Privacy Policy

1. Overview & Commitment

CBI Digital Media Limited (“CBI”, “we”, “our”, or “us”) operates the CBI VAS aggregation infrastructure, portals, and APIs. We are committed to protecting the privacy and confidentiality of all personal data entrusted to us by our merchants, partners, developers, and end users.

This Privacy Policy explains how personal data is collected, handled, retained, and protected in accordance with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation (NDPR), and applicable telecommunications guidelines issued by the Nigerian Communications Commission (NCC).

2. Information We Collect

Depending on how you interact with our platform, we collect the following categories of information:

3. How We Use Your Information

We process collected data solely for legitimate operational and regulatory purposes, including:

• Processing value-added transactions (Airtime, Data, USSD sessions, SMS broadcasts, Bill payments).
• Conducting automated fraud prevention, risk assessment, and identity verification.
• Facilitating merchant settlement disbursements and reconciliation to commercial bank accounts.
• Maintaining regulatory compliance with NCC, CBN, and anti-money laundering (AML) mandates.
• Providing technical support, service notifications, and system performance enhancements.

4. Legal Basis for Processing (NDPA)

Under Section 25 of the Nigeria Data Protection Act 2023, our processing of your personal data is grounded in:

• Contractual Necessity: To fulfill the provision of services agreed upon under our Terms of Service.
• Legal Obligation: To comply with Nigerian regulatory, taxation, and statutory requirements.
• Legitimate Interests: To prevent fraud, safeguard platform infrastructure, and optimize routing engines.
• Consent: Where you have explicitly opted in for specific services or direct communications.

5. Data Sharing & Third-Party Telcos

To deliver telecommunications and utility aggregation, we share necessary transaction payload details with:

• Mobile Network Operators (MNOs): MTN Nigeria, Airtel, Globacom, and 9mobile for network fulfillment of airtime, data, and SMS traffic.
• DISCOs & Utility Providers: Power distribution companies, cable television switches (MultiChoice, StarTimes), and water boards to credit bill tokens.
• Settlement & Financial Switches: NIBSS and licensed commercial banks for clearing merchant balances.
• Law Enforcement: Only upon valid judicial subpoena or formal regulatory directive under statutory Nigerian law.

We do not sell, rent, or trade your personal data to any third parties for advertising or commercial monetization.

6. Data Retention & Security

We apply enterprise security controls to protect your data from unauthorized access, loss, or alteration:

Financial and transaction records are retained for a minimum of five (5) to seven (7) years in compliance with the Money Laundering (Prevention and Prohibition) Act and Central Bank of Nigeria financial recordkeeping rules.

7. Your Rights as a Data Subject

Under the NDPA 2023, you possess the following actionable rights regarding your personal data:

• Right to Access: Request copies of the personal data held about you.
• Right to Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure: Request deletion of your data where statutory retention rules permit.
• Right to Object: Object to processing carried out under legitimate interest grounds.
• Right to Data Portability: Request transmission of your data in a structured, machine-readable format.

To exercise any of these rights, email our Data Protection Officer at dpo@cbidigitalmedia.com. Requests are responded to within thirty (30) days.

8. Cookies & Tracking Technologies

We use strictly necessary cookies to maintain session states, authenticate users, and enforce security policies. We also employ minimal aggregated analytics cookies to monitor platform performance and error rates. You can manage your cookie preferences through your browser settings.

9. Cross-Border Data Transfers

Whenever personal data is transferred or hosted outside Nigeria (such as via cloud infrastructure providers), we ensure adequate protection mechanisms are in place in accordance with Section 41 of the NDPA 2023, including standard contractual clauses and robust encryption standards.

10. Policy Updates

We may periodically update this Privacy Policy to reflect modifications to our services or changes in data protection legislation. When material updates are made, we will notify registered users via their account email or through a prominent banner on the dashboard.

11. Contact Our Data Protection Officer