Download Brochure
Login
Calendar

NIBSS

  1. Introduction

Nigeria Inter-Bank Settlement System Plc (“we,” “our,” or “us”) is committed to safeguarding the privacy and protection of personal data in accordance with the Nigeria Data Protection Act (NDPA) 2023, the General Application and Implementation Directive (GAID), and other applicable data protection laws.

This Privacy Policy explains how we collect, use, store, share, and protect personal data obtained through our onsite operations (e.g., CCTV, visitor logs, access control) and online services (e.g., websites, mobile applications, digital platforms).

 

  1. Scope of Policy

This policy applies to:

  1. All employees, contractors, vendors, clients, and visitors interacting with us physically or digitally.
  2. All personal data collected via:
  • CCTV surveillance systems, visitor registration systems, access control devices (onsite).
  • Websites, mobile applications, payment platforms, customer support channels, marketing tools (online).
  • All processing activities conducted by us or on our behalf by authorized third parties.
  • We may also collect information from or about you from other sources, such as your results when you respond to a survey, and from other accounts we have reason to believe you control (whether in part or in whole).
  • Additionally, for quality and training purposes or for our own protection, we may record telephone conversations with you or anyone acting on your behalf. By communicating with us, you acknowledge that your communication may be overheard, monitored, or recorded without further notice or warning.

 

  1. Data We Collect

We may collect and process the following categories of personal data:

  1. Identification Data: Name, gender, date of birth, national identity details, passport, company name, employment details etc.
  2. Contact Data: Email, phone number, physical address, emergency contacts etc.
  3. Access/Onsite Data: CCTV footage, visitor register details, biometric or card access logs etc.
  4. Transaction Data: Payment records, service usage details, billing information etc.
  5. Technical/Online Data: IP addresses, device identifiers, browser information, geolocation, cookies, login data, computer and connection information, mobile network information, statistics on page views, traffic to and from the sites, referral URL, ad data, and standard web log data and other information. We also collect anonymous information through our use of cookies and web beacons.

 

  1. Legal Basis for Processing

We process personal data on the following lawful basis under NDPA:

  1. Consent: Where data subjects voluntarily provide personal information
  2. Contractual Necessity: To perform contractual obligations
  3. Legal Obligation: To comply with statutory or regulatory requirements.
  4. Legitimate Interest/Public Interest: To ensure safety, security, operational efficiency, fraud prevention.

 

  1. Purpose of Processing

We collect and process personal data for the following purposes:

  1. Security and access control for our premises.
  2. Service delivery and customer relationship management.
  3. Transaction processing and fraud prevention.
  4. Communication and customer support.
  5. Marketing, product development, and customer engagement (with opt-out options).
  6. Compliance with regulatory, tax, and legal obligations.
  7. Internal audits, risk management, and business continuity.

 

  1. Data Retention

We will retain your personal information in accordance with our retention policy. We will also endeavour to keep your information accurate and up to date, and not keep it for longer than is necessary:

Our retention policy is as follows:

  1. CCTV Footage: Retained for 30–90 days, unless required for investigations.
  2. Visitor Records: Retained for 6–12 months.
  3. Customer/Transaction Data: Retained in line with statutory requirements
  4. Online Data: Retained only for as long as necessary to fulfill service or consented purposes.

In all cases we will retain your information at least for the minimum period prescribed by law or regulation where applicable.

After the retention period, data is securely deleted, anonymized, or archived in compliance with NDPA.

 

  1. Data Sharing and Third Parties

We may share personal data with:

  1. Internal staff with strict access controls.
  2. Regulators and law enforcement agencies when legally required.
  3. Third-party service providers (e.g., IT vendors, cloud storage, payment processors), bound by data processing agreements.
  4. Financial institutions that we partner with to jointly create and offer a product and to maintain the integrity of the payment ecosystem
  5. Credit bureaus and collection agencies to report account information, as permitted by law.
  6. Companies that we plan to merge with or are acquired by.
  7. Cross-border transfers: Where personal data is transferred outside Nigeria, we ensure compliance with NDPA adequacy, standard contractual clauses, or other GAID-compliant safeguards.

We may also obtain information about you from third parties such as Central Bank of Nigeria, financial institutions, super agents, credit bureaus and identity verification services.

 

  1. Security Measures

We implement appropriate technical and organizational measures including:

  1. Encryption, firewalls, intrusion detection, and secure access controls.
  2. Regular system audits, vulnerability testing, and monitoring.
  3. Staff training on data protection obligations.
  4. Privacy by design and default in all new systems and processes.

 

  1. Individual Rights

Under NDPA, data subjects have the underlisted right to:

  1. Access their personal data.
  2. Rectify inaccurate or incomplete data.
  3. Erase personal data (“right to be forgotten”), subject to lawful exceptions.
  4. Restrict processing in certain circumstances.
  5. Data portability to another service provider.
  6. Withdraw consent at any time (where consent is the legal basis).
  7. Object to certain processing activities
  8. Lodge complaints with the Nigeria Data Protection Commission.

We recognise these rights of data subjects. Request to exercise these rights can be submitted to our Data Protection Officer (DPO) at dpo@nibss-plc.com.ng

 

  1. Children’s Data

We do not knowingly process personal data of children under 18 without parental or guardian consent, in accordance with NDPA provisions.

 

  1. Data Breach Notification

In the event of a personal data breach, we will:

  1. Notify the Nigeria Data Protection Commission within 72 hours, as required by law.
  2. Inform affected individuals where there is a high risk to their rights and freedoms.
  3. Implement remedial actions to prevent recurrence.

 

  1. Updates to Policy

This Privacy Policy may be updated periodically to reflect changes in law, technology, or business practices. The updated version will be communicated via our website, digital platforms, or made available onsite.

 

Contact Information

For questions, requests, or complaints regarding this Privacy Policy, please contact:

Data Protection Officer (DPO)

dpo@nibss-plc.com.ng