Privacy Policy

1. Introduction

KudiLink Financial Services Limited (“KudiLink”, “KudiLoans”, “we”, “us” or “our”) is a company duly incorporated under the Companies and Allied Matters Act 2020 and licensed to carry on money lending business in Nigeria. We operate the website www.kudiloans.com and the KudiLoans mobile application (collectively, the “Platform”) through which we offer short-term and medium-term consumer and small business loan products.

We are committed to protecting the privacy and personal data of every person who visits our Platform, applies for a loan, or otherwise interacts with us (“you”, “your”, or “Data Subject”). This Privacy Policy explains what personal data we collect, why we collect it, how we use, store, share and protect it, and the rights available to you under applicable Nigerian law.

This Policy is issued in compliance with, among other instruments, the Nigeria Data Protection Act 2023 (“NDPA”), the Nigeria Data Protection Regulation 2019 and its Implementation Framework, applicable State Money Lenders Laws, and the Federal Competition and Consumer Protection Act 2018.

2. Information We Collect

2.1 Information You Provide Directly

• Identity information: Full name, date of birth, gender, marital status, passport photograph, signature, Bank Verification Number (BVN), National Identification Number (NIN), and government-issued identification documents (national ID card, voter's card, international passport, or driver's licence).
• Contact information: Residential and work address, phone number(s), e-mail address, and next-of-kin/guarantor details.
• Financial information: Bank account details, account statements, salary/income information, employment and employer details, existing debt obligations, and credit history.
• Loan application information: Loan amount requested, purpose of loan, repayment plan, and supporting documents you upload.
• Communications: Records of calls, e-mails, chat messages and other correspondence between you and KudiLink, including customer support interactions.

2.2 Information Collected Automatically

• Device and technical information: IP address, device identifiers, device model, operating system, browser type, mobile network information, and geolocation data (where enabled).
• Usage data: Pages visited, features used, time spent on the Platform, log-in timestamps, and clickstream data, collected via cookies and similar tracking technologies (see Section 8).

With your express, separate consent obtained at the point of app installation and in line with applicable Google Play/App Store policies and the NDPA, our mobile application may request access to limited device data (such as device information and SMS data strictly necessary for identity verification and fraud prevention) where you have granted such permission. We do not access your contact list, photo gallery, or call logs for marketing purposes.

2.3 Information from Third Parties

• Credit bureaux licensed by the CBN and the CBN Credit Risk Management System (CRMS).
• Identity verification providers, including the National Identity Management Commission (NIMC) and the Nigeria Inter-Bank Settlement System (NIBSS) BVN platform, used solely to verify the identity you have provided.
• Your bank, where you have authorised us (for example, via Mono, Okra or a similar open-banking/account-information service) to retrieve your account statement for affordability assessment.
• Publicly available sources, such as the Corporate Affairs Commission register, where relevant to verifying business loan applicants.

3. Purpose and Legal Basis for Processing

We process your personal data only where we have a lawful basis to do so. The table below summarises our principal purposes and the corresponding lawful basis.

4. How We Share Your Information

We do not sell your personal data. We may share your personal data, on a need-to-know basis and subject to appropriate safeguards, with:

• Licensed credit bureaus, for credit reporting and assessment in line with applicable laws.
• Identity verification and open-banking service providers engaged to confirm your identity or retrieve account statements with your consent.
• Loan recovery agents, solicitors, and debt collection partners engaged in compliance with State Money Lenders Laws and the FCCPC Interim Regulatory Framework for Digital Lending, strictly without harassment or abusive practices.
• Your nominated guarantor, referee or next-of-kin, strictly for loan verification or recovery.
• Regulatory and governmental authorities, including NDPC, FCCPC, EFCC, and courts of competent jurisdiction.
• Professional advisers (auditors, lawyers, insurers) and cloud/technology service providers operating under written data processing agreements consistent with NDPA requirements.
• A successor entity in the event of a merger, acquisition, restructuring, or asset sale.

5. Cross-Border Data Transfer

Where it is necessary to transfer your personal data outside Nigeria (for example, to a cloud hosting provider), we will only do so where the recipient country, or the recipient itself, is subject to an adequate level of data protection as determined by the NDPC, or where appropriate safeguards (such as standard contractual clauses or your explicit consent) have been put in place in accordance with the NDPA.

6. Data Storage and Security

We implement technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including 256-bit SSL encryption of data in transit and at rest, access controls, staff confidentiality obligations, and periodic security assessments.

We conduct Data Protection Impact Assessments (DPIA) where required and maintain a comprehensive data breach response procedure. In the event of a personal data breach likely to result in a risk to your rights, we will notify the NDPC and affected Data Subjects without undue delay.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this Policy, including the duration of your loan relationship with us. Thereafter, data is retained for such additional period as required by law (for loan and KYC records, typically not less than five (5) years after the relationship ends, in line with CBN AML/CFT requirements). Where retention is no longer required, data is securely deleted or anonymised.

8. Cookies and Similar Technologies

Our website uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyse usage, and improve security. You may control or disable cookies through your browser settings; however, doing so may affect Platform functionality. Where required, consent is requested before placing non-essential cookies.

9. Your Rights as a Data Subject

Subject to applicable law, you have the right to:

• Be informed about how your personal data is processed.
• Access a copy of the personal data we hold about you.
• Request correction of inaccurate or incomplete personal data.
• Request erasure of your personal data, subject to legal and regulatory retention obligations.
• Object to, or request restriction of, certain processing including direct marketing.
• Request a copy of your personal data in a structured, machine-readable format (data portability).
• Withdraw consent at any time without affecting prior lawful processing.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or seek judicial redress.

To exercise any of these rights, please contact our Data Protection Officer. We will respond generally within thirty (30) days as prescribed by the NDPA.

10. Marketing Communications

Where you have consented to marketing communications, you may opt out at any time by clicking “unsubscribe” in any e-mail, replying “STOP” to any SMS, or contacting us directly. Service and transactional messages relating to active loans will continue to be sent.

11. Children's Privacy

Our services are intended only for persons who are at least 18 years old and have full legal capacity to enter into a binding contract under Nigerian law. We do not knowingly collect data from minors.

12. Third-Party Links

The Platform may contain links to third-party websites not operated by us. We are not responsible for their privacy practices and encourage you to review their respective privacy policies.

13. Data Protection Officer and Complaints

We have designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and data protection laws:

14. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. Material changes will be posted on the Platform with an updated “Last Reviewed” date.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to us at:

KudiLink Financial Services Limited
Propertygate Centre (3rd Floor), 2 The Rock Drive, Lekki Phase 1, Lagos State, Nigeria
E-mail: support@kudiloans.com | Phone: +234 (0) 700 KUDI LOAN | Website: www.kudiloans.com