Nigerian Exchange Limited (“NGX”, “we”, “us” or “our”) is committed to protecting your personal data and respecting your privacy when you access or use the NGX Invest platform (“NGX Invest” or the “Platform”).

NGX processes personal data through NGX Invest in accordance with the Nigeria Data Protection Act 2023 (“NDP Act”), the Nigeria Data Protection Act – General Application and Implementation Directive 2025 (“GAID”), and other applicable data protection and regulatory requirements.

What Personal Data We Process

Depending on your interaction with NGX Invest and the investment products or services you access, we may collect and process personal data including your:

• name, date of birth, gender and contact details;
• residential or correspondence address;
• Bank Verification Number (BVN) and other identity verification information;
• bank account and payment information;
• government-issued identification and related Know-Your-Customer (KYC) information;
• investor and investment application information;
• next-of-kin information, where applicable;
• device, IP address, login and platform usage information; and
• other information reasonably required to provide the services available through NGX Invest or comply with applicable legal and regulatory obligations.

We will only collect and process personal data that is adequate, relevant and reasonably necessary for the purposes for which it is required.

Why We Process Your Personal Data

Your personal data may be processed for purposes including:

• creating, administering and securing your NGX Invest account;
• verifying your identity and completing applicable KYC requirements;
• enabling you to participate in public offers, rights issues and other investment opportunities available through the Platform;
• processing and reconciling payments and investment applications;
• communicating with you regarding your account, applications, transactions and Platform services;
• preventing fraud, unauthorised access and other unlawful activities;
• maintaining appropriate records of transactions conducted through the Platform;
• improving the functionality, security and user experience of NGX Invest; and
• complying with applicable laws, regulatory requirements and lawful requests from competent authorities.

We process your personal data only where we have a lawful basis for doing so, including where processing is necessary for the performance of a contract, compliance with a legal obligation, the legitimate interests of NGX or a third party, or where you have provided valid consent, as applicable.

Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing undertaken before the withdrawal.

Sharing of Personal Data

Where necessary for the operation of NGX Invest or the completion of your investment, we may share relevant personal data with authorised third parties, including issuers, receiving agents, registrars, financial institutions, payment service providers, identity verification providers, technology service providers, professional advisers, regulators and other entities involved in facilitating transactions through the Platform.

We require service providers to process personal data on our behalf to implement appropriate safeguards and process such information only for authorised purposes. NGX does not sell your personal data.

Data Security, Privacy by Design and Data Protection Impact Assessment

NGX is committed to embedding privacy and data protection principles into the design, development and operation of NGX Invest and applies appropriate technical and organisational measures to safeguard personal data against unauthorised or unlawful access, use, disclosure, alteration, loss or destruction.

In accordance with the NDP Act, GAID and other applicable data protection requirements, NGX has conducted a Data Protection Impact Assessment (DPIA) in respect of NGX Invest.

The DPIA assessed the nature, scope, context and purposes of the personal data processing activities undertaken through the Platform, including the potential risks to the rights and freedoms of data subjects, and identified appropriate technical, organisational and governance measures for mitigating those risks.

NGX has implemented, and will continue to maintain and review, appropriate safeguards arising from the DPIA, including measures relating to data minimisation, access controls, information security, data retention, third-party processing and the protection of data subject rights.

NGX will periodically review the DPIA and the privacy and security measures applicable to NGX Invest, particularly where there are material changes to the Platform, its functionality, the categories or purposes of personal data processed, the technologies deployed, third-party integrations or other circumstances capable of materially altering the privacy risks associated with the Platform.

Through these measures, NGX seeks to ensure that privacy by design and by default remains an integral part of the operation and continuing development of NGX Invest.

Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to satisfy applicable legal, regulatory, contractual, accounting and legitimate business requirements.

At the expiration of the applicable retention period, personal data will be securely deleted, destroyed or anonymised in accordance with NGX's applicable data retention requirements and applicable law.

International Transfers

Where it becomes necessary to transfer your personal data outside Nigeria, NGX will ensure that such transfer is undertaken in accordance with the NDP Act, GAID and other applicable requirements and that appropriate safeguards are implemented to protect your personal data.

Your Data Protection Rights

Subject to applicable law and any lawful limitations, you may have the right to:

• obtain information about the processing of your personal data;
• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of your personal data where legally permissible;
• object to or request restriction of certain processing;
• withdraw consent where processing is based on consent;
• request portability of your personal data where applicable;
• object to certain automated decision-making or profiling; and
• lodge a complaint regarding the processing of your personal data.

Requests relating to your personal data may be submitted through the designated privacy contact provided on NGX Invest.

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) where you believe that your personal data has been processed in violation of applicable data protection law.

Cookies and Similar Technologies

NGX Invest may use cookies and similar technologies that are necessary for the operation, functionality and security of the Platform. Where cookies or similar technologies are used for analytics, personalisation, advertising or other purposes requiring consent, you will be provided with appropriate choices to accept, reject or manage such cookies.

Your Choices and Control

Where available, NGX Invest provides mechanisms that enable you to manage your account information and privacy preferences. You may also contact us to exercise your data protection rights or obtain assistance regarding the processing of your personal data.

Further Information

This Privacy Statement provides a summary of how NGX Invest collects, uses, shares and protects your personal data. More detailed information regarding our data processing activities, retention practices, data sharing arrangements, international transfers and your rights is available in the NGX Invest Privacy Policy.

By proceeding to use NGX Invest, you acknowledge that you have read and understood this Privacy Statement. Where NGX requires your consent for a specific processing activity, such consent will be requested separately, and you will be provided with an appropriate means of indicating your choice.