficiary names, payout details, country, relationship with you, and purpose of transfer.
• Savings and Investment Profile Data: for savings and investments, we may collect your savings goals, risk tolerance, investment preferences, and product selections.

5. How We Collect Information

We collect information directly from you when you provide it during registration, KYC, loan or savings applications, and customer support interactions. We also collect data automatically through your use of our apps and websites, such as devices and usage information. Additionally, we may receive information from third parties, including KYC providers, payment processors, credit bureaus, banks, and licensed investment partners, when you link accounts or when they are involved in processing your transactions.

6. How We Use Your Information

We use your personal data for the following purposes:

• Service Provision: to create and manage your account, process payments and remittances, maintain your wallet, and provide savings, loan, and investment features.
• KYC and Compliance: to verify your identity, assess risk, monitor transactions, and comply with KYC/AML laws and other regulatory requirements.
• Credit Assessment and Loan Servicing: to evaluate eligibility for loans, determine credit limits, model risk of default, manage disbursements, and handle collections.
• Fraud Prevention and Security: to detect and prevent fraud, account takeover, and other misuse by analysing transaction patterns, device data, and login behaviour.
• Savings and Investment Product Delivery: to administer savings plans, calculate returns, execute investment orders, and reconcile transactions with partner institutions.
• Customer Support: to respond to enquiries, support requests, and complaints, and to provide operational and security alerts.
• Service Improvement and Analytics: to understand how our services are used, identify areas for improvement, and develop new features or products.
• Marketing and Communication: where permitted, to inform you about products, features, or promotions that may be relevant to you, with the ability to opt out.

7. Legal Basis for Processing

Our processing of your personal data is based on one or more of the following legal bases:

• Performance of a Contract: providing wallet, payment, remittance, savings, loan, and investment services under our agreement with you.
• Legal Obligation: complying with laws and regulations, including KYC/AML requirements, tax rules, and reporting obligations.
• Legitimate Interests: protecting our platform and users from fraud, improving security and service quality, and supporting responsible innovation, provided your rights are not overridden.
• Consent: for specific activities such as certain marketing communications or optional services, where we ask for and you provide explicit consent.

8. Cookies and Similar Technologies

When you use SWAVE websites or web-based interfaces, we may use cookies and similar technologies to remember your preferences, improve performance, and collect usage statistics. You may control cookies through your browser settings but disabling them may affect some features. Mobile apps may use equivalent analytics or telemetry tools to understand usage and improve reliability.

9. Sharing Your Information

We may share your personal information with selected third parties in the following circumstances:

• Service Providers and Vendors: with licensed providers such as Zeeh Africa for BVN/NIN validation, cloud hosting providers, payment processors, cybersecurity firms, and other technical partners. These parties act under contract and may only use data for agreed purposes.
• Financial Institutions and Payment Partners: with banks, card schemes, remittance partners, and other institutions involved in processing your transactions and settlements.
• Credit Bureaus and Collections Partners: for loan products, we may share information about applications, approvals, and repayment performance with licensed credit bureaus and, where necessary, with regulated collections partners.
• Capital Market and Investment Partners: with licensed fund managers, brokers, or investment platforms that provide index-linked products you subscribe to, so they can maintain records and comply with their regulatory obligations.
• Regulators and Authorities: with regulatory bodies, law enforcement agencies, or courts where required by law, for example in response to lawful requests or where suspicious activity must be reported.
• Business Transfers: in connection with mergers, acquisitions, or corporate restructuring, subject to appropriate safeguards and continuity of protection.

10. International Data Transfers

Your data may be processed or stored in locations outside your country, including in data centres operated by reputable cloud service providers. Where we transfer data across borders, we use appropriate safeguards such as contractual clauses requiring recipients to protect your data to standards comparable to those required in your home jurisdiction.

11. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this Privacy Policy and to meet legal and regulatory retention requirements. For example, KYC and transaction data may need to be retained for several years after account closure to comply with anti-money laundering regulations and potential audit or investigation requirements. When data is no longer required and there is no legal duty to retain applications, we will delete it or anonymise it so that it can no longer be linked to you.

12. Security Measures

We implement technical and organisational measures to protect your data, including encryption in transit, strong access controls, secure development practices, logging and monitoring, and regular security testing.

Access to personal data is restricted to staff and authorised service providers who need it to perform their duties, and such access is governed by clear policies and logged where appropriate. While no system can guarantee absolute security, we continuously improve our controls and respond promptly to emerging threats.

13. Children's Data

SWAVE Money is not intended for children below the minimum age required to enter into binding financial agreements in the relevant jurisdiction. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected such data, we will take steps to delete it, subject to any legal constraints.

14. Your Rights

Depending on applicable law, you may have the right to request access to your personal data, request correction of inaccurate or incomplete data, request deletion in certain circumstances, object to certain processing, or request restriction of processing. You may also have the right to withdraw consent where processing is based on consent.

To exercise these rights, you can contact us using the details provided above. We may need to verify your identity before processing some requests and will respond within timelines required by law.

15. Automated Decision-Making and Profiling

We may use automated systems and scoring models to help detect fraud or assess creditworthiness for loans, by analysing transaction patterns and other relevant data. These tools assist our teams but are not the sole basis for decisions that have significant legal or financial effects without human review. If you are impacted by a decision you believe is unfair, you may contact us to request further explanation or review.

16. Marketing Communications

We may send you information about SWAVE products or services that we believe may be of interest to you, such as new features or promotions. Where required by law, we will obtain your consent before sending marketing communications. You can opt out at any time by following unsubscribe instructions or updating your preferences in the app.

Opting out of marketing does not prevent us from sending essential service or security-related messages about your account.

17. Third-Party Links

SWAVE platforms may contain links to websites, apps, or services operated by third parties. We are not responsible for the privacy practices of these third parties, and this Privacy Policy does not apply to them. We recommend that you review the privacy statements of any third-party services you visit.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When changes are significant, we will notify you through appropriate channels such as apps, websites, or email. The Effective Date will be updated to indicate when the changes take effect.

By continuing to use SWAVE Money after changes are implemented, you accept the revised Privacy Policy. If you do not agree with the updated terms, you should stop using the service and request closure of your account.

19. Contact and Complaints

If you have questions, concerns, or complaints about how we handle your data, you can contact us at support@swaveafrica.com or contactline@exemplarproject.org.

We will acknowledge your complaint, investigate within a reasonable time, and provide a response in line with our Complaint Policy. You may also have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.