Privacy Policy

Mida Africa Limited ("we" / "our"/ "us") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy (the "Policy") explains how we collect, use, disclose, and safeguard your information in accordance with the Nigerian Data Protection Act 2023 (NDPA), and other applicable data protection laws.

1. INTRODUCTION

We are a technology-driven debt collection company that leverages advanced analytics and artificial intelligence to enhance collections performance for lenders. We process personal data to facilitate debt recovery, assess risk, and improve operational efficiency for our clients.

2. SCOPE AND CONSENT

2.1 This Policy applies to personal information processed by us in our business, including on our websites, mobile apps, APIs, and our related online and offline offerings (collectively, the "Services").

2.2 You consent and accept the terms of this Policy and consent to our collection, use, disclosure and retention of your information as described herein (including to contact you), and for all other purposes permitted under applicable data protection laws, anti-spam legislation, and consumer protection laws to this Policy by your continued use of our Services, and your supply of your personal data to us.

3. THE INFORMATION YOU PROVIDE US

We may collect and process the following categories of personal data:

• Identification Data (e.g. name, date of birth, BVN, National ID number);
• Contact Information (e.g. phone number, email address, residential address);
• Financial Information (e.g. loan details, repayment history, outstanding balances);
• Employment Information (e.g. employer name, job title, income data);
• Device and Technical Data (e.g. IP-address, browser type, cookies, geolocation data); and
• Behavioural and Predictive Data (derived from Artificial Intelligence (AI) and analytics tools).

We ensure that all personal data collected is limited to what is necessary for the purpose for which it is processed and in line with the NDPA. If any of the personal data we hold about you is inaccurate, outdated, or incomplete, you have the right to request that it be corrected or updated. We will take reasonable steps to verify your identity before making any changes. To exercise this right, please contact us using the details provided in the "Contact Us" section of this Policy.

4. HOW WE USE YOUR PERSONAL DATA

We will only use personal data where the law permits us to. Specifically, we will use your personal data to:

• verify the identity and contact individuals regarding outstanding debts;
• analyse debt repayment patterns using AI and analytics tools;
• predict repayment behaviour and optimise collection strategies;
• provide our clients with performance insights and reports;
• comply with legal and regulatory requirements; and
• send promotional materials, offers, and updates about our services that may be of interest to you. You may opt out of marketing communications at any time following the unsubscribe link provided in our emails or by contacting us directly.

We only process your data for the purposes outlined above and in accordance with the lawful basis for processing under the NDPA.

5. SHARING YOUR PERSONAL DATA

We may share your personal data with:

• Our client lenders;
• Third-party service providers and business partners; or
• Regulatory authorities if required by the law.

All third parties are required to maintain the confidentiality and security of your personal data.

6. INTERNATIONAL DATA TRANSFERS

Where we transfer your personal data outside Nigeria, we ensure that such transfers are done in compliance with the NDPA and with adequate safeguards in place.

7. DATA SECURITY

We implement appropriate technical and organisational measures to safeguard your data, including:

• Encryption;
• Access control and user authentication;
• Secure data storage and transmission protocols; and
• Regular security assessments.

We will notify you and the Nigeria Data Protection Commission (NDPC) of any suspected personal data breach where we are legally required to do so. Notification shall take place immediately without any undue delay, and in any case no later than 24 hours from the time on which it became apparent that the breach had taken place. Where it is not possible to provide the information at the same time, it may be provided gradually without undue delay. In any case, we shall cooperate with you or any other stakeholder or and shall take all necessary actions, commercial and other, in accordance with the instructions of the competent authority, if any, for the purpose of investigating, limiting possible consequences and restoring to the fullest possible degree any Personal Data breach.

8. DATA RETENTION

8.1 We retain personal data for only as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, regulatory, contractual, operational, or audit requirements.

8.2 Personal data relating to debtors will generally be retained for the duration of the debt recovery process and for an additional period of seven (7) years following the resolution or closure of the account or final payment.

8.3 Where personal data is processed based on consent, (e.g. for marketing purposes), we will retain such data until you withdraw your consent or request deletion, unless we are legally required to retain it for a longer period.

8.4 We may also retain anonymised or aggregated data, including behavioural and predictive insights generated through analytics and AI, for as long as necessary to support research, statistical analysis, system improvement, and business development, provided such data can no longer be linked to any identifiable individual.

8.5 At the end of the applicable retention period, we will take appropriate steps to securely delete, anonymise, or archive personal data in a manner that prevents unauthorised access or further processing.

If you would like more information about our data retention period or to request the deletion of your data, please contact us using the details in "Contact Us" section of this Policy.

9. COOKIES AND TRACKING TECHNOLOGIES

Our website uses cookies and similar technologies to enhance your experience, analyse site usage, and improve our services. You can manage your cookie preferences through your browser settings. For more information on cookies, please see our Cookie Policy.

10. YOUR LEGAL RIGHTS

Under the NDPA, you have the following rights:

• Right to access your Personal Data – this enables you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it.
• Right to correction of your Personal Data – this enables you to have any incomplete, outdated, or inaccurate data we hold about you corrected.
• Right to erasure of your Personal Data – this enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your Personal Data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Right to object to processing of your Personal Data – this enables you to object to the processing of your Personal Data in certain situations, such as for direct marketing purposes or where you feel it impacts on your fundamental rights and freedoms.
• Right to withdraw consent – where we rely on your consent to process data, you can withdraw it at any time without affecting prior processing.
• Right to lodge a complaint – you have the right to file a complaint with the NDPC if you believe your rights have been violated.

To exercise any of these rights, please contact us using the details in the "Contact Us" section of this Policy.

11. CONTACT US

11.1 Please contact our Privacy Department with any questions or concerns regarding this Policy at hello@getmida.com.

11.2 If you have any questions or concerns regarding our Policy, or if you believe our Policy or applicable laws relating to the protection of your personal information have not been respected, you may file a complaint through the email listed above, and we will respond to let you know when you can expect a further response. We may request additional details from you regarding your concerns and may need to engage or consult with other parties to investigate and address your issues. We will keep records of your request and any resolution.

12. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.