BPRIME ASSETS LIMITED

Operator of the BPrime X Platform (x.bprimeassets.com)

Privacy Policy

BPrime X — a platform of BPrime Assets Limited

Legal Entity	BPrime Assets Limited (“BPrime”, “the Company”, “we”, “us”, or “our”)
Platform	BPrime X — x.bprimeassets.com
Corporate Site	bprimeassets.com
Jurisdiction	Federal Republic of Nigeria
Effective Date	6 July 2026
Version	Version 1.0
Contact	legal@bprimeassets.com

Table of Contents

1. Introduction

BPrime Assets Limited (“BPrime”, “the Company”, “we”, “us”, or “our”) is a company incorporated under the laws of the Federal Republic of Nigeria, operating the BPrime X platform accessible at x.bprimeassets.com (the “Platform”), together with our corporate website at bprimeassets.com and any related applications, dashboards, application programming interfaces, or services that link to this Policy (collectively, the “Services”).

This Privacy Policy (“Policy”) explains how we collect, use, disclose, retain, transfer, and protect Personal Data belonging to individuals who access or use the Services, including registered users, prospective users, and visitors to our websites (“you” or “User”).

This Policy is issued in compliance with the Nigeria Data Protection Act, 2023 (“NDPA”), the Nigeria Data Protection Commission’s General Application and Implementation Directive, 2025 (“GAID”), and, to the extent applicable, other recognised international data protection frameworks and best practices. By accessing or using the Services, you acknowledge that you have read and understood this Policy.

BPrime Assets Limited acts as the Data Controller in respect of Personal Data processed through the Services, unless expressly stated otherwise. Where we process Personal Data on behalf of another entity within the BPrime ecosystem, we act as a Data Processor and this is disclosed to affected Users where relevant.

2. Definitions and Interpretation

In this Policy, the following terms have the meanings set out below, and cognate expressions bear corresponding meanings:

Personal Data	Any information relating to an identified or identifiable natural person, including information capable of directly or indirectly identifying a Data Subject, as defined under the NDPA.
Sensitive Personal Data	Personal Data relating to an individual’s genetic and biometric data, health, sex life, sexual orientation, religious or similar beliefs, race or ethnicity, trade union membership, political opinions, or criminal history, as defined under the NDPA.
Data Subject	The individual to whom Personal Data relates, including a User of the Services.
Data Controller	The entity that determines the purposes and means of processing Personal Data.
Data Processor	An entity that processes Personal Data on behalf of, and on the instructions of, a Data Controller.
Processing	Any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, or erasure.
Platform / BPrime X	The digital platform operated by BPrime Assets Limited at x.bprimeassets.com through which Users may fund and manage their own personal or business projects.
Account	A registered profile created by a User to access and use the Services.
SSO	The Single Sign-On authentication mechanism used across the BPrime ecosystem, allowing a single set of credentials to authenticate a User across multiple BPrime-affiliated platforms.
Payment Processor	Paystack Payments Limited, or any successor payment service provider engaged by BPrime to process transactions on the Platform.
NDPC	The Nigeria Data Protection Commission, the statutory body responsible for the administration of the NDPA.

3. Scope and Application

3.1 Who This Policy Covers

This Policy applies to all natural persons who visit, register on, or otherwise interact with the Services, including Users of BPrime X and visitors to bprimeassets.com. It does not apply to the personal data of corporate entities as such, though it does apply to natural persons acting as representatives, directors, or beneficial owners of corporate Users where such information is collected.

3.2 Minimum Age

The Services are intended solely for individuals who are eighteen (18) years of age or older. We do not knowingly collect Personal Data from individuals under the age of eighteen (18). If we become aware that we have inadvertently collected Personal Data from a minor, we will take reasonable steps to delete such data promptly and, where necessary, suspend the associated Account.

3.3 Nature of the Platform

BPrime X currently enables Users to fund, track, and manage projects that they themselves create and control. The Platform does not, as at the Effective Date of this Policy, facilitate public investment by Users in third-party projects, and no Personal Data is processed for the purpose of matching Users as investors with other Users’ projects. Should this business model change, this Policy will be updated in accordance with Section 15 (Changes to This Policy) prior to any such feature becoming available.

4. Personal Data We Collect

4.1 Data You Provide Directly

We collect Personal Data that you voluntarily provide when you:

• Register for an Account, including via Single Sign-On across the BPrime ecosystem;
• Complete identity verification and Know-Your-Customer (KYC) procedures;
• Create, fund, or manage a project on the Platform;
• Initiate or receive payments through our integrated Payment Processor, Paystack;
• Communicate with our support, compliance, or legal teams;
• Subscribe to newsletters, respond to surveys, or participate in promotions;
• Submit documents, complaints, or feedback through the Services.

Such Personal Data may include, without limitation:

• Full legal name, date of birth, gender, and nationality;
• Contact details, including email address, telephone number, and residential address;
• Means of identification, such as Bank Verification Number (BVN), National Identification Number (NIN), voter’s card, international passport, or driver’s licence details, to the extent required for identity verification;
• Financial information, including bank account details, transaction history, and project funding records (noting that full card details are collected and processed directly by Paystack, not by BPrime);
• Account credentials and SSO identifiers;
• Correspondence and any information you choose to submit through support channels.

4.2 Data Collected Automatically

When you access or use the Services, we and our service providers may automatically collect certain technical and usage information, including:

• Device information (device type, operating system, unique device identifiers);
• Log data (IP address, browser type, access times, pages viewed, referring URLs);
• Location information derived from IP address or, where permitted, device settings;
• Cookies and similar tracking technologies, as further described in our Cookie Policy.

4.3 Data Received from Third Parties

We may receive Personal Data about you from:

• Our Payment Processor (Paystack), including transaction status, payment confirmation, and fraud-risk indicators;
• Identity verification providers engaged for KYC and Anti-Money Laundering (AML) purposes;
• Other platforms within the BPrime ecosystem, where you have authenticated via SSO and consented to data sharing for a unified user experience;
• Regulatory authorities, credit reference agencies, or law enforcement, where lawfully required.

4.4 Sensitive Personal Data

We do not, as a matter of policy, seek to collect Sensitive Personal Data. Where identity verification documents incidentally reveal data such as religion (in some national identification formats), we process such incidental data solely for identity confirmation purposes, under the lawful basis described in Section 5, and do not use it for profiling or any secondary purpose.

5. Lawful Basis for Processing

In accordance with Section 24 of the NDPA, we process your Personal Data only where one or more of the following lawful bases applies:

• Consent — where you have given clear, specific, and informed consent to the processing, such as for marketing communications or optional profiling.
• Contractual Necessity — where processing is necessary to perform our Terms of Use with you, including account creation, project management, and payment facilitation.
• Legal Obligation — where processing is necessary to comply with an obligation under Nigerian law, including AML/CFT regulations, tax law, and NDPC directives.
• Vital Interests — in the rare circumstance where processing is necessary to protect your life or physical safety.
• Public Interest — where processing is necessary for functions carried out in the public interest, such as fraud prevention reporting to competent authorities.
• Legitimate Interests — where processing is necessary for our legitimate interests, such as platform security, service improvement, and prevention of fraud, provided such interests are not overridden by your fundamental rights and freedoms.

6. How We Use Your Personal Data

We use Personal Data for the following purposes:

6.1 Account and Service Delivery

• Creating and administering your Account, including SSO authentication across the BPrime ecosystem;
• Enabling you to create, fund, and manage your own projects on the Platform;
• Processing payments and disbursements through Paystack;
• Providing customer support and responding to enquiries.

6.2 Verification, Security, and Compliance

• Verifying your identity in accordance with KYC and AML obligations;
• Detecting, investigating, and preventing fraud, unauthorised access, and other unlawful activity;
• Complying with applicable Nigerian laws, regulatory directives, and lawful requests from competent authorities;
• Maintaining records as required for audit, tax, and regulatory purposes.

6.3 Service Improvement and Communication

• Analysing usage patterns to improve Platform functionality, reliability, and user experience;
• Sending service-related notifications (e.g., transaction confirmations, security alerts, policy updates);
• With your consent, sending marketing or promotional communications, which you may opt out of at any time.

We do not use your Personal Data for automated decision-making that produces legal or similarly significant effects concerning you without appropriate human oversight, safeguards, and, where required, your explicit consent.

7. Disclosure of Personal Data

We do not sell your Personal Data. We may disclose Personal Data to the following categories of recipients, strictly on a need-to-know basis and subject to appropriate contractual safeguards:

• Identity verification, KYC, and AML screening providers engaged to satisfy our regulatory obligations;
• Cloud hosting, data storage, and information technology service providers who process data on our behalf under written data processing agreements;
• Affiliated companies within the BPrime ecosystem, solely to the extent necessary to support SSO functionality and a consistent cross-platform experience, and subject to the same standard of protection as set out in this Policy;
• Regulators, law enforcement agencies, courts, or other governmental authorities, where disclosure is required or permitted by law;
• Professional advisers, including legal counsel and auditors, bound by obligations of confidentiality;
• A successor entity in the event of a merger, acquisition, restructuring, or sale of assets, subject to equivalent data protection commitments.

Where we engage a Data Processor to process Personal Data on our behalf, we impose contractual obligations requiring that Processor to implement appropriate technical and organisational measures consistent with the NDPA and this Policy.

8. International Data Transfers

Certain service providers we engage, including cloud infrastructure and payment processing partners, may process Personal Data on servers located outside Nigeria. Where we transfer Personal Data outside Nigeria, we do so only where:

• the recipient jurisdiction is subject to an adequacy decision or equivalent determination recognised by the NDPC; or
• appropriate safeguards, such as standard contractual clauses, binding corporate rules, or equivalent mechanisms recognised under the NDPA, have been put in place; or
• the transfer is otherwise permitted under an exception or derogation recognised by the NDPA, including with your explicit consent after being informed of the possible risks of such transfer.

We conduct due diligence on cross-border processors to ensure that Personal Data transferred outside Nigeria continues to receive a standard of protection consistent with this Policy and the NDPA.

9. Data Retention

We retain Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, KYC/AML, or reporting requirements. As a general guide:

• Account and identity verification records are retained for the duration of your Account’s existence and for a minimum period thereafter as required under applicable AML/CFT regulations (typically not less than five (5) years following account closure);
• Transaction and payment records are retained in accordance with financial record-keeping obligations under Nigerian law;
• Support correspondence is retained for as long as reasonably necessary to resolve the matter and defend any related claims;
• Marketing consent records are retained until consent is withdrawn, plus a reasonable period to evidence compliance.

Upon expiry of the applicable retention period, we securely delete, anonymise, or aggregate Personal Data such that it can no longer be used to identify you, unless a longer retention period is required or permitted by law.

10. Your Rights as a Data Subject

Subject to applicable exceptions under the NDPA, you have the right to:

• Access — request confirmation of whether we process your Personal Data and obtain a copy of it;
• Rectification — request correction of inaccurate or incomplete Personal Data;
• Erasure — request deletion of your Personal Data where it is no longer necessary for the purposes collected, or where processing is unlawful;
• Restriction — request that we limit the processing of your Personal Data in certain circumstances;
• Data Portability — request a copy of Personal Data you have provided to us in a structured, commonly used, machine-readable format;
• Objection — object to processing based on legitimate interests or for direct marketing purposes;
• Withdrawal of Consent — withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• Lodge a Complaint — lodge a complaint with the Nigeria Data Protection Commission (NDPC) or other competent supervisory authority.

To exercise any of these rights, please contact us at legal@bprimeassets.com. We will respond to verified requests within the timeframes prescribed by the NDPA, generally within one (1) month of receipt, subject to extension where permitted by law for complex requests. We may request additional information to verify your identity before acting on a request.

11. Data Security

We implement appropriate technical and organisational measures designed to protect Personal Data against unauthorised access, alteration, disclosure, or destruction, proportionate to the risk involved. These measures are described in greater detail in our Security & Data Protection Statement and include encryption in transit and at rest, access controls, network monitoring, and periodic security assessments.

No system is entirely immune from risk. In the event of a Personal Data breach likely to result in a risk to your rights and freedoms, we will notify the NDPC and affected Data Subjects in accordance with the timelines and procedures prescribed under the NDPA.

12. Cookies and Tracking Technologies

The Services use cookies and similar technologies to operate, secure, and improve the Platform, and to understand usage patterns. Full details of the categories of cookies used, their purposes, and how you may manage your preferences are set out in our Cookie Policy, which forms part of this Policy by reference.

13. Marketing Communications

Where you have consented to receive marketing communications from us, you may withdraw such consent at any time by using the unsubscribe mechanism included in such communications or by contacting legal@bprimeassets.com. Withdrawal of marketing consent will not affect service-related communications necessary for the operation of your Account.

14. Third-Party Links and Services

The Services may contain links to third-party websites or integrate with third-party services, including Paystack and other BPrime-affiliated platforms accessed via SSO. This Policy does not apply to the privacy practices of such third parties, and we encourage you to review their respective privacy policies. We are not responsible for the content or privacy practices of third-party websites.

15. Data Protection Officer

In accordance with the NDPA, BPrime has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and applicable data protection law. You may contact our DPO at legal@bprimeassets.com regarding any data protection matter, including the exercise of your rights under Section 10.

16. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, legal or regulatory requirements, or the functionality of the Services, including any future expansion of BPrime X to facilitate third-party project investment. Material changes will be notified to you through the Platform or by email prior to taking effect. The “Effective Date” at the top of this Policy indicates when it was last revised. Your continued use of the Services after such changes take effect constitutes acceptance of the revised Policy.

17. Contact Us

If you have questions, concerns, or requests regarding this Policy or our data processing practices, please contact:

BPrime Assets Limited — Legal & Compliance Department

Email: legal@bprimeassets.com

Platform: x.bprimeassets.com

Corporate Website: bprimeassets.com