We may collect the following Personal Data:

• Personal identification information – We collect and use information about You to administer Our business. Information collected shall include
  • Your contact information such as Name, contact address, email addresses, gender, telephone numbers and details of next of kin;
  • Demographic information;
  • Occupation, Career history, professional background and other CV related information;
  • International and National passport, driving license or any other form of proof of identification;
  • Transactional data, including financial details, your photograph; 
  • And any other information We may deem necessary and which may be determined by extant Nigerian laws and regulations.

We may collect personal identification information from you in a variety of ways, including, but not limited to, when you visit our Site, register on the Site, make payments for our products and services, subscribe to Our newsletter, respond to a survey, or fill out a form, and in connection features or resources made available on our Site.

• Non-personal identification information – This is information received whenever You interact with Our Site. Non-personal identification information may include:
  • Unique IDs such as your mobile device identifier or cookie ID on your browser;
  • IP address and information that maybe derived from IP address, such as geographic location; and
  • Information about a device you use, such as browser, device type, operating system and the internet service providers utilized.

Other information relevant to customer surveys and/or offers

True Depth API Usage 

ARM HoldCo uses the True Depth API within the camera module to enhance the liveness check during the Know Your Customer (KYC) process, as required by account opening regulations. This technology ensures that the video submitted is being recorded live and belongs to the user. 

What We Collect 

The app gathers the following data during the liveness check: 

• Camera Intrinsic Matrix: Information about the camera’s internal properties. 
• Facial Expressions and Head Orientation: To verify live interaction. 
• Camera Position: To validate that the video is captured in real-time and is not pre-recorded. 

How We Use This Data 

• The video is shared with a third-party service provider solely to confirm the user’s identity. 
• The data is deleted after the verification process, in compliance with applicable laws and regulations. 

Third-Party Obligations 

• Our third-party service provider is bound by data protection laws and prohibited from using the data for marketing or any other purpose outside the agreed scope. 

User Rights 

• Users can opt out of the video capture process at any time. However, opting out may limit the ability to complete KYC verification, restricting access to certain services. 

This process ensures that ARM Group meets regulatory requirements while prioritizing user privacy and security. 

All Personal  Data which we collect, and process is justified by lawful processing on the legitimate basis that:

• You have given consent to the processing;
• Processing is necessary for the performance of a contract to which you are a party or to take steps to enter into a contract;
• Processing is necessary for compliance with  legal and regulatory obligations to which we are subject;
• Processing is necessary in order to protect your vital interests or another natural person; and
• Processing is necessary for the performance of a task carried out in the public interest.
• Processing is necessary for the purposes of our legitimate interests or those of a third party, provided that such interests are not overridden by your rights and freedoms.

We require this information to understand your needs, and provide you with better service, particularly with regard to the following:

• Internal record keeping;
• To respond to your enquiries about the ARM Group;
• To improve our products and services;
• To improve customer service delivery;
• To send promotional emails about new products, special offers or other information which we think you may find interesting using the email address which you have provided;
• To contact you occasionally for market research purposes. We may contact you by email, phone, fax or mail;
• To deliver technical and functional management on our site;
• To provide specific services in accordance with an agreement you are entering, or have entered into with us;
• To manage the security of our sites, networks and systems;
• To comply with Applicable Laws and to operate our business;
• To run a promotion, contest, survey or other site features; and
• To improve our Site through feedback you provide on our products and services.

The ARM Group will not share with other parties, information which you may provide when using the Site, except to the extent necessary to provide services to you, further, to obtaining your consent.

With your express consent, we will share your personal data among subsidiaries within the ARM group, only to the extent of your permission, and which is necessary to provide services to you. In this case, your right to withdraw consent shall be exercisable at all times.

We may wish to share with you, information about our products and services, including those of our subsidiaries which we reasonably believe you may be interested. If you have agreed to receive marketing materials, you can always opt out at a later date. You reserve the right at any time and at no cost to you, to stop us from contacting you for marketing purposes or giving your data to our subsidiaries.

We collect information about you and any other party whose details you provide to us when you:

• Provide feedback on our products and services to improve our Site;
• Complete online forms;
• Take part in surveys;
• Interact with us using our social media platforms;
• Download information such as publications or participate in any other interactive areas that appear on our Site or portals;
• Contact us offline, for example by telephone, SMS, email, post or any other means of communication;
• Access and use any of our Sites or portals from your devices (including mobile devices) and applications; and 
• Share Personal Data with third parties that are entitled to share that data, but in each case as permitted by Applicable Laws.
• In the event that our ability to communicate with you is disrupted by reason of a change in your contact information, we shall take steps to re-establish same including procuring your personal data from third parties who possess the authority to disclose such information in compliance with applicable data protection laws. Such information shall be used solely for the purpose of reconnecting with you and updating your previously provided information, and where required, to safeguard your interests

We store Personal Data in both digital and physical formats. Physical records are secured in a fireproof safe, while digital data is stored on cloud platforms with data centers located both within and outside Nigeria. 

By accessing or using our Services or otherwise providing information to us, you consent to the processing and transfer of your information within Nigeria and to other countries where we or our service providers operate. Where data is transferred outside Nigeria, we ensure that the recipient country has data protection laws that are adequate and comparable to those in Nigeria. 

Note that where your data is transferred to other countries there might be an increased risk that your personal information, particularly where such jurisdiction is not subject to the same level of protection as in Nigeria. These risks may include: 

• Increased exposure to unauthorized access or misuse due to weaker enforcement mechanisms. 
• Lack of enforceable data subject rights, such as the right to access, rectify, or delete personal data. 
• Limited recourse for data breaches, meaning individuals may find it difficult to seek legal remedies. Potential government surveillance without adequate safeguards or oversight. 
• Inadequate technical and organizational measures by recipients to secure data. 

We take reasonable steps to mitigate these risks, including through the use of contractual safeguards (such as Standard Contractual Clauses), security measures, and by ensuring that third parties processing data on our behalf adhere to high data protection standards. 

We are committed to ensuring that Your Personal Data information is secure. In order to prevent unauthorised access or disclosure, We have put in place reasonable physical, electronic and managerial procedures to safeguard and secure the Personal Data We collect online.

In particular, We adopt appropriate data collection, storage and processing practices and security measures to protect against unauthorized access, alteration, disclosure or destruction of Your personal transaction information and data stored on our Site.

Sensitive and private data exchange between the Site and its Users happens over a secured communication channel and is encrypted and protected. Transactions are also handled over a secure payment gateway. Also, the ARM Group has implemented appropriate technical, physical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, accidental loss, damage, alteration, unauthorised disclosure or access, as well as all other forms of unlawful processing.

We maintain Personal Data not longer than we need to use it in accordance with the ARM Group’s Data Retention Policy. In some circumstances, we may retain your Personal Data for longer periods if it is in accordance with regulatory, legal, tax or accounting obligations. The ARM Group has an established retention procedure it applies to records and Personal Data collected and stored. In all cases, where your Personal Data is no longer required or you request for deletion, we will ensure it is disposed of in a secure manner.

We do not sell, trade, or rent Users Personal Data to others. We may share generic aggregated demographic information not linked to any Personal Data regarding visitors and users with our business partners, trusted affiliates and advertisers for the purposes outlined above. We will not disclose Your Personal Data to anyone outside the ARM Group without Your consent to do so unless one of the following circumstances applies:

1. With your consent

We will share Personal Data with companies, organizations or individuals outside of the ARM Group when We have your consent to do so. We shall also obtain your consent before sharing of any sensitive Personal Data.

2. Processing of Personal Data of minors

Where we collect the Personal Data of a minor, we shall obtain the consent of a parent or guardian and we shall ensure that the purpose of processing or collecting the Personal Data is clear to both the minor and the parent or guardian.

3. For external processing

We provide Personal Data to our affiliates or other trusted businesses or persons to process it for us, based on our instructions and in compliance with our Privacy Policy and any other appropriate confidentiality and security measures.

4. For legal reasons

We will share Personal Data with companies, organizations or individuals outside of the ARM Group if we have a good-faith belief that access, use, preservation or disclosure of the information is reasonably necessary to:

• meet any Applicable Law, regulation, such as the Nigeria Data Protection Act 2023, legal process or enforceable governmental request.
• detect, prevent, or otherwise address fraud, security or technical issues.
• protect against harm to the rights, property or safety of the ARM Group, our Users or the public as required or permitted by law.

By using this Site or transacting with ARM, You signify Your acceptance of this policy. If You do not agree to this policy, please do not use Our Site. Your continued use of the Site following the posting of changes to this policy will be deemed Your acceptance of those changes.

Whenever You use Our services, We aim to provide You with access to Your Personal Data. If that Personal Data is wrong, We strive to give You ways to update it quickly or to delete it – unless We have to keep that Personal Data for legitimate business or legal purposes. When updating Your Personal Data, We may ask You to verify Your identity before We can act on Your request.

We shall, at your request, confirm what Personal Data We hold about You and how such Personal Data is processed. The following Personal Data are available upon Your request.

• Contact details of the Data Protection Officer, where applicable;
• The purpose of the processing as well as the legal basis for processing;
• The categories of Personal Data collected, stored and processed;
• Recipient(s) or categories of recipients that the data is/will be disclosed to;
• Information about how We ensure transfer of Personal Data to a third party or international organisation is done securely.
• How long the data will be stored;
• Details of Your rights to correct, erase, restrict or object to such processing;
• Information about Your right to withdraw consent at any time;
• How to lodge a complaint with the supervisory authority, Nigeria Data Protection Commission (the Commission);
• Whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the Personal Data and the possible consequences of failing to provide such data;
• The source of Personal Data if it was not collected directly from you; and
• Any details and information of automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.

At any point while we are in possession of or processing your Personal Data, You, the data subject, have the following rights:

• Right of Access – You have the right to request a copy of the information that We hold about you
• Right of Rectification – You have a right to correct data that We hold about You that is inaccurate or incomplete
• Right to be Erased/Forgotten – In certain circumstances You can ask for the data We hold about You to be erased from our records
• Right to Restriction of Processing – Where certain conditions apply to have a right to restrict the processing
• Right of Portability – You have the right to have the data We hold about you transferred to another organisation (to be reused for Your own purposes)
• Right to Object – You have the right to object to certain types of processing such as direct marketing
• Right to Object to automated processing, including profiling – You also have the right to be subject to the legal effects of automated processing or profiling
• Right to Withdraw – You have the right to withdraw Your consent at any time

In the event you are dissatisfied with the way in which we process your data we advise that you submit your complaint to our DPO via [email protected].  You may also lodge your complaint with the commission using the contact information as provided in our Compliance with Regulations Clause of this Privacy Policy.

Where you remain dissatisfied, you reserve the right to explore other appropriate legal remedies as guaranteed under Nigerian law.

Our Privacy Policy may change from time to time. We will not reduce your rights under this Policy without your explicit consent. We will post any privacy policy changes on this page and, if the changes are significant, we will provide a more prominent notice (including, for certain services, email notification of privacy policy changes) or via a pop-up notice or statement of changes on our site).

You acknowledge and agree that it is Your responsibility to review this Policy periodically and become aware of modifications. This Privacy Notice or Policy was last updated in July 2025. The most up-to-date version can be found on this Site.

According to Applicable Law, ARM Group shall notify Nigeria Data Protection Commission (the Commission) within 72 hours of knowledge of a breach of security leading to accidental or unlawful destruction, loss, alteration unauthorized disclosure of, or access to your Personal Data. Furthermore, where we ascertain that such breach is detrimental to your rights and freedoms in relation to your Personal Data, we as soon as reasonably practicable upon knowing the occurrence of such breach take steps to inform you of the breach incident, the risk to your rights and freedoms resulting therefrom and any course of action to remedy said breach. If

If you feel that your Personal Data has not been handled correctly or you are unhappy with our response to any requests you have made to us regarding the use of your Personal Data, you have a right to lodge a complaint with the Commission. The contact details are:

Nigeria Data Protection Commission

Tel: +234 (0) 916 061 5551

Email: [email protected]

Website: https://ndpc.gov.ng/