Privacy Policy
How Finzla collects, uses, stores and protects your personal information.
Regulatory basis: Nigeria Data Protection Act 2023; NDP Act – GAID 2025; CBN payment data localisation requirements (Circular PSS/DIR/PUB/CIR/001/004, June 2026)
Finzla Technologies Nigeria Limited is committed to protecting your privacy and handling personal information responsibly, including sensitive information, like identity documents and bank transactions, that comes with being a financial-wellbeing platform. This policy explains what we collect, why, and how you stay in control throughout.
1. About this policy
This Privacy Policy explains how Finzla Technologies Nigeria Limited (“Finzla”, “we”, “us”) collects, uses, stores, and protects your personal information when you use our website, platform, or services. It should be read alongside our Cookie Policy and our Right to Erasure and Account Deletion Policy, which covers how to exercise your deletion rights in detail.
2. Information we may collect
What we collect depends on how you use Finzla; someone who only reads our educational content will have a much smaller footprint than someone who connects a bank account. In broad terms:
- Account & contact data: Full name, email address, phone number, username, registration date, and account status.
- Authentication & security data: Password hash, MFA/OTP records, session identifiers, login history, and security and fraud-monitoring events.
- KYC & identity data: BVN, proof of identity, ID type and number, proof of address, facial verification image or result, and KYC status.
- Bank connection & transaction data: Connected bank, consent status, access tokens, account identifiers, balances, transactions, and merchant/category details, where you choose to connect a bank account or upload a statement.
- Budgeting & financial-wellbeing data: Budget inputs and results, spending categories, recurring expenses, financial-wellbeing indicators, and personalised nudges.
- Education & engagement data: Articles or lessons viewed, course progress, quiz results, and related activity.
- Partner/referral data: Providers viewed, enquiries or referrals you've initiated, and your consent to share information with a partner.
- Employer/B2B programme data: Employer-sponsored programme membership and eligibility, where applicable. Your individual financial information is never shared with your employer.
- Device, technical & analytics data: IP address, device/browser/app information, session identifiers, push-notification token, and usage analytics.
- AI/ML and derived data: Where Finzla's AI-assisted features are used, the interaction context supplied and analytical features derived from your activity, such as spending patterns.
- Consent & rights records: Records of privacy, marketing, bank-connect and partner-sharing consent, and any data-subject-rights requests you've made.
3. Our lawful basis for processing
Under the Nigeria Data Protection Act 2023, we rely on one or more of the following lawful bases, depending on the activity:
- Consent – for example, connecting a bank account, sharing your details with a partner, or receiving marketing communications. You can withdraw consent at any time.
- Performance of a contract – to provide the core Finzla service you've signed up for, such as your account and budgeting tools.
- Legal obligation – for example, KYC and anti-money-laundering requirements that apply to identity verification.
- Legitimate interests – for example, keeping the platform secure and improving our service, balanced against your rights and freedoms.
4. How we use your information
We may use your information to:
- Provide and improve our services, including budgeting tools, transaction insights, and educational content.
- Verify your identity as required by KYC and anti-money-laundering obligations.
- Respond to enquiries and support account management.
- Generate personalised financial-wellbeing insights and nudges.
- Prepare aggregate, anonymised usage reports for employer-sponsored programmes, which never include an individual's financial details.
- Send important service updates, and, with your consent, marketing communications.
- Maintain platform security and prevent fraud.
- Meet legal and regulatory obligations.
5. How AI and machine learning use your information
Some insights and nudges are generated by models trained on data across many Finzla users, not just you. If you ask us to delete your data, we stop using it in future training straight away; a shared model already in place isn't rebuilt for every individual request, but it's never trained on you again. Any data used to improve our models outside Nigeria is anonymised first; see the data residency section below for detail. We don't use your information to train third-party AI systems outside our control.
6. How we protect your information
We apply technical and organisational measures appropriate to the sensitivity of the information involved, including access controls, encryption in transit and, where appropriate, at rest, monitoring, and internal data-handling procedures, to protect personal information against unauthorised access, loss, misuse, or disclosure. See our Data Protection page for more on the principles behind this.
8. Data residency and international transfers
Information that identifies you in connection with identity verification, bank connections and transactions, including your BVN and transaction records, is hosted using cloud infrastructure located in Nigeria, including applicable backup and disaster-recovery copies, and is not transferred outside Nigeria as part of our core hosting and processing of that information. This reflects Finzla's data-protection approach and applicable Nigerian data-localisation requirements.
Other limited personal information may be processed or hosted outside Nigeria where this is necessary to provide particular services. For example, we may use cloud-based communication services hosted in South Africa to send account and service-related emails. Only the minimum information necessary for those communications is transferred, and sensitive identity-verification, bank-account and detailed transaction information is not included in such communications unless separately assessed and lawfully permitted. These transfers are subject to an applicable cross-border transfer mechanism under the Nigeria Data Protection Act and GAID 2025, together with appropriate contractual, technical and organisational safeguards.
Where information is used to improve our AI/ML models, only non-identifiable, anonymised data, with direct identifiers removed, may be processed outside Nigeria for that specific purpose, and only where this is technically achievable; where it is not, that data remains in Nigeria.
Some independent third-party service providers, such as identity-verification specialists, may process limited information outside Nigeria as part of providing their services. Where this occurs, we assess the transfer and apply the appropriate cross-border transfer mechanism and contractual, technical and organisational safeguards required under applicable data-protection law.
9. How long we keep your information
We keep personal information only as long as necessary for the purpose it was collected, governed by our internal Data Retention Schedule. Some information, particularly KYC and transaction records, is subject to longer, legally mandated retention periods under AML/KYC rules; where that applies, we restrict it from ordinary use rather than deleting it outright, and remove it once the legal period has passed.
10. Your rights
Depending on the circumstances, you have the right to:
- Access the personal information we hold about you.
- Correct inaccurate or incomplete information.
- Request erasure of your information; see our Right to Erasure and Account Deletion Policy for the full process.
- Restrict or object to certain processing, including direct marketing.
- Withdraw consent at any time, without affecting processing already carried out.
- Receive a copy of your information in a portable format, where technically feasible.
11. Children
Finzla is intended for adults aged 18 and over. We don't knowingly collect personal information from anyone under 18, and if we become aware that we have, we'll take steps to delete it.
12. Changes to this policy
We may update this policy to reflect changes in our services or in applicable law. Where a change is material, we'll take reasonable steps to let you know, and where required, ask you to re-confirm your agreement before it takes effect.
13. Contact
For privacy-related enquiries, contact privacy@finzla.com.
Need help? Contact Finzla through the support details on our website.