Official Legal Notice to all FinanceFlex Account Holders & Verification Agents:
Under the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR), the processing, verification, and printout of sensitive personal data (including National Identification Numbers (NIN) and Bank Verification Numbers (BVN)) are strictly regulated by law. You must read, understand, and agree to this binding policy.
1. Statutory & Regulatory Framework
This Platform operates in strict compliance with:
- Nigeria Data Protection Act (NDPA) 2023 enacted by the Federal Republic of Nigeria.
- Nigeria Data Protection Regulation (NDPR) 2019 administered by the Nigeria Data Protection Commission (NDPC).
- National Identity Management Commission (NIMC) Act No. 23 of 2007 governing the handling and printing of National Identity Slips.
- Central Bank of Nigeria (CBN) Regulatory Framework for BVN Operations and Watchlist 2021 issued by the CBN and NIBSS.
- Cybercrimes (Prohibition, Prevention, etc.) Act 2015.
2. Legal Roles: Data Controller vs. Data Processor
For all business operations and identity verifications conducted on this platform:
- Your Business / Workspace: Acts as the Data Controller and Verification Agent who directly interacts with the customer, collects customer identity digits, and verifies consent.
- FinanceFlex: Acts as the secure technological Data Processor routing encrypted queries to licensed identity and statutory verification gateways.
3. Two-Tier Verification Policy & Liability Rules
A. Rules for Unverified Businesses:
Any business workspace that has not completed official Corporate Affairs Commission (CAC) verification is deemed an Unverified Agent. To protect citizen privacy, unverified workspaces CANNOT generate or print any NIN or BVN slip without the customer receiving and confirming a live 6-digit SMS OTP verification code sent directly to their registered phone number.
B. Rules for Officially CAC-Verified Businesses (Direct Fast-Track):
Businesses that have passed verified CAC incorporation are authorized to utilize the Direct Instant Printout Fast-Track. Because customer SMS OTP is bypassed, the registered business and its proprietor undertake full civil and criminal liability under Section 25 & 30 of the NDPA 2023. You certify under penalty of law that the customer has provided explicit written or physical in-person consent before any lookup is initiated.
4. Customer Consent & Purpose Limitation (Section 25 NDPA 2023)
Personal demographic data retrieved via the Platform shall:
- Only be accessed with the explicit, informed, and unambiguous consent of the data subject.
- Be processed strictly for the verified purpose of generating an official identification slip or card for the customer.
- NEVER be mined, sold, leased, or distributed to any third-party marketing or commercial network.
5. Absolute Prohibition on Biometric & Unauthorized Data Storage
The platform strictly adheres to data minimization. Raw biometric templates (fingerprints and raw iris data) are never retained on our application servers. Transient verification records are maintained solely for statutory auditing, regulatory dispute resolution, and legal compliance as required by Nigerian law.
6. Statutory Penalties & Legal Enforcement
Under Sections 48 and 49 of the Nigeria Data Protection Act 2023, unauthorized lookup, identity theft, or fraudulent dissemination of identity records constitutes a severe criminal offence punishable by regulatory fines (up to âĻ10,000,000 or 2% of annual turnover) and imprisonment. By proceeding, you agree to indemnify FinanceFlex against any liability arising from your breach of customer privacy.
