CFTL Digital Services Limited

1. Introduction

Hi! We've created this Privacy Policy (the "Policy") to describe your privacy rights regarding how CFTL Digital Services Limited ("CFTL Digital" or "we" or "us") collects, uses, processes, shares, discloses and protects your information; including any nonpublic, personal information that identifies or can be used to identify you, such as your name, email address, mobile number, nationality, gender and demographic information, and financial information such as bank verification number (BVN) and bank details, as well as your National Identity Number (NIN)("Personal Data").

This Policy applies to the Personal Data collected by CFTL Digital when you use our website, mobile application, social media platforms, tools and any other platform belonging to CFTL Digital (collectively, the "Services") or otherwise interact with us as described below.

We may update this Policy from time to time and at our sole discretion. Where updates are made to the Policy, we will notify you of same by revising the date at the top of this Policy, and in some cases, we may provide you with additional notice (by adding a statement to the homepages of our website or mobile application; or by sending you an email notification). Such updated policy becomes effective as at the time it is posted. We encourage you to review the Policy whenever you interact with us to stay informed about our information privacy practices as well as ways in which you can protect your privacy. You are advised to consult this Policy regularly for any changes, as we deem your continued use, following notification and posting of any amendment, modification or change, as your agreement to such revisions.

2. Consent

You accept and consent to this Policy when you access our platforms, or use our Services, technologies, features, content or functions offered on our website, mobile applications, digital platforms, social media, amongst other platforms which may be contemplated to be used by CFTL Digital.

3. Collection of Personal Data

You may be asked to provide your Personal Data anytime you contact us or interact/access any of CFTL Digital's platforms, and we shall use your Personal Data in accordance with this Policy, relevant laws and regulations.

3.1 Categories of Personal Data

We collect Personal Data you provide to us when you apply for a CFTL Digital account or when you communicate with us about your CFTL Digital account. The types of Personal Data we may collect include, but not limited to personal information such as your name, address, phone number, email address, date of birth, bank account information, BVN, username, password, and next of kin details.

3.2 Personal Data About Your Transactions With Us

As you use your CFTL Digital account to buy and sell publicly traded securities on the stock exchange market across jurisdictions, we collect Personal Data in connection with each transaction, including transaction time, Naira or USD amount and merchant details. We may collect photos, memos or other information that you attach to your transactions as well as other information contained in communications with customer support or third-party service providers, including records and copies of correspondence.

3.3 Personal Data From Other Sources

When you create a CFTL Digital account, we may collect information about you, including Personal Data, prior addresses and names from non-affiliated third-party service providers in order to verify your identity, and for fraud prevention. Also, based on the fact that we work closely with third parties (including financial service providers, security agencies, etc), we will notify you when we receive information about you from them and the purposes for which we intend to use that information.

3.4 Other Personal Data we collect

We may collect Personal Data you provide to us, such as your name, email address and any other information you choose to provide. For example, we may collect such information if you request an invite to join Cowrywise or if you enter into any contest or promotion. In a case where you choose to enable access to your contacts via our mobile application, we may upload your contact data to our servers so we can show you your friends who are also registered on the Cowrywise platform as users.

We may also collect or retain content that you submit via chatboxes, chat rooms or similar functionality, on our platforms, including audio recordings, photos, images, text, information (collectively, "User Content")

3.5 Personal Data We Collect Automatically from our Services

When you access or use our Services, we automatically collect Personal Data and other information about you as follows:

1. Log Information: We log information about your use of our Services, including the type of browser you use, access times, pages viewed, your IP address and the page you visited before navigating to our Services.
2. Device Information: We collect information about the computer or mobile device you use to access our Services, including the hardware model, operating system and version, unique device identifiers and mobile network information.
3. Location Information: We may collect your location information from your mobile device with your prior consent. Also, we have incorporated Google Maps into our Services, and you may consent to the collection of location information by Google Maps in connection with your use of this maps service. Any information collected via your use of Google Maps will be transmitted directly to Google and is not collected by us. Please refer to Google's privacy policy for details about their collection, use and sharing of this information. For information about how to disable the collection of location information from your device, please see "Your Choices" below.
4. Information Collected by Cookies and Other Tracking Technologies: We use various technologies to collect information on our Services and other websites, and this may include sending cookies to your computer or mobile device. Cookies are small data files stored on your hard drive or in device memory that help us to improve our Services and your experience, see which areas and features of our Services are popular and count visits. For more information about cookies, and how to disable them, please see "Your Choices" below. We may also collect information using web beacons (also known as "tracking pixels"). Web beacons are electronic images that may be used in our Services or emails and help deliver cookies, count visits, understand usage and campaign effectiveness and determine whether an email has been opened and acted upon.
5. How We Respond to Do Not Track Signals: We allow Do Not Track browser configurations. We use cookies and other tracking technologies, and Do Not Track status may alter the available services with certain browsers, when these tracking functionalities are used to provide services. We do not alter the information our applications attempt to collect based on your Do Not Track configuration.

The app does use third party services that may collect information used to identify you. Links to privacy policy of third party service providers used by the app:

• Google Play Services
• AdMob
• Firebase Analytics
• Fabric
• Crashlytics
• Adjust
• Facebook

4. Use Of Personal Data

We may use your information, including Personal Data as follows:

• Provide, maintain and improve our Services
• Provide and deliver the products and services you request, process transactions and send you related information, including confirmations.
• Verify your identity and prevent fraud.
• Send you technical notices, updates, security alerts and support and administrative messages.
• Respond to your comments, questions and requests and provide customer service.
• Communicate with you about products, services, offers, promotions, rewards, and events offered by Cowrywise and others, and provide news and information we think will be of interest to you.
• Monitor and analyze trends, usage and activities in connection with our Services.
• Personalize, update and improve the Services and provide advertisements, content or features that match user profiles or interests;
• verify compliance with the terms and conditions governing the use of the Service;
• assist government and law enforcement agencies or regulators/supervisors;
• comply with any court order or applicable law;
• Process and deliver contest or promotion entries and rewards.
• Link or combine with information we get from others to help understand your needs and provide you with better service; and
• Carry out any other lawful purpose for which the information was collected.

By submitting User Content for publication on the Service, you hereby grant us a worldwide, revocable, sub-licensable and royalty-free license to use such personal information for our business purposes.

CFTL Digital is based in Nigeria and the Personal Data we collect is governed by the Nigeria Data Protection Act (NDPA) 2023, NDPA General Application and Implementation Directive, 2025 (GAID) and all data protection laws and regulations applicable to processing of Personal Data in Nigeria. By accessing or using the Services or otherwise providing your Personal Data to us, you expressly and clearly consent to the processing and transfer of your Personal Data in and outside Nigeria.

5. Lawful Basis For Processing Personal Data

We will only use your Personal Data for the lawful reason for which we collected it in the first instance. We consider the lawful basis for using your Personal Data as set out in the Nigeria Data Protection Act (NDPA) 2023, NDPA General Application and Implementation Directive, 2025 (GAID) and all data protection laws and regulations applicable to processing of Personal Data. This includes:

1. Where you give your consent to the processing of your personal data for one or more purposes. Please note that your continuous use of our platform or by agreeing to our terms of use, you would be deemed to consent to the processing of your personal data to enable us provide the Services;
2. To comply with our legal and regulatory obligations.
3. To use your Personal Data as is necessary for our legitimate interests or the legitimate interests of others.
4. To protect your interest, the interest of another Data Subject or for the performance of a task carried out in the public interest or in exercise of official public mandate vested in us.

6. Disclosure Of Personal Data

We may disclose any information we collect about current and former customers, including Personal Data, to affiliates and non-affiliated third parties as follows:

1. With financial service providers, including the financial institutions identified in your cardholder bank agreement that provide banking services in connection with your CFTL Digital account.
2. With another user, when you sign up for CFTL Digital's services via a referral link. The user that referred you may receive information indicating that you have enrolled with CFTL Digital. You may avoid this sharing by not using a referral link to enroll with non-financial companies, such as email service providers that perform marketing services on our behalf, and fraud prevention service providers that use the information to provide services to CFTL Digital and other companies.
3. With a non-affiliated third-party, to access and transmit your personal and financial information from a relevant financial institution. You grant the third-party the right, power, and authority to access and transmit this information, according to the terms of their privacy policy.
4. With employees, independent contractors, subsidiaries, affiliates, consultants, business associates, service providers, suppliers and agents or authorised personnel, acting on our behalf for any of the identified purposes.

We may also disclose any information we collect about current and former customers, including Personal Data, to other non-affiliated companies, for our everyday business purposes, such as to process transactions, maintain accounts, respond to court orders and legal investigations or report to credit bureaus. For example, in connection with our everyday business purposes, we may share Personal Data about you as follows:

1. In response to a request for Personal Data, if we are required by, or believe disclosure is in accordance with, any applicable law, regulation or legal process.
2. With relevant law enforcement officials, regulators other third parties, such as investigators or auditors, where requests are made within or outside your country of residence and if we believe it is appropriate for national security, to investigate fraud or other issues of public importance.
3. With legal representatives and advisors, including attorneys and accountants, to help us comply with legal, accounting, or security requirements.
4. If we believe your actions are inconsistent with our user agreements or policies, or it is necessary to protect the rights, property and safety of CFTL Digital or others.
5. In connection with, or during negotiations of, any merger, sale of CFTL Digital's assets, financing or acquisition of all or a portion of our business to another company; and
6. With your consent or at your direction, including if we notify you that the Personal Data you provide will be shared in a particular manner and you provide such Personal Data.

We may also share aggregated or de-identified Personal Data, which cannot reasonably be used to identify you. For example, we may share transaction zip codes with third parties to improve our accuracy in geo-locating transactions and to improve the clarity of transaction descriptions.

We will usually not share your Personal Data with other third parties without your consent. Where we need to transfer your Personal Data to another country, we shall ensure that such country to which the data is being transferred or the foreign institution receiving said Personal Data, shall have adequate and sufficient data protection laws. We will seek your consent where we need to send your data to a country without an adequate data protection law.

7. Your Choices

7.1 Account Information

You may edit your Personal Data by logging into your account via our Services. If you wish to delete or deactivate your online account, please contact us through cftlcompliance@cowrywise.com , but note that we may retain certain Personal Data as required by law or for legitimate business purposes. Where you notice misrepresentations in your personal information, please promptly notify us, and provide all requested documentation to enable us to implement the necessary updates or changes.

7.2 Promotional Communications

We may contact and inform you of products or services that we think may be beneficial or of interest to you. You may opt out of receiving promotional emails and text messages from CFTL Digital by following the instructions in those messages. Please note that if you opt out, we may still send you transactional or relationship messages, such as those about your account or our ongoing business relations.

7.3 Location Information

If you initially consent to the collection of location information by CFTL Digital or Google Maps within our mobile application, you may be able to subsequently stop this collection through your device operating system settings or through your online account settings. If either of these opt-out options are not available to you, you may also disable location information by following the standard uninstall process to remove our mobile application from your device.

7.4 Cookies

Cookies serve multiple purposes, such as storing your settings to customize your experience on our site and aiding us in evaluating our website traffic. Most web browsers are set to accept cookies by default and CFTL Digital uses cookies to improve user experience when you interact with our Services. If you prefer, you can usually choose to set your browser to remove or reject browser cookies. Please note that some cookies are required to access some of our Services. If you choose to remove or reject cookies, this could affect the availability and functionality of our Services.

7.5 Social Sharing Features

Our Services include social sharing features for common social networks to let users share content. These features are served from third-party services that may serve their own cookies. The use of such features enables the sharing of information with your friends or the public, depending on the settings you establish with the entity that provides the social sharing feature. For more information about the purpose and scope of data collection and processing in connection with social sharing features, please visit the privacy policies of the entities that provide these features.

7.6 Analytics and Advertising Services Provided by Others

We may allow others to provide analytics services on our behalf and to serve advertisements on our behalf across the Internet. These entities may use cookies, web beacons and other technologies to collect information about your use of the Services and other websites, including your IP address, web browser, pages viewed, time spent on pages, links clicked and conversion information. This Personal Data may be used by CFTL Digital and others, to, among other things, analyze and track data, determine the popularity of certain content, deliver advertising targeted to your interests and to better understand your online activity.

8. Your Rights

The Nigeria Data Protection Act (NDPA) 2023, NDPA General Application and Implementation Directive, 2025 (GAID)and all data protection laws and regulations applicable to processing of Personal Data will give you certain rights in respect of the Personal Data we hold about you. Below is a highlight of some of those rights. It is not a complete, exhaustive statement of your rights in respect of your Personal Data:

1. You have a right to consent to this Policy and to withdraw your consent at any time. However, your withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
2. You have a right to a copy of the Personal Data we hold about you, as well as the information about what we do with it, who we share it with and how long we hold it for, provided you show us/forward the proof of your identity. We may make a reasonable charge for additional copies of that data in the case of unfounded and excessive requests.
3. You have a right to freely transfer your data received from us to any other person.
4. You have the right to have the Personal Data we hold about you corrected, if it is factually inaccurate, by notifying us of such amendment/update. You may contact us for this purpose.
5. In some circumstances, you have the right to the deletion of the information that we hold about you. Please note that in other circumstances, we may continue to retain such data after a request for deletion is made if there are valid legal or regulatory requirements or reasons.
6. You have a right to lodge a complaint about the handling of your personal information with the Nigerian Data Protection Commission (NDPC).
7. You have the right to ask us not to process your Personal Data for marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your Personal Data to any third party for such purposes.

NDPC's website has a wealth of useful information in respect of your rights over your personal data. If you wish to exercise your rights, you may write to us at cftlcompliance@cowrywise.com

9. Security

CFTL Digital takes reasonable measures within the law to help protect all Personal Data about you from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction. To prevent unauthorized access to your information, we have implemented strong controls and security safeguards at the technical and operational levels. Additionally, CFTL Digital implements policies designed to protect the confidentiality and security of your nonpublic Personal Data, including a privacy protection policy. CFTL Digital limits access to your Personal Data to employees that have a business reason to know such Personal Data, and implement security practices and procedures designed to protect the confidentiality and security of such Personal Data and prohibit unlawful disclosure of such Personal Data in accordance with its policies.

Where you have chosen a password that allows you to access certain parts of the website and mobile application, you are responsible for keeping this password confidential. We advise you not to share your password with anyone. Please note that you are responsible for maintaining the confidentiality of your account information and any activity that occurs under your account. It is important to:

• Choose Strong Passwords: You are advised to use strong and unique passwords for your account and change them regularly.
• Protect Your Credentials: Keep your login details confidential and avoid sharing them with anyone.
• Monitor Your Account: Regularly review your account activity for any unauthorised actions.
• Log Out: Log out of your account when using shared or public devices to prevent unauthorised access.

If you believe your account has been compromised or notice any suspicious activity, please contact us immediately at cftlcompliance@cowrywise.com to secure your account.

We have also taken measures to comply with the provision of security facilities for the protection of your Personal Data through the set-up of firewalls, limited access to specified authorised individuals, encryption and continuous capacity building for relevant personnel. We therefore have digital and physical security measures to limit and eliminate the possibilities of data privacy breach incidents.

Although we use appropriate security measures once we have received your Personal Data, the transmission of data over the internet (including by email) is never completely secure. We endeavor to protect Personal Data, but we cannot guarantee the absolute security of Personal Data transmitted to us or by us. We will notify you and any applicable regulator of a breach where we are legally required to do so.

We understand that mistakes can happen, but CFTL Digital shall not be held liable for any damages, losses, or claims arising from the reckless, negligent, or intentional misuse of the Services. This includes, but is not limited to, unauthorised disclosure of personal information, failure to follow security protocols, or engaging in any activities that violate the terms and conditions outlined in this Policy or any applicable laws. You assume full responsibility for any harm or consequences resulting from such actions.

10. Where We Store Your Personal Data

The Personal Data that we collect from you will be transferred to and stored at a destination outside Nigeria. By submitting your Personal Data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your Personal Data is treated securely and in accordance with this Policy. All Personal Data you provide to us is stored on our secure cloud storage solution.

11. How Long We Keep Your Personal Information

We will hold your Personal Data on CFTL Digital's systems in line with our Retention Schedule to fulfill the purpose for which it was collected or to comply with legal, regulatory or internal policy requirements.

12. Breach Of Personal Data

In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data which is likely to result in a risk to the rights and freedoms of individuals, we shall, within 72 (Seventy-Two) hours of having knowledge of such breach, report the details of the breach to the NDPC.

Furthermore, where we ascertain that such breach is detrimental to your rights and freedom in relation to your Personal Data, we shall within 7 (Seven) working days of having knowledge of the occurrence of such breach take steps to inform you of the breach incident, the risk to your rights and freedom and any course of action to remedy said breach.

13. Governing Law

This Policy is made pursuant to the Nigeria Data Protection Act (NDPA) 2023 and NDPA General Application and Implementation Directive, 2025 (GAID) and other relevant Nigerian laws and regulations. Where any provision of this Policy is deemed inconsistent with a law or regulation, such provision shall be subject to the overriding law or regulation.

14. Contact Us

If you have any questions, comments or concerns about this Privacy Policy, please contact us at: cftlcompliance@cowrywise.com

You can also write us as follows:

CFTL Digital Attention: Data Protection Officer

5C Reverend Ogunbiyi Street,

Ikeja, GRA

Lagos, Nigeria

cftlcompliance@cowrywise.com

15. Affiliates and Related Entities

Below is a list of some of our affiliated entities that currently may have access to personal information collected from you on our Services as set forth in this Policy. We may update this list from time-to-time, so please check back periodically to keep up to date.

Affiliates: Cowrywise Inc., Cowrywise Financial Technology Limited.