PRIVACY NOTICE
This Privacy Notice explains how Spectrum Microfinance Bank Limited collects, uses, stores, and protects your personal data in compliance with the Nigeria Data Protection Act, 2023 (NDPA) and all applicable regulations. Please read it carefully. By opening an account, applying for a loan, using our mobile application (Spectrum Pay), or accessing any of our services, you acknowledge that you have read and understood this Notice.
1. Who We Are
Spectrum Microfinance Bank Limited (“Spectrum MFB”, “we”, “us”, or “our”) is a retail microfinance bank licensed by the Central Bank of Nigeria (CBN), incorporated under the Companies and Allied Matters Act and regulated under the Banks and Other Financial Institutions Act (BOFIA). We are the Data Controller in respect of your personal data.
2. Our Data Protection Officer (DPO)
In compliance with Section 32 of the NDPA 2023, we have designated a Data Protection Officer who is responsible for overseeing our data protection practices and ensuring compliance with applicable law. You may contact our DPO regarding any matters relating to the processing of your personal data or the exercise of your rights:
DPO Name: Data Protection Officer, Spectrum Microfinance Bank Limited
Email: dpo@spectrummfb.com
3. Personal Data We Collect
We collect personal data that is necessary and proportionate to provide our financial services. The categories of personal data we process include:
3.1 Identity & Contact Information
- Full legal name, date of birth, gender, and nationality
- Government-issued identification (BVN, NIN, passport, driver's license,)
- Residential address, email address, and telephone number(s)
- Passport photograph and signature
3.2 Financial Information
- Bank account details, account number, and transaction history
- Loan applications, repayment records, and credit history
- Income details, employment information, and business details (for loan purposes)
- Investment portfolio and savings records
3.3 Device & Technical Data (Mobile App — Spectrum Pay)
- Device type, operating system, and unique device identifiers
- Camera access — used solely for document capture and identity verification during onboarding or loan application
- Phone storage and gallery access — used solely to upload documents and photographs required for account opening or loan processing
- Log data including date and time of access and app usage statistics (used for error diagnosis and service improvement)
- IP address and location data (where you grant permission, used for fraud prevention)
3.4 KYC & Compliance Data
- Results of Know Your Customer (KYC) and Anti-Money Laundering (AML) verification checks
- Politically Exposed Person (PEP) screening results
- Risk classification and customer due diligence records
4. How We Collect Your Personal Data
We collect your personal data through the following means:
- Directly from you when you complete account opening forms, loan application forms, or investment registration forms (in-branch or online)
- Through the Spectrum Pay mobile application when you register, log in, or carry out transactions
- From third parties such as credit bureaus (e.g., CRC Credit Bureau, FirstCentral Credit Bureau), the CBN, NIBSS, identity verification agencies, and our regulatory partners
- Through your ongoing use of our products and services, including transaction records and customer service interactions
- From publicly available sources, including regulatory registers and court records, where permitted by law
5. Why We Process Your Data & Our Legal Basis
We only process your personal data where we have a valid lawful basis to do so under Section 25 of the NDPA 2023. For each processing activity, we identify and rely on the lawful basis that is most appropriate, having regard to the nature of the activity and our obligations as a regulated financial institution. Depending on the circumstances, we rely on one or more of the lawful bases recognised under the NDPA, as summarised below.
| Lawful Basis | How and When We Rely On It |
|---|---|
| Performance of a contract | To open and operate your account, assess and administer loans, carry out transactions, manage your savings and investments, and provide the products and services you ask us for. |
| Compliance with a legal or regulatory obligation | To meet our obligations under the NDPA, BOFIA, CBN regulations, KYC, anti-money-laundering and counter-terrorism-financing laws, tax laws, and the lawful directives of regulators such as the CBN, NFIU, NIMC, and FCCPC. |
| Our legitimate interests | To prevent and detect fraud, protect the security of our systems and the Spectrum Pay app, recover debts, improve our products and services, and manage our business — where these interests are not overridden by your rights and freedoms. |
| Your consent | For activities such as optional marketing communications and certain optional features. You may withdraw your consent at any time, without affecting the lawfulness of processing already carried out. |
| Protection of vital interests | In exceptional cases, where processing is necessary to protect your life or physical safety, or that of another person. |
| Public interest | Where processing is necessary for the performance of a task carried out in the public interest, such as cooperating with a lawful investigation. |
Where more than one lawful basis could apply to a particular activity, we rely on the basis that is most appropriate in the circumstances. If you would like to know which lawful basis applies to a specific use of your personal data, please contact our Data Protection Officer using the details in Section 2.
6. How We Share Your Personal Data
We do not sell your personal data. We may share your personal data only in the following circumstances and with the following categories of recipients:
7. How Long We Keep Your Data
We keep your personal data in line with our internal Data Retention Policy, which forms part of our wider data protection framework. We retain your data only for as long as we are required to by policies and regulations to fulfil the purposes for which it was collected, to provide our services to you, and to meet our legal, regulatory, and contractual obligations. Retention periods are not set arbitrarily; they are determined by the following criteria:
- The duration of our relationship with you, including any period during which you continue to hold an account or use our products and services;
- The minimum record-keeping periods prescribed by applicable laws and regulations, including BOFIA, CBN guidelines, and anti-money-laundering and counter-terrorism-financing requirements;
- Any legal, regulatory, or contractual obligation that requires us to retain the data for a defined period;
- The need to retain records in order to establish, exercise, or defend legal claims, and to handle complaints, disputes, and regulatory enquiries; and
- Guidance and directives issued by our regulators and by the Nigeria Data Protection Commission (NDPC).
In practice, this means that records relating to your account, identity verification, loans, and transactions are retained for at least the minimum periods required of regulated financial institutions, while data such as marketing preferences is kept only until you withdraw your consent or become inactive. Our Data Retention Policy sets out the specific retention periods applied to each category of data and is reviewed periodically to keep it aligned with current law and regulatory guidance.
After the applicable retention period expires, your data will be securely deleted, destroyed, or anonymised in accordance with our data disposal policy.
8. Your Data Protection Rights
Under the NDPA 2023, you have the following rights in relation to your personal data. You may exercise any of these rights by contacting us or our DPO using the details in Section 2 or Section 11:
| Your Right | What This Means |
|---|---|
| Right of Access | You have the right to request a copy of the personal data we hold about you and information about how we process it. |
| Right to Rectification | You have the right to request that we correct any inaccurate or incomplete personal data we hold about you. |
| Right to Erasure | You may request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations. |
| Right to Restriction | You may request that we restrict the processing of your personal data in certain circumstances (for example, while a correction is being verified). |
| Right to Object | You have the right to object to processing based on our legitimate interests or for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds. |
| Right to Data Portability | Where processing is based on your consent or on a contract, you may request that we provide your data in a structured, commonly used, machine-readable format. |
| Right to Withdraw Consent | Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. |
| Right to Lodge a Complaint | You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at www.ndpc.gov.ng if you believe your rights have been infringed. |
We will respond to your request within 30 days of receipt. In complex or high-volume cases, we may extend this period by a further 30 days, in which case we will notify you. We will not charge a fee for exercising your rights unless the request is manifestly unfounded or excessive.
9. How We Protect Your Data
We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. These measures include:
- Encryption of data in transit and at rest using industry-standard protocols
- Role-based access controls limiting access to personal data to authorized personnel on a need-to-know basis
- Regular security assessments, vulnerability testing, and monitoring of our systems
- Staff training on data protection and information security obligations
- Physical security controls at our premises
- Contractual safeguards with all third-party service providers requiring them to maintain equivalent security standards
While we take every reasonable step to protect your data, no system or transmission over the internet is completely secure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours and, where required, notify you without undue delay.
10. Cookies and Third-Party Technologies
The Spectrum Pay mobile application does not use browser cookies. However, the application may incorporate third-party software development kits (SDKs) and libraries (for example, analytics and crash-reporting tools) that may collect usage data and technical identifiers to improve service performance.
Where the app requests access to your device permissions (camera, storage, gallery, location), this access is used solely for the specific purposes described in Section 3.3. You may manage or revoke these permissions at any time through your device settings. Please note that revoking certain permissions may limit the functionality of the application.
Our website (www.spectrummfb.com) may use cookies for session management and analytics purposes. You may configure your browser to refuse or alert you to cookies. A full Cookie Policy is available on our website.
11. How to Contact Us
If you have any questions, concerns, or requests in relation to this Privacy Notice or the processing of your personal data, please contact us through any of the following channels:
12. Updates to This Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our services, legal obligations, or data processing practices. When we make material changes, we will notify you by:
- Posting the updated Notice on our website at www.spectrummfb.com
- Displaying a prominent in-app notification on the Spectrum Pay mobile application
- Sending an email or SMS notification to registered customers where the change materially affects your rights
We encourage you to review this Notice periodically. Continued use of our services after any update constitutes your acknowledgment of the revised Notice. The effective date at the top of this document indicates when the Notice was last updated.
