Please read this Privacy Notice before you may become a business or personal user of Nigerian Exchange Limited (“NGX”) and its Affiliates' Digital Gateway Platform (hereinafter referred to as the “Platform”).

INTRODUCTION

This Privacy Notice sets out how NGX and/or its Affiliates collect, use, store, share and protect any information that you give to NGX/its Affiliate when you log on to or subscribe to this Platform. It applies to this Platform and all its applications, services, tools and contents regardless of how you access or use them.

NGX and its Affiliates are committed to ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified when using this Platform; you can be assured that it will only be used in accordance with this Privacy Notice.

CONSENT

You accept this Privacy Notice when you sign up for access or use the products, services, content, features, technologies or functions offered on this Platform and all related sites, applications, and services.

LEGAL BASIS

COLLECTION OF INFORMATION

Personal Information We Collect Directly from You

NGX and/or its Affiliates collect Personal Information from you when you use this Platform. The type of Personal Information that we collect from you depends on your particular interaction with the Platform. We require you to register on the Platform to access certain features. When we do, we may collect the following information from you during the registration process:

If you choose to purchase a product or procure service through the Platform, we may collect your credit or debit card information. Currently, we use third party service providers to process your bank verification number, credit and debit card transactions on our behalf. The third-party service providers will collect your contact information (such as your name, address, and e-mail, bank verification number,) bank or financial information (such as debit or credit card number and expiration date) in accordance with the provisions of a written contract between NGX/its Affiliates and the third party. We will be verifying your BVN data and your bank details and by your logging on to this Platform, you consent to the validation of your BVN data and bank details.

We may also collect information you provide us including but not limited to information on web forms, account update information and correspondence with the Platform support services team. Information obtained through voluntary submissions (e.g., responses to surveys, requests for information on NGX's/its Affiliates' Platform or those of NGX's/its Affiliates' advertisers/marketing partners) and review of Platform usage patterns survey responses, customer enquiries and other means may also be collected and used by us. NGX/its Affiliates will only collect information that is necessary for the provision of the product or service that you have subscribed to.

Personal Information We Collect Automatically

NGX/its Affiliates may use cookies, web beacons, and other tracking technologies to collect information about you automatically as you log on to the Platform. This includes information sent to us by your computer, mobile phone, POS or other electronic access devices. The automatically collected information includes but is not limited to data about the pages you access, computer IP address, device ID or unique identifier, device type, geo-location information, computer and connection information, mobile network information, statistics on page views, traffic to and from the sites, referral URL, ad data, the dates and times of your use of the Platform and standard web log data. We may combine this information with other information that we collect about you. NGX/its Affiliates may engage in activities which involve the automated processing and/or profiling of information you provide us where (i) it is necessary for entering into or performance of a contract;(ii) it is authorized or required by law (which also provides safeguards for you); or (iii) it is the subject of explicit consent fromyou.

You hereby consent that in the circumstances not covered above NGX/its Affiliates can engage in activities which involve the automated processing and/or profiling of your information in respect of the services for which you provided the Personal Data. Such automated processing and/or profiling in respect of the services can include, without limitation, carrying out automated processing and/or profiling for the purpose of improving the services or introducing more services.

Upon your request we will shall provide you with information about the logic involved in the automated processing of your personal information as well as the significance and envisaged consequences of such processing.

Personal Information We Collect from Third Parties

We also collect information about you from third party sources such as identity verification services; and analytics providers in accordance with the provisions of a written contract between NGX/its Affiliates and the third party. The categories of information that we collect about you from other sources include:

Please note that we may be required by law to collect and use certain Personal Information about you. And we may need to collect and use Personal Information to enter into or fulfil a contract with you. Failure to provide this information may prevent or delay the fulfilment of our obligations in these circumstances.

How NGX/its Affiliates uses Information it Collects

We primarily use your Personal Information to provide Subscription Services to you and to respond to your inquiries. We also may use your Personal Information as follows:

a. To communicate with you, including to respond to your comments or requests for information, to request feedback on our products and services, and to notify you about changes to your subscriptions/ registration or to the services you use.

b. To help NGX/its Affiliates understand you, to tailor and enhance our product and service offerings, anticipate and resolve problems with any products or services supplied to you, create products or services that may meet your needs.

c. To provide access to restricted pages or contents of the Platform.

d. To comply with legal and/or regulatory requirements and cooperate with regulators and law enforcement bodies.

e. To facilitate your activity and to identify you when you log into your account on our Platform

f. To send you marketing communications and advertising in line with your communications preferences and where permitted by applicable law about products, services and opportunities that we believe would be of interest to you, including products and services offered by third parties.

g. To protect our rights, your rights, and the rights of others, and to meet our own high standards of business practice.

The services of third party may be employed to help us in certain areas, such as website hosting, marketing and market researching. In some cases that third party may receive your information.

However, at all times we will endeavor to keep control and be responsible for the use of your information. By providing NGX/its Affiliates with your Personal Information, you consent to our transferring of your information to countries or jurisdictions which may not be in the 'white list' of jurisdictions annexed to the NDPR Implementation Framework (“Framework”) and may not provide the same level of data protection as us. If we do make such a transfer, we will be following all the conditions provided for in the Framework, if appropriate put a contract in place that imposes obligations on our counterparties to protect your information. Each time you provide us with Personal Information we aim to let you know how we intend to use it and ask you to give your consent to such use.

NGX/its Affiliates may assign its obligations and rights under this Policy to an Affiliate or a successor entity and your Personal Information as well as the use and processing of such Personal Information may be among the assets transferred by NGX/its Affiliates. You acknowledge and consent that such transfers may occur and are permitted by this Privacy Policy.

SECURITY AND PROTECTION

Personal Information collected will be held securely and will only be kept for as long as is reasonably necessary in the circumstances you are registered or, to use the Platform or as required by law (if applicable) or for as long as you use the service or product that you are subscribed to, unless you have provided us with your consent to use the data for any additional purposes. We take the security of the Platform and the information you provide very seriously, and we will take all appropriate technical, administrative and physical safeguards/measures using recognized security procedures and tools in accordance with good industry practice to protect your Personal Information. We have reasonable security measures in place to protect against the loss, misuse and interception by third parties of the information under our control, but, to the extent allowed by law, NGX/its Affiliate assume no liability for any damages you may suffer as a result of interception, alteration or misuse of information transmitted over the Internet. Whilst we use all reasonable endeavors to protect your security in the manner described above, we consider that it is only appropriate to advise users that data transmission over the Internet and the World Wide Web cannot be guaranteed as 100% secure, and therefore that you use the Platform at your own risk.

NGX'S/ITS AFFILIATES' OBLIGATIONS TO RETAIN YOUR PERSONAL INFORMATION AND YOUR ACCESS TO AND CONTROL OF SUCH PERSONAL INFORMATION

NGX/its Affiliates keep your Personal Information in line with set periods calculated using the following applicable criteria: risk.

The retention period is to enable NGX/its Affiliate use the personal data for the necessary legitimate purposes identified in full compliance with the legal and regulatory requirements. When NGX/its Affiliate no longer need to use your personal information, we will delete it from our systems and records, and/or take steps to anonymise the said personal information so that you cannot be identified or linked to the said personal information.

Access to and Control over Information

In respect of your Personal Information with us you can do at any time the following by contacting us:

• If allowable, see what Personal Information we have about You, if any. Change/correct any Personal Information we have about You after providing the required documentation and if it is within your purview to change/correct.
• If allowable, and subject to points a - h above, have us delete any Personal Information we have about You.
• Request for contact details of the data protection officer, where applicable. If allowable, request for the purpose of the processing as well as the legal basis for processing.
• If allowable, request for information about interests, if the processing is based on the legitimate interests of NGX and its Affiliates or a third party.
• If allowable, request for the categories of personal data collected, stored and processed. If allowable, request for recipient(s) or categories of recipients that the data is/will be disclosed to.
• Information about how we intend to securely transfer the personal data to a third party or international organisation. NITDA will coordinate the transfer requests with the office of the Attorney General of the Federation, who will approve sending personal data to some countries that meet a minimum standard of data protection. Countries listed in the 'white list' of jurisdictions annexed to the NDPR Implementation Framework are exempted from the said approval in other cases, we will ensure there are specific measures in place to secure your information.
• Request for the duration of data retention.
• Request for details and information of automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing and express any concern about our use of your Personal Information.

The services of third party may be employed to help us in certain areas, such as website hosting, marketing and market researching. In some cases that third party may receive your information.

However, at all times we will endeavor to keep control and be responsible for the use of your information. By providing NGX/its Affiliates with your Personal Information, you consent to our transferring of your information to countries or jurisdictions which may not be in the 'white list' of jurisdictions annexed to the NDPR Implementation Framework (“Framework”) and may not provide the same level of data protection as us. If we do make such a transfer, we will be following all the conditions provided for in the Framework, if appropriate put a contract in place that imposes obligations on our counterparties to protect your information. Each time you provide us with Personal Information we aim to let you know how we intend to use it and ask you to give your consent to such use.

NGX/its Affiliates may assign its obligations and rights under this Policy to an Affiliate or a successor entity and your Personal Information as well as the use and processing of such Personal Information may be among the assets transferred by NGX/its Affiliates. You acknowledge and consent that such transfers may occur and are permitted by this Privacy Policy.

DO WE USE COOKIES?

Yes. A cookie is a small file which asks permission to be placed on your computer's hard drive. Once you agree, the file is added, and the cookie helps analyze web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences. Cookies are features included in your browser and will store small amounts of data on your computer about your visit to the Platform, in particular when you complete any form on the Platform. However, a cookie does not provide us with any Personal Information. Therefore, if you have not supplied us with any Personal Information, you can still browse our site anonymously. You do not need to have cookies turned on to visit most of the Platform. Cookies on the Platform are not used to capture or store personal data from browsers to the site, other than to log your IP address and session information such as the duration of the visit to our site and the nature of the browser used. This information is used only for administration of the site system and in the compilation of statistics used by NGX/its Affiliates. Cookies may be required to allow you to access and participate in certain areas of the Platform. Once you have closed your browser, this type of cookie is deactivated. The majority of browsers will allow you to alter the settings used for cookies and to disable and enable them as you require. If you do not want cookies and for further general information on cookies you may wish to visit http://www.allaboutcookies.org.

CONTROLLING YOUR PERSONAL INFORMATION

We will not sell, distribute or lease your Personal Information to third parties unless we have your permission or are required by law to do so.

REMEDIES FOR VIOLATION OF THIS PRIVACY NOTICE

a. Failure to implement safeguards required by the Nigeria Data Protection Regulation 2019 or any of the security measures provided in this Privacy Notice;

b. Failure to mitigate the damage once it has occurred; or

c. Failure to timely notify the affected individuals

shall be liable, in addition to any other civil liabilities, to the penalties provided in the Nigerian Data Protection Regulation.

CONTACTING NGX/ITS AFFILIATES

Our customer service contacts are publicoffers@ngxgroup.com or kadebayo@ngxgroup.com and +234 700 225 5673. We shall endeavour to respond to enquiries/issues sent to/made to these service contacts within 48 hours.

GOVERNING LANGUAGE

This Privacy Notice, and the contents of this Platform are available in English

GOVERNING LAW AND JURISDICTION

By accessing the services on this Platform, you agree to be governed by the laws of the Federal Republic of Nigeria and the Nigeria Data Protection Regulation 2019. The laws of the Federal Republic of Nigeria will govern all matters relating to this Privacy Notice and the use, or inability to use, the Platform, and shall apply without regard to the principles of conflict of laws.

You agree to submit to the exclusive jurisdiction and venue of the Courts in the Federal Republic of Nigeria.

You agree to submit to the exclusive jurisdiction and venue of Notwithstanding the foregoing, NGX/its Affiliates may seek recourse in any jurisdiction worldwide in order to restrain the unlawful use of the Platform or any material contained in the Platform.