Right to Erasure and Account Deletion Policy

This policy explains how Finzla Technologies Nigeria Limited ("Finzla", "we", "us" or "our") handles requests to erase personal data. This right is sometimes called the right to erasure or the right to be forgotten. Under section 34 of the Nigeria Data Protection Act 2023 (NDP Act), you may request erasure of personal data concerning you. Where the legal conditions are met, Finzla must erase the relevant personal data without undue delay. The NDP Act General Application and Implementation Directive 2025 (GAID 2025), including Article 38, gives further guidance on when the right applies and when an exception may allow continued retention. This policy should be read together with Finzla's Privacy Policy and any privacy notice shown when you use a particular Finzla feature or third-party service.

You can ask Finzla to erase personal data relating to you. The right may apply where:

You do not need to use legal language. A clear request such as "delete my account and personal data" is enough for us to recognise that you may be exercising your right to erasure.

You may make a request through any Delete Account or Delete My Data function available in the Finzla app or web platform, through Finzla customer support, or through the privacy contact details published on our website or in the app. If someone acts for you, we may ask for reasonable evidence that they are authorised to do so.

We will process your request securely and without undue delay. Depending on the circumstances, we may record your request and assign a reference number, take reasonable steps to verify that the request relates to you, identify the Finzla systems and service providers that hold relevant personal data, assess whether any lawful reason requires us to keep particular information, stop or restrict unnecessary processing while the request is being handled, delete or irreversibly anonymise the information where the right applies, instruct relevant service providers to erase their copies where required, and confirm the outcome to you.

We may verify your identity before deleting data so that another person cannot maliciously delete your account. Where you are already securely signed in, we will normally use existing authentication controls where appropriate. If additional information is needed, we will request only what is reasonably necessary.

Finzla aims to store only information that is necessary for the relevant service. Where a third-party verification or technology provider can return only a verification/result reference, Finzla may retain that result rather than an unnecessary copy of the underlying raw data. The information involved depends on the Finzla services you have used. Subject to any lawful retention requirement, an approved request may cover:

Where your right to erasure applies, our default approach is deletion. This may include removing user-specific records from active databases, deleting stored files, revoking bank or service connections and tokens, purging user-linked cache/index entries, and instructing relevant processors to erase their copies. In some cases we may retain information only after it has been irreversibly anonymised so that it can no longer reasonably identify you, for example for aggregated statistics.

Masking or pseudonymisation may be used as a privacy and security control, but we do not treat it as erasure where the information can still be linked back to you.

We do not retain BVN, identity documents, proof of address or facial verification information simply because they were collected for verification. If any such information must be retained after an erasure request, there must be a documented lawful reason.

Where your information has contributed to a shared model that does not identify you individually, we stop using your information in future training and assess any residual risk, rather than deleting or retraining that model for every individual request.

The right to erasure is not absolute. Applicable law may allow or require us to retain limited information, including where processing is necessary to comply with a legal ruling or obligation, for an applicable public-interest purpose, for certain protected research or statistical purposes, or to establish, exercise or defend legal claims. Where we cannot erase particular information, we mask or redact the identifying details we don't need to keep, restrict what remains from ordinary use, and don't use it for unrelated purposes such as marketing or personalisation.

Finzla may use service providers for services such as identity verification, bank connectivity, cloud hosting and object storage, analytics, communications, logging and monitoring, security, customer support and other technology services. Where your personal data has been shared with a third party and your right to erasure applies, we will take the steps required under applicable law and our contractual arrangements to have that data erased or otherwise appropriately handled.

If you take up a product or service directly with a partner we referred you to, that partner will usually become independently responsible for the personal data relating to that product or service. In that case we will let you know, where relevant, that you may need to contact the partner directly to exercise your right to erasure with them.

We remove personal data from active databases, file/object storage, caches, indexes and other active systems where the right applies. Where user-linked information appears in application logs, security records or monitoring/observability tools, we will delete, redact, anonymise or restrict it as appropriate, taking account of applicable security, legal and retention requirements.

Some information may temporarily remain in secure backup, snapshot or disaster-recovery systems after it has been removed from active systems. Where immediate granular deletion from an immutable backup is not technically practicable, the backup will remain protected and unavailable for ordinary use until it is overwritten or expires under the relevant retention cycle. If a backup is restored, we will take measures to ensure previously erased data is not returned to normal active processing.

The NDP Act requires erasure without undue delay where the legal conditions are met. Finzla therefore aims to complete ordinary erasure requests as promptly as reasonably practicable and, as an internal service target, ordinarily within 30 calendar days after receiving a sufficiently verified request. The 30-day period is Finzla's operational target; it does not replace the statutory requirement to act without undue delay. If a request requires additional assessment because of its scope or a genuine legal-retention issue, we will keep you appropriately informed.

Deleting your Finzla account and personal data may permanently remove access to your profile, transaction information stored by Finzla, budgeting information, education progress, personalised insights and other account features. Once deletion is completed, some information may not be recoverable if you later create a new account.

If you access Finzla through an employer-sponsored programme, your employer ending your programme membership is a separate event from deleting your Finzla account, and does not by itself delete your personal data. Likewise, asking Finzla to delete your account and personal data is your own right and does not depend on your employer's programme decisions.

After completing your request, we will tell you the outcome. If we are legally permitted or required to retain limited information, we may explain the relevant category and reason, subject to applicable legal restrictions. If we refuse your request, or can only fulfil it in part, we will provide an explanation where required and appropriate. You may ask Finzla to review the decision through our privacy or customer-support channel.

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC). You do not have to use Finzla's internal grievance process before contacting the NDPC. The NDPC website is ndpc.gov.ng.

We may update this policy to reflect changes in law, regulatory guidance, Finzla services, service providers, data repositories or our data-handling practices. Where a change materially affects your rights or how we handle erasure requests, we will take reasonable steps to provide appropriate notice.

To exercise your right to erasure or ask a question about this policy, use the privacy or support contact details published in the Finzla app or on the Finzla website, or use any Delete Account / Delete My Data function available in your account settings.