Kudimata Securities · Legal

Privacy Policy

Last updated 19 August 2026

Who We Are

Kudimata Securities Ltd. operates the Kudimata Invest app. We are a Nigerian company responsible for looking after your personal data. This Privacy Policy explains what data we collect, why we collect it, how we store it, with whom we share it, and what rights you have.

We have appointed a Data Protection Officer under Section 32 of the Nigeria Data Protection Act 2023. You can contact our Data Protection Officer at support@kudimata.securities.

What Data We Collect

When you use Kudimata Invest, we collect the following types of data:

Identity data: Your name, email address, phone number, Bank Verification Number (BVN), and government ID details (NIN, international passport, or driver’s licence number).

Biometric and liveness data: A live selfie taken within the app for identity verification. This is sent to our KYC provider (LumiID or Smile Identity) for automated checking. We do not use your biometric data for any other purpose.

Face ID and fingerprint data: If you turn on biometric unlock, your face or fingerprint data is stored only on your device. We never receive, access, or store this data. It never leaves your phone.

Financial data: Your bank account details for withdrawals, and your transaction history (deposits, withdrawals, trades).

Device data: Your device type, app version, IP address, and usage logs. This helps us keep the app secure and fix problems.

Transaction data: Your orders, fills, cancellations, wallet funding, and withdrawal records.

Why We Collect It

We collect your data for these reasons:

  • To verify your identity as required by law and SEC rules.
  • To open and manage your investment account.
  • To process your wallet funding and withdrawals.
  • To route your orders to our sponsoring broker for execution.
  • To send you trade confirmations and service notifications.
  • To comply with SEC rules on record keeping.
  • To keep the app secure and prevent fraud.

We process your data under the Nigeria Data Protection Act 2023. Our legal bases are:

  • Contract: We need your data to open and manage your account and process your trades.
  • Legal obligation: SEC rules require us to verify your identity, keep records, and report transactions.
  • Consent: You consent to our use of your data when you accept this Privacy Policy during onboarding. You can withdraw your consent at any time by contacting us, though we may still need to keep some data to meet our legal obligations.

Whom We Share Your Data With

We share your data with the following providers to run the platform:

LumiID (and Smile Identity as an alternate): Receives your BVN, NIN, ID document images, and liveness selfie for identity verification.

Flutterwave: Receives your payment details to process wallet funding and withdrawals.

AWS SNS: Receives your email address to send you transactional emails like trade confirmations and one-time passcodes.

Blue Marina Securities Limited: Receives your order details to execute trades on the NGX on your behalf.

FiberOps Tech: Hosts your data in their data centres in Nigeria. They do not access your data directly.

Cloudflare: Provides security and content delivery. They may see your IP address, but do not access your account data.

We will never sell your personal data. We will only share it with regulators if required by law.

Data Hosting in Nigeria

All your primary data is hosted within Nigeria. Our hosting provider, FiberOps Tech, runs data centres in Lagos (primary) and Abuja (disaster recovery). Your data does not leave Nigeria for storage.

Data Processed Outside Nigeria

Some of our providers (SendGrid, Flutterwave, LumiID) may process data outside Nigeria as part of their service. Where this happens, we have written agreements in place with them that include data protection clauses. These agreements follow sections 41 to 43 of the Nigeria Data Protection Act 2023. We have also carried out transfer impact assessments for each provider.

How Long Do We Keep Your Data

We keep your data for as long as your account is active and for the periods required by SEC rules:

  • Trade orders, transactions: 12 years.
  • Client communications: 7 years.
  • Audit trail: 12 years.
  • KYC records: for the life of the account plus the period required by SEC rules.

When the retention period ends, data is securely deleted or anonymised.

Security Controls

We take the security of your data seriously. Here is what we do:

  • All data is encrypted when it travels between your device and our servers (TLS 1.3).
  • All data is encrypted when stored (AES 256).
  • The most sensitive data (BVN, NIN, date of birth, bank account numbers) is protected with an extra layer of encryption so that even our database administrators cannot read it.
  • Personally identifiable information is removed from logs before they are stored.
  • Access to your data is restricted to authorised staff only, and every staff action is recorded in an audit trail that cannot be edited or deleted.
  • We run regular security scans and will conduct independent penetration testing before production launch.

Your Rights Under the Nigeria Data Protection Act 2023

You have the following rights:

  • Right to access: You can ask us what data we hold about you.
  • Right to rectification: You can ask us to correct data that is wrong or out of date.
  • Right to erasure: You can ask us to delete your data, subject to our legal obligation to keep records.
  • Right to data portability: You can ask us to give you a copy of your data in a format you can take to another provider.
  • Right to object: You can object to us processing your data for certain purposes.
  • Right to withdraw consent: You can withdraw your consent at any time by contacting us.

To exercise any of these rights, contact us at support@kudimata.securities. We will respond within 30 days.

If you are not happy with how we handle your data, you can file a complaint with the Nigerian Data Protection Commission.

Marketing and Notifications

We will send you service notifications (like trade confirmations and security alerts) because they are necessary to run your account. We will not send you marketing messages unless you opt in. You can change your notification preferences in the app at any time.

Data Breach Notification

If a data breach is likely to harm you, we will notify the Nigeria Data Protection Commission within 72 hours, as required by Section 40 of the NDPA 2023. We will also tell you directly if the breach is likely to affect your rights or freedoms.

Changes to This Policy

We may update this policy from time to time. When we do, the new version will be published in the app with a new version number and effective date. You will be asked to review and accept the updated version at your next login. The previous version you accepted will be kept in the audit trail.

Acceptance

By tapping “I Accept” in the app, you confirm that you have read, understood, and agreed to this Privacy Policy. Your acceptance is recorded with the date, time, device identifier, IP address, and the exact version of this document.

Document Version: 1.0 Effective Date: 17 August 2026 Owner: Kudimata Securities Ltd.