Data Notice

What This Notice Is

This is a short, plain language summary of how we handle your personal data. It does not replace our full Privacy Policy, which is available in the compliance documents section of the app. If anything in this notice differs from the Privacy Policy, the Privacy Policy takes priority.

The Data We Hold About You

We hold the following types of data about you:

• Your name, email, phone number, BVN, and government ID details.
• A selfie taken during onboarding for identity verification.
• Your bank account details for withdrawals.
• Your transaction history (deposits, withdrawals, trades).
• Your device type, app version, and IP address.
• Your order history and portfolio holdings.

What We Do With It

We use your data to:

• Verify your identity as required by law.
• Open and manage your investment account.
• Process your wallet funding and withdrawals.
• Route your orders to Blue Marina Securities for execution.
• Send you trade confirmations and security alerts.
• Keep records as required by SEC rules.
• Prevent fraud and keep the app secure.

What We Do Not Do With It

We do not:

• Sell your personal data to anyone.
• Use your biometric data for anything other than identity verification.
• Store your Face ID or fingerprint data. That stays only on your device.
• Share your data with anyone unless required by law or to run the platform.
• Send you marketing messages unless you opt in.

Where Your Data Is Stored

Your data is stored in Nigeria. Our hosting provider, FiberOps Tech, runs data centres in Lagos (primary) and Abuja (backup). Your data does not leave Nigeria for storage.

Some of our providers (SendGrid, Flutterwave, LumiID) may process data outside Nigeria as part of their service. Where this happens, we have written agreements in place to protect your data in line with the Nigeria Data Protection Act 2023.

How Long We Keep It

We keep your data for as long as your account is active. After your account is closed, we keep records for the periods required by SEC rules:

• Trade orders and wallet transactions: 12 years.
• Client communications: 7 years.
• Audit trail: 12 years.

After the retention period ends, your data is securely deleted or made anonymous.

How We Protect It

• All data is encrypted when it travels between your device and our servers.
• All stored data is encrypted.
• The most sensitive data (BVN, NIN, bank account numbers) has an extra layer of encryption.
• Only authorised staff can access your data, and every action they take is recorded in an audit trail that cannot be changed or deleted.
• We run regular security scans and will conduct independent penetration testing before production launch.

Your Rights

Under the Nigeria Data Protection Act 2023, you have the right to:

• Ask what data we hold about you.
• Ask us to correct wrong or out-of-date data.
• Ask us to delete your data (subject to our legal obligation to keep records).
• Ask for a copy of your data in a portable format.
• Object to certain types of processing.
• Withdraw your consent at any time.

To use any of these rights, contact us at support@kudimata.securities. We will respond within 30 days.

If Something Goes Wrong

If a data breach is likely to harm you, we will notify the Nigerian Data Protection Commission within 72 hours, as required by law. We will also tell you directly if the breach could affect your rights.

Who to Contact

For any questions about your data, contact us at support@kudimata.securities. You can also ask for our full Privacy Policy, which has more details about everything in this notice.

Changes to This Notice

We may update this notice from time to time. When we do, the new version will be published in the app. You will be asked to review and accept it at your next login.

Acceptance

By tapping “I Accept” in the app, you confirm that you have read and understood this Data Notice. Your acceptance is recorded with the date, time, device identifier, IP address, and the exact version of this document.