Privacy Notice

Section 1Who We Are and How to Contact Us

Bway Microfinance Bank Limited (‘BWAY’, ‘we’, ‘us’, or ‘our’) is a Microfinance Bank licensed and regulated by the Central Bank of Nigeria (CBN), with its registered office at No 21/25 Broad Street, Marina, Lagos State, Nigeria (RC: 7269613). Bway is the data controller of the personal information you provide to us or that we collect in the course of providing our banking and financial services.

As a CBN-licensed financial institution, Bway is committed to processing your personal data responsibly, transparently, and in full compliance with the Nigeria Data Protection Act (NDPA) 2023 and its General Application and Implementation Directive (NDPA-GAID 2025).

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing our compliance with data protection law. If you have any questions about this Privacy Notice, wish to exercise your data subject rights, or want to make a complaint, please contact the DPO:

Section 2Who This Privacy Notice Applies To

This Privacy Notice applies to all individuals whose personal data Bway collects and processes in the course of our business. This includes:

• Existing and former customers of Bway, including holders of savings accounts, current accounts, loans, and other financial products.
• Prospective customers who have enquired about or applied for any Bway product or service.
• Authorised signatories, beneficial owners, directors, and officers of corporate customers.
• Guarantors and co-borrowers in respect of Bway loan facilities.
• Visitors to Bway’s website (www.bway.ng), internet banking portal, and mobile banking application.
• Representatives and contact persons of Bway’s vendors, service providers, and business partners.
• Job applicants and former employees (to the extent covered by Bway’s Employee Privacy Notice).

This Notice does not apply to the personal data of Bway’s employees, which is governed by a separate Employee Privacy Notice provided to staff at onboarding.

Section 3What Personal Data We Collect

The personal data we collect about you depends on the nature of your relationship with us and the products and services you use. We collect the minimum data necessary to provide our services and meet our legal obligations (‘data minimisation’ — NDPA 2023, s.24(c)). The categories of personal data we may collect include:

• Full legal name, title, date of birth, gender, nationality, and marital status.
• National Identification Number (NIN), Bank Verification Number (BVN), International Passport number, Driver’s Licence number, or Voter’s Card number.
• Residential address, mailing address, email address, and mobile phone number(s).
• For corporate customers: Registered business name, RC number, TIN, registered address, names and BVN/NIN of directors and beneficial owners, and Certificate of Incorporation.

• Account number(s), account type, account balance(s), and transaction history.
• Income information, salary details, employment status, and employer details (for loan assessment purposes).
• Loan application details, repayment history, collateral details, and credit risk information.
• Bank statements, financial statements (for business customers), and tax identification information.
• Information about other financial products or debts (obtained via credit bureaus with your consent or as required by law).

As a CBN-licensed institution, BWAY is legally required to conduct Know Your Customer (KYC) checks and Anti-Money Laundering (AML) verification before and during our business relationship with you. This includes:

• Certified copies or scans of identity documents (passport, NIN slip, Driver’s Licence, Voter’s Card).
• Utility bills, tenancy agreements, or other proof of address documents.
• Source of funds declarations and politically exposed person (PEP) declarations.
• Beneficial ownership information for corporate customers.
• Adverse media and sanctions screening results (obtained from approved third-party screening services).

• IP address, device type, browser type and version, operating system, and device identifiers.
• Login data, session duration, pages visited, and navigation patterns on our digital platforms.
• Transaction data from internet banking and mobile banking sessions.
• Cookies and similar tracking technologies (see our Cookie Policy for full details).

• Fingerprint data and facial recognition data collected at account opening for BVN verification purposes, in compliance with CBN BVN guidelines.
• Biometric authentication data used for mobile banking login (stored locally on your device — not held on BWAY servers).

Biometric data is special category data under the NDPA 2023 and is processed only where strictly necessary and with appropriate additional safeguards.

• Records of calls, emails, in-branch conversations, and chat interactions with BWAY customer service.
• Complaints, feedback, and survey responses.
• CCTV footage collected at BWAY branches and ATMs (for security purposes, retained for 90 days).

In certain circumstances, we receive personal data about you from third parties, including:

• Credit bureaus (e.g., CRC Credit Bureau, CreditRegistry) — credit history and credit score data, with your consent or as required by law.
• NIBSS — BVN verification data, bank account linkage information.
• CBN / NDIC — regulatory enquiry responses.
• Fraud prevention and sanctions screening databases.
• Employers or guarantors — employment verification or guarantee confirmation.

Section 4How We Collect Your Personal Data

We collect personal data through the following channels:

• Account opening forms (in-branch, online, or via our mobile app).
• Loan application forms and supporting documentation.
• Our website (www.bway.ng), internet banking portal, and BWAY mobile banking application.
• Telephone and video calls (which may be recorded for quality assurance and security).
• In-branch interactions, including CCTV recordings.
• Third-party sources as described in Section 3.7 above.
• Cookies and digital tracking technologies as described in our Cookie Policy.
• Corporate customer onboarding documentation submitted to BWAY by authorised representatives.
• NIBSS and BVN database enquiries conducted as part of KYC compliance.

Section 5Why We Use Your Personal Data and Our Legal Basis

We only use your personal data where we have a valid legal basis to do so under the NDPA 2023. The table below explains each purpose for which we process your data and the corresponding legal basis:

Section 6Special Category and Sensitive Personal Data

Certain categories of personal data are considered more sensitive under the NDPA 2023 and require additional protection. BWAY processes the following categories of sensitive or special category data:

Section 7Who We Share Your Personal Data With

We do not sell your personal data to third parties. We share your personal data only where necessary and under appropriate legal and contractual protections. We may share your data with the following categories of recipients:

• Central Bank of Nigeria (CBN) — supervisory examination, regulatory reporting, and compliance enquiries.
• Nigeria Deposit Insurance Corporation (NDIC) — deposit insurance scheme obligations and supervisory reports.
• Nigeria Financial Intelligence Unit (NFIU) — mandatory Suspicious Transaction Reports (STRs) and Currency Transaction Reports (CTRs) under the Money Laundering (Prevention and Prohibition) Act 2022.
• Nigeria Data Protection Commission (NDPC) — regulatory reporting, data breach notifications, and enquiry responses.
• Economic and Financial Crimes Commission (EFCC) / Independent Corrupt Practices Commission (ICPC) — legally required disclosures in the course of investigations.
• Courts and other judicial authorities — pursuant to valid court orders, subpoenas, or legal process.

We engage third-party service providers who process personal data on our behalf under written Data Processing Agreements (DPAs) that meet NDPA 2023, Section 28 requirements. These include:

• NIBSS (Nigeria Inter-Bank Settlement System) — BVN verification, NIP payment processing, and inter-bank settlements.
• Credit bureaus (CRC Credit Bureau, CreditRegistry, XDS Credit Bureau) — credit history checks for loan assessment purposes.
• Core banking system vendor — hosting and maintenance of our core banking infrastructure.
• Payment card schemes (Verve, Mastercard, Visa) — debit card processing and transaction switching.
• Cloud service provider (AWS) — secure hosting of digital banking systems.
• SMS / email communications provider — delivery of transaction alerts, OTPs, and service notifications.
• KYC / AML screening service providers — identity verification and sanctions screening.
• IT security and cybersecurity service providers — fraud monitoring and threat detection.
• Audit firms and legal advisers — as required for audit, legal, and compliance purposes.

• Correspondent banks and NIBSS — for processing inward and outward fund transfers on your behalf.
• Card schemes — for processing card transactions at point-of-sale and ATM terminals.
• Debt recovery agents — where a loan account is in default and recovery action is authorised under your loan agreement, subject to strict instructions from Bway.

Where you have provided consent, we may share your data with: third-party financial product providers (e.g., insurance partners) where you have requested a product; credit reference agencies for purposes beyond mandatory AML/credit assessment; and other parties as specified at the time you provide your consent.

Section 8Cross-Border Transfer of Personal Data

Some of our service providers are based outside Nigeria or operate global infrastructure that may involve the transfer of your personal data outside Nigeria. We only transfer personal data outside Nigeria where we are satisfied that adequate safeguards are in place, in accordance with NDPA 2023, Section 43. These safeguards include:

• Transfer to a country or territory that the Nigeria Data Protection Commission (NDPC) has determined provides an adequate level of data protection.
• Standard contractual clauses approved by the NDPC or equivalent international data protection authority.
• The transfer is necessary for the performance of a contract between you and BWAY (e.g., processing an international wire transfer).
• The transfer is necessary for compliance with a legal obligation applicable to BWAY.

The primary international data transfers we currently make involve: cloud infrastructure services (AWS processed under data processing agreements with appropriate safeguards); and international card scheme transactions (Mastercard/Visa necessary for the performance of your card services contract). You may request details of the specific safeguards in place for any particular transfer by contacting our DPO.

Section 9How Long We Keep Your Personal Data

We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected and to meet our legal, regulatory, and contractual obligations. The NDPA 2023 requires us to apply the principle of storage limitation — we do not keep data longer than we need it.

When your data reaches the end of its retention period, we will securely delete or anonymise it so that it can no longer be attributed to you. If you wish to request early deletion, please see Section 11 (Your Rights).

Section 10How We Protect Your Personal Data

Bway takes the security of your personal data very seriously and implements comprehensive technical and organisational measures to protect it against unauthorised access, disclosure, alteration, loss, or destruction. Our security measures include:

• Encryption of all personal data in transit using TLS 1.2 minimum and at rest using AES-256 encryption.
• Multi-Factor Authentication (MFA) for all access to systems containing customer personal data.
• Role-based access controls — customer data is accessible only to Bway staff who need it to perform their specific job function.
• 24/7 security monitoring and intrusion detection systems.
• Regular security testing, including penetration testing and vulnerability assessments.
• Encrypted and tested backup systems with off-site and cloud storage.

• Mandatory data protection and cybersecurity training for all staff handling personal data.
• Strict access control and privileged access management policies.
• Data Processing Agreements with all third-party processors meeting NDPA 2023, Section 28 requirements.
• A documented Privacy and Data Protection Policy, Access Control Policy, and Incident Response Plan.
• Regular internal and external data protection audits.
• An appointed Data Protection Officer responsible for overseeing compliance.

In the event of a personal data breach, BWAY will: notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, where required by NDPA 2023, Section 40; notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms; and take immediate steps to contain and remediate the breach. You can report a suspected data breach or security concern to our DPO at ayomide@bway.ng.

Section 11Your Rights as a Data Subject

Under the Nigeria Data Protection Act (NDPA) 2023, you have the following rights in relation to your personal data. We are committed to responding to all valid rights requests within 30 (thirty) days of receipt. In complex cases, we may extend this by a further 30 days and will notify you if this is necessary.

To exercise any of your rights, please contact our Data Protection Officer at dpo@bway.ng. We may need to verify your identity before processing your request. All rights requests are free of charge; however, we may charge a reasonable fee for manifestly unfounded or excessive requests.

Section 12Automated Decision-Making and Profiling

BWAY uses automated systems to assist with certain decisions in the course of providing banking services. These include: initial credit scoring assessments for loan applications (using financial data you provide and credit bureau data); fraud detection alerts generated by our transaction monitoring system; and AML transaction screening for sanctions and PEP matches.

In all cases where automated processing generates an outcome that materially affects you (e.g., a preliminary loan decision, an account restriction, or a fraud alert), a qualified BWAY staff member reviews the automated outcome before it is implemented. You have the right to request human review of any automated decision, as described in Section 11.

We do not use profiling for purposes that would result in discrimination on the basis of protected characteristics under Nigerian law, including race, ethnicity, religion, gender, or disability.

Section 13Marketing Communications

With your consent, BWAY may use your personal data to send you information about our banking products, services, and promotions that we believe may be relevant to you. Marketing communications may be sent by: email, SMS, in-app notification, or phone call. We will only send marketing communications where you have opted in to receive them.

You can opt out of marketing communications at any time by:

• Clicking the ‘Unsubscribe’ link in any marketing email.
• Replying ‘STOP’ to any marketing SMS.
• Updating your communication preferences in your internet banking profile under ‘Notifications and Preferences’.
• Contacting our DPO at dpo@bway.ng.
• Calling our customer service line.

Opting out of marketing will not affect transactional and service communications, such as account statements, transaction alerts, OTPs, and security notices, which are necessary for your banking relationship with us.

Section 14Cookies and Digital Tracking Technologies

When you use BWAY’s website, internet banking portal, or mobile banking application, we may use cookies and similar technologies to enhance your experience and to collect usage data. Our use of cookies is governed by our separate Cookie Policy, which is available from the footer of every BWAY webpage. The Cookie Policy explains: what cookies are; the specific cookies we use and why; how long they are stored; and how to manage your cookie preferences.

Section 15Children’s Privacy

Bway’s banking services and digital platforms are not directed at individuals under the age of 18. We do not knowingly collect personal data from children under 18 without verifiable parental or guardian consent. Bway offers certain youth savings products for minors; in such cases, the account is operated by a parent or legal guardian, and personal data collected relates primarily to the adult guardian.

If you are a parent or guardian and you believe your child under 18 has provided personal data to BWAY without your consent, please contact our DPO immediately at ayomide@bway.ng. We will take prompt steps to verify the information and, where appropriate, delete the data from our records.

Section 16Third-Party Websites and Services

Bway’s website and digital platforms may contain links to third-party websites, social media platforms, and partner services. These third-party sites are governed by their own privacy policies, which we encourage you to review. BWAY is not responsible for the privacy practices or content of third-party websites and cannot guarantee that those sites process your personal data lawfully. The inclusion of a link to a third-party website does not constitute an endorsement by Bway of that site’s privacy practices.

Section 17How to Make a Complaint

If you believe that BWAY has not complied with this Privacy Notice or has processed your personal data unlawfully, we encourage you to contact our Data Protection Officer in the first instance. We take all privacy complaints seriously and will investigate and respond to your complaint within 30 days of receipt.

If you are not satisfied with our response, or if you wish to report a concern directly to the national supervisory authority, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC):

Section 18Changes to This Privacy Notice

Bway may update this Privacy Notice from time to time to reflect changes in applicable law (including new NDPC or CBN guidance), changes in our data processing practices, or changes in Bway’s products and services. When we make material changes, we will:

• Post the updated Notice on our website at www.bway.ng/privacy with a revised ‘Effective Date’.
• Display a prominent notice on our website and digital platforms for not less than 30 days following any material update.
• Where the change is material to your rights or our processing of your data, notify you by email, in-app notification, or SMS where we hold your contact details.

We encourage you to review this Notice periodically. Your continued use of Bway’s services after material changes are communicated constitutes your acknowledgement of the updated Notice. This Notice was last reviewed and approved in January 2026.