Privacy Notice

1. About this notice

Wimika RMS Technologies Limited (“Wimika”, “we”, “us”) builds customer protection infrastructure for digital financial services. Our product, MoneyGuard, helps banks, fintechs and payment providers protect their customers before, during and after fraud.

This notice explains how personal information is handled in four different situations: when you visit this website, when you use MoneyGuard through a financial institution, when you report a suspected fraud incident, and when a claim is assessed. Who is responsible for your information differs between them, so section 3 sets that out before anything else.

This notice is issued under the Nigeria Data Protection Act 2023. Where MoneyGuard is provided through your bank or payment provider, that institution will also have its own privacy notice, which applies alongside this one.

2. Contact

For any question about this notice, or to exercise your rights, contact us at support@wimika.ng. Our Data Protection Officer can be reached at dpo@wimika.ng, on +234 813 444 0598, or at 4 Olatunbosun Street, Shonibare Estate, Maryland, Lagos, Nigeria.

Wimika RMS Technologies Limited, registered in Nigeria with number [RC NUMBER], registered office [REGISTERED OFFICE ADDRESS], Lagos, Nigeria.

3. Who is responsible for your information

Data protection law distinguishes between the party that decides why and how information is used (the controller) and a party that processes it on the controller’s instructions (a processor). Because MoneyGuard is provided through financial institutions and supported by an insurer, that role changes depending on the situation.

Where we act as a processor, the institution or insurer decides how your information is used. You can exercise your rights with them or with us, and we will help either way.

4. Information we handle

We handle only what is needed for the situation you are in. Not all of the categories below apply to every person.

• Contact and enquiry information. Your name, email address, phone number, organisation and role, and the content of any message you send us through this website.
• Account and protection information. Where MoneyGuard is active, the identifiers needed to link protection to your account with your provider, and your protection status.
• Device and application signals. Information about the device MoneyGuard runs on and the conditions it is operating under, device type and configuration, operating system, whether remote-access or screen-overlay software is present, and similar risk signals.
• Network and session context. Information about how the device is connected, such as network type and characteristics associated with known fraud conditions.
• Fraud incident information. What you tell us when you report an incident: what happened, when, the amount involved, the channel used, what you have already done, and any evidence you choose to provide.
• Claims information. Information needed to assess eligibility and, where a claim is approved, to arrange payment.

We do not ask for your PIN, password or one-time passcode, and we never will. Do not provide them to anyone who asks, including anyone claiming to be from Wimika or from your bank.

We do not collect or store card security codes. Where a payment is made, it is handled by a regulated payment provider and card details are not shared with us.

MoneyGuard does not read your emails or messages, does not access your photos or videos, and does not collect your browsing history.

5. Why we use it, and our legal basis

Under the Nigeria Data Protection Act we must have a lawful basis for each purpose. Ours are set out below.

Consent applies to marketing only. Withdrawing marketing consent does not stop protection, an open incident assessment or a claim in progress, because those rest on other bases. This is a deliberate change from our previous notice, which described consent as the basis for everything.

6. Who we share it with

• Your bank or payment provider. Where MoneyGuard is provided through them, so that protection, reporting and resolution work together.
• The insurer and risk partners. Where a claim is assessed or paid, for eligibility assessment, claims administration and reinsurance.
• Service providers. Cloud hosting, communications and support tools that process information on our instructions under written agreements.
• Authorities and legal process. Where we are required by law, or to establish, exercise or defend legal claims, or to prevent fraud or harm.
• In a corporate transaction. If our business or part of it is bought or merged, subject to the buyer honouring this notice.

We do not sell your personal information, and we do not share it with third parties for their own marketing.

7. Where your information is held

We are based in Lagos, Nigeria. Some of our service providers process information outside Nigeria. Where information is transferred across borders, we do so under the conditions permitted by the Nigeria Data Protection Act, including adequacy where recognised and standard contractual clauses or equivalent safeguards where not.

8. How long we keep it

We keep personal information only as long as needed for the purpose it was collected for, and then for as long as we are required to retain it by law or by insurance and financial-services record-keeping obligations. When it is no longer needed, it is deleted or anonymised.

9. How we protect it

We use encryption in transit and at rest, role-based access control, logging and monitoring, and we restrict access to those who need it for a defined purpose. We apply data minimisation and pseudonymise information where the purpose allows.

We test our systems, review our controls and maintain incident-response procedures. If a breach occurs that is likely to result in a risk to your rights, we will notify the Nigeria Data Protection Commission and, where required, you.

No system can be guaranteed completely secure. Please protect your own credentials and devices, and report anything suspicious promptly.

10. Your rights

Under the Nigeria Data Protection Act you have the right to:

• be informed about how your information is used;
• access a copy of the information we hold about you;
• have inaccurate or incomplete information corrected;
• have information deleted, where we are not required to keep it;
• restrict or object to certain processing;
• receive certain information in a portable format;
• withdraw consent where consent is the basis we rely on; and
• not be subject to a decision based solely on automated processing that significantly affects you, without human involvement.

MoneyGuard uses automated risk signals to identify conditions associated with fraud. Where those signals lead to an action affecting you, a person is involved in decisions about eligibility and claims, and you can ask for a decision to be reviewed by a person.

To exercise any right, contact support@wimika.ng. We may ask you to verify your identity. If MoneyGuard was provided through your bank or payment provider, we may need to direct your request to them, and we will tell you if so.

If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission.

11. Children

MoneyGuard is not intended for people under 18. We do not knowingly collect information about children except where they are included in a plan held by a parent or guardian who has consented. If you believe we hold information about a child in any other circumstances, contact support@wimika.ng and we will remove it.

12. Changes to this notice

We review this notice regularly and update it when our services or obligations change. The version and effective date are shown at the top of this page. Where a change materially affects you, we will tell you directly rather than relying on this page alone.