Privacy Policy – BPrime Projects

BPRIME ASSETS LIMITED

Operator of the BPrime X Platform (x.bprimeassets.com)

Privacy Policy

BPrime Projects — a platform of BPrime Assets Limited

Legal Entity	BPrime Assets Limited (“BPrime”, “the Company”, “we”, “us”, or “our”)
Platform	BPrime Projects — projects.bprimeassets.com
Corporate Site	bprimeassets.com
Jurisdiction	Federal Republic of Nigeria
Effective Date	6 July 2026
Version	Version 1.0
Contact	legal@bprimeassets.com

Table of Contents

1. Introduction

BPrime Assets Limited (“BPrime”, “the Company”, “we”, “us”, or “our”) is a company incorporated under the laws of the Federal Republic of Nigeria, operating the BPrime Projects platform accessible at projects.bprimeassets.com (the “Platform”), together with our corporate website at bprimeassets.com and any related applications, dashboards, application programming interfaces, or services that link to this Policy (collectively, the “Services”).

BPrime Projects enables Users to create, fund, and manage their own projects, including planning and tracking project milestones, processing project-related payments, and generating and managing contracts and agreements connected with their projects (for example, with vendors, contractors, suppliers, or collaborators engaged by the User in connection with their Project).

This Privacy Policy (“Policy”) explains how we collect, use, disclose, retain, transfer, and protect Personal Data belonging to individuals who access or use the Services, including registered Users, prospective Users, individuals named as counterparties in contracts created on the Platform, and visitors to our websites (“you” or “Data Subject”).

This Policy is issued in compliance with the Nigeria Data Protection Act, 2023 (“NDPA”), the Nigeria Data Protection Commission’s General Application and Implementation Directive, 2025 (“GAID”), and, to the extent applicable, other recognised international data protection frameworks and best practices.

BPrime Assets Limited acts as the Data Controller in respect of Personal Data processed to operate the Services generally (such as Account and payment data). Where a User inputs Personal Data relating to a third party into the Platform — for example, the name and contact details of a contractor named in a contract — BPrime acts as a Data Processor on behalf of that User in respect of such third-party data, processing it solely on the User’s instructions and for the purpose of generating, storing, and managing the relevant contract or project record. The User remains the Data Controller in respect of any such third-party Personal Data they input, and is responsible for ensuring they have a lawful basis to share it with us.

2. Definitions and Interpretation

Personal Data	Any information relating to an identified or identifiable natural person, as defined under the NDPA.
Sensitive Personal Data	Personal Data relating to health, biometric or genetic data, sex life, religion, race, political opinion, trade union membership, or criminal history, as defined under the NDPA.
Data Subject	The individual to whom Personal Data relates, including a User or a third party named in Project-related content, such as a contract counterparty.
Data Controller	The entity that determines the purposes and means of processing Personal Data.
Data Processor	An entity that processes Personal Data on behalf of, and on the instructions of, a Data Controller.
Platform / BPrime Projects	The platform operated by BPrime Assets Limited at projects.bprimeassets.com, enabling Users to create, fund, manage, and contract in relation to their own projects.
Project	A funding, planning, or management initiative created and controlled by a User for the User’s own purposes.
Contract Tools	The features of the Platform that allow Users to generate, populate, store, share, and (where enabled) electronically sign contracts and agreements relating to their Project.
Contract Counterparty	A third party named in a contract or agreement created using the Contract Tools, such as a vendor, contractor, supplier, or collaborator engaged by a User.
SSO	The Single Sign-On authentication mechanism used across the BPrime ecosystem.
Payment Processor	Paystack Payments Limited, or any successor licensed payment service provider engaged by BPrime.
NDPC	The Nigeria Data Protection Commission.

3. Scope and Application

3.1 Who This Policy Covers

This Policy applies to natural persons who visit, register on, or otherwise interact with the Services, including Users of BPrime Projects, individuals whose Personal Data is entered by a User as a Contract Counterparty, and visitors to bprimeassets.com.

3.2 Minimum Age

The Services are intended solely for individuals eighteen (18) years of age or older. We do not knowingly collect Personal Data from individuals under eighteen (18). If we become aware of such collection, we will take reasonable steps to delete the data promptly and, where necessary, suspend the associated Account.

3.3 Nature of the Platform

BPrime Projects enables Users to fund and manage projects that they themselves create and control, and to generate contracts connected with those projects. The Platform does not, as at the Effective Date of this Policy, facilitate public investment by Users in third-party projects. Should this business model change, this Policy will be updated in accordance with Section 15 (Changes to This Policy).

4. Personal Data We Collect

4.1 Data You Provide Directly

We collect Personal Data that you voluntarily provide when you:

Register for an Account, including via Single Sign-On across the BPrime ecosystem;
Complete identity verification (KYC) procedures;
Create, fund, or manage a Project;
Initiate or receive payments through our Payment Processor, Paystack;
Use the Contract Tools to draft, populate, store, or execute a contract, including entering the name, contact details, and role of a Contract Counterparty;
Communicate with our support, compliance, or legal teams.

Such Personal Data may include, without limitation:

Full legal name, date of birth, gender, and nationality;
Contact details, including email address, telephone number, and residential or business address;
Means of identification, such as Bank Verification Number (BVN), National Identification Number (NIN), voter’s card, international passport, or driver’s licence details, to the extent required for identity verification;
Financial information, including bank account details, transaction history, invoicing information, and project budgets;
Contract content, including the identity, contact details, fee arrangements, and obligations of Contract Counterparties named by the User;
Electronic signature data, including signature images or cryptographic signing metadata, timestamps, and IP addresses associated with contract execution;
Account credentials and SSO identifiers.

4.2 Data Collected Automatically

We and our service providers may automatically collect technical and usage information, including device information, log data (IP address, browser type, access times), and cookies, as further described in our Cookie Policy.

4.3 Data Received from Third Parties

Our Payment Processor (Paystack), including transaction status and fraud-risk indicators;
Identity verification providers engaged for KYC and AML purposes;
Other platforms within the BPrime ecosystem, where you have authenticated via SSO;
Regulatory authorities or law enforcement, where lawfully required.

4.4 Data Relating to Contract Counterparties

Where a User enters Personal Data relating to a Contract Counterparty (for example, a contractor’s name, address, or bank details for payment purposes), we process that data solely to enable the User to generate, store, and manage the relevant contract and any associated payment, and for no other purpose, unless the Contract Counterparty separately becomes a User of the Platform in their own right.

4.5 Sensitive Personal Data

We do not, as a matter of policy, seek to collect Sensitive Personal Data. Where identity or verification documents incidentally reveal such data, we process it solely for identity confirmation and do not use it for profiling or any secondary purpose.

5. Lawful Basis for Processing

In accordance with Section 24 of the NDPA, we process Personal Data only where one or more of the following lawful bases applies:

Consent — for optional features such as marketing communications.
Contractual Necessity — to perform our Terms of Use with you, including account creation, Project management, Contract Tools, and payment facilitation.
Legal Obligation — to comply with AML/CFT regulations, tax law, and NDPC directives.
Legitimate Interests — for Platform security, fraud prevention, and service improvement, and, in respect of Contract Counterparty data, the User’s legitimate interest in documenting and administering their own contractual relationships, provided such interests are not overridden by the Data Subject’s rights.
Vital Interests / Public Interest — in limited circumstances such as protecting life or reporting fraud to competent authorities.

6. How We Use Your Personal Data

6.1 Account and Service Delivery

Creating and administering your Account, including SSO authentication;
Enabling you to create, fund, and manage your own Projects;
Providing and operating the Contract Tools, including template population, storage, retrieval, and, where enabled, electronic signature capture;
Processing payments and disbursements through Paystack, including payments due to Contract Counterparties under a User’s contract;
Providing customer support.

6.2 Verification, Security, and Compliance

Verifying identity in accordance with KYC and AML obligations;
Detecting, investigating, and preventing fraud, unauthorised access, and other unlawful activity, including in relation to contract execution;
Complying with Applicable Law and lawful requests from competent authorities;
Maintaining records, including executed contracts, for audit, evidentiary, tax, and regulatory purposes.

6.3 Service Improvement and Communication

Analysing usage patterns to improve Platform functionality;
Sending service-related notifications (e.g., contract execution confirmations, payment receipts, security alerts);
With consent, sending marketing communications, which you may opt out of at any time.

We do not use Personal Data for automated decision-making producing legal or similarly significant effects without appropriate human oversight and, where required, your explicit consent.

7. Disclosure of Personal Data

We do not sell Personal Data. We may disclose Personal Data to the following categories of recipients, on a need-to-know basis and subject to appropriate contractual safeguards:

Paystack Payments Limited and other licensed payment service providers, to process transactions initiated on the Platform, including payments to Contract Counterparties;
Identity verification, KYC, and AML screening providers;
Cloud hosting, data storage, e-signature, and information technology service providers who process data on our behalf under written data processing agreements;
Affiliated companies within the BPrime ecosystem, solely to support SSO functionality and a consistent cross-platform experience;
Regulators, law enforcement, courts, or other governmental authorities, where required or permitted by law, including where a contract generated on the Platform becomes the subject of a legal or regulatory dispute;
Professional advisers, including legal counsel and auditors, bound by confidentiality obligations;
A successor entity in the event of a merger, acquisition, or sale of assets, subject to equivalent data protection commitments.

Contract content and any Personal Data of Contract Counterparties contained within it are disclosed only as necessary to fulfil the purposes described in this Policy, to the parties to the relevant contract themselves, and are not shared with unrelated third parties.

8. International Data Transfers

Certain service providers we engage, including cloud infrastructure, e-signature, and payment processing partners, may process Personal Data on servers located outside Nigeria. Where we transfer Personal Data outside Nigeria, we do so only where:

the recipient jurisdiction is subject to an adequacy decision or equivalent determination recognised by the NDPC; or
appropriate safeguards, such as standard contractual clauses or binding corporate rules recognised under the NDPA, have been put in place; or
the transfer is otherwise permitted under an exception or derogation recognised by the NDPA, including with explicit consent after being informed of the risks.

9. Data Retention

We retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, KYC/AML, and evidentiary requirements. As a general guide:

Account and identity verification records are retained for the duration of your Account and for a minimum period thereafter as required under applicable AML/CFT regulations (typically not less than five (5) years following account closure);
Executed contracts and associated audit trails (including e-signature metadata) are retained for the duration of the underlying contractual relationship and for such further period as may be necessary to preserve evidentiary value in the event of a dispute, and in any event consistent with the limitation periods applicable to contractual claims under Nigerian law;
Transaction and payment records are retained in accordance with financial record-keeping obligations under Nigerian law;
Support correspondence is retained for as long as reasonably necessary to resolve the matter and defend any related claims.

Upon expiry of the applicable retention period, we securely delete, anonymise, or aggregate Personal Data such that it can no longer identify you, unless a longer period is required or permitted by law.

10. Your Rights as a Data Subject

Subject to applicable exceptions under the NDPA, you have the right to:

Access — request confirmation of whether we process your Personal Data and obtain a copy;
Rectification — request correction of inaccurate or incomplete Personal Data;
Erasure — request deletion where no longer necessary or where processing is unlawful, subject to our record-keeping obligations in respect of executed contracts;
Restriction — request that we limit processing in certain circumstances;
Data Portability — request a copy of Personal Data you provided, in a structured, machine-readable format;
Objection — object to processing based on legitimate interests or direct marketing;
Withdrawal of Consent — withdraw consent at any time, without affecting prior lawful processing;
Lodge a Complaint — with the Nigeria Data Protection Commission (NDPC) or other competent authority.

Where you are a Contract Counterparty (rather than a registered User) and wish to exercise a right in respect of Personal Data entered about you by a User, please contact us at legal@bprimeassets.com; as we act as a Data Processor in respect of such data, we may direct your request to the relevant User (as Data Controller) or assist in fulfilling it on their instruction, as appropriate.

To exercise your rights, contact legal@bprimeassets.com. We will respond to verified requests within the timeframes prescribed by the NDPA, generally within one (1) month, subject to extension where permitted for complex requests.

11. Data Security

We implement appropriate technical and organisational measures to protect Personal Data, including contract content and e-signature records, against unauthorised access, alteration, disclosure, or destruction, proportionate to risk. These measures are described further in our Security & Data Protection Statement.

In the event of a Personal Data breach likely to result in a risk to your rights and freedoms, we will notify the NDPC and affected Data Subjects in accordance with the timelines and procedures prescribed under the NDPA.

12. Cookies and Tracking Technologies

The Services use cookies and similar technologies as described in our Cookie Policy, which forms part of this Policy by reference.

13. Marketing Communications

Where you have consented to receive marketing communications, you may withdraw consent at any time via the unsubscribe mechanism in such communications or by contacting legal@bprimeassets.com.

14. Third-Party Links and Services

The Services may link to or integrate with third-party services, including Paystack, e-signature or document infrastructure providers, and other BPrime-affiliated platforms accessed via SSO. This Policy does not apply to the privacy practices of such third parties.

15. Data Protection Officer

BPrime has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy. You may contact our DPO at legal@bprimeassets.com.

16. Changes to This Policy

We may update this Policy to reflect changes in our practices, legal or regulatory requirements, or Platform functionality, including any future expansion of BPrime Projects to facilitate third-party project investment. Material changes will be notified through the Platform or by email prior to taking effect.

17. Contact Us

BPrime Assets Limited — Legal & Compliance Department

Email: legal@bprimeassets.com

Platform: projects.bprimeassets.com

Corporate Website: bprimeassets.com