Privacy
Notice

1. Who we are

The challenge (Ibadan) Growth circle cooperative investment and credit society Limited ("Mayana", "we", "us"), Registration No. 27097, of No 42, Royal House, Anfani Layout, Anfani, Ibadan, Nigeria, is the data controller for the personal data described in this notice. Mayana Moni, Mayana Agro, Mayana Qara, Mayana Vesti and Mayana Homes are names of our products.

Mayana Technologies Limited (RC 9826229) builds and runs our website and systems. It processes personal data only on our behalf and on our instructions, as our data processor.

Our Data Protection Officer is Oshomo Oforomeh, Technical Adviser. You can contact them by email at [email protected] or by post at 19 CMD Road, Lagos, Nigeria.

2. What this notice covers

This notice explains how we handle the personal data of members, people applying to become members, guarantors and visitors to our website, in line with the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive 2025 (GAID) issued by the Nigeria Data Protection Commission (NDPC).

This notice is separate from our Terms and Conditions.

3. The personal data we collect

• Identity: full name, date of birth, sex, National Identification Number (NIN), your ID document and its type, and your photograph.
• Contact: phone numbers, email address, home address and office address.
• Employment and income: employment status and, when you apply for a loan, your monthly salary and proof of income.
• Loan applications: the product, amount and term you apply for, and your guarantor's member number where a guarantor is needed.
• Financial: the bank accounts you register with us, the name your bank holds for each account, the money you send us and the transfers' details, your balances, savings, loans, repayments and withdrawals.
• Sign-in and security: your login code, which we store only in a protected form that we cannot read, and the internet address (IP address) and browser details of each sign-in.
• Website use: the pages you visit and how you use them, including recordings of how you move around the website, as described in the cookies section below.

4. How we collect it

• From you, when you apply for membership, complete your profile, apply for a loan or use our services.
• Automatically, when you use the website and sign in.
• From our payment provider, when you send money to us, and when we check the name on a bank account you register.
• From you about other people, such as your guarantor. Please tell them you have shared their details with us.

5. Why we use it, and on what legal basis

• To provide our services under our agreement with you: to consider your membership, run your Main Account and Savings Products, assess and manage loans, process withdrawals and contact you about your account.
• To comply with the law: to verify your identity, prevent and report money laundering and fraud, deduct tax where required and respond to lawful requests from authorities.
• For our legitimate interests: to keep accounts and the website secure, prevent fraud, recover money owed to us and improve our services, where those interests are not outweighed by your rights.
• With your consent: for website analytics and for any marketing we send you. You can withdraw your consent at any time.

6. Automated checks and decisions

Some checks are made automatically:

• Your verification level, and the limits that come with it, are set automatically from the identity and address checks you have completed.
• Whether you can open a Savings Product is checked automatically against its minimum age and required verification level.
• We calculate a credit score from your repayment history and the verification you have completed.

Loan applications are reviewed by our staff, not decided by a computer alone. If an automated check affects you, you may ask for a person to review it and explain it.

7. Who we share it with

We do not sell your personal data. We share it only with:

• Mayana Technologies Limited, which runs our website and systems on our behalf
• our cloud hosting, content delivery and file storage providers, which host our website and systems and store the documents and photographs you upload
• a service that monitors our systems for errors
• Africa’s Talking and BulkSMS Nigeria, which send our SMS messages, such as verification and reset codes and repayment reminders
• Resend, which sends our emails
• Nomba, our payment provider, which receives money sent to us and confirms the name on a bank account
• Google, which hosts the form for requesting a Mayana Qara product
• PostHog, which provides our website analytics
• your guarantor, our recovery agents and our lawyers, where a loan is overdue
• regulators, law enforcement agencies and courts, where the law requires us to

Each service provider may use your data only to provide its service to us and must keep it secure.

8. Transfers outside Nigeria

Our website, systems and the documents you upload are hosted outside Nigeria. Some of our service providers process data in other countries, such as the United States, depending on where they run their services. Where this happens, we rely on a lawful basis for the transfer under the NDPA and the GAID, such as adequate protection in the receiving country or contractual safeguards.

9. How long we keep it

• Membership, identity, transaction and loan records: for as long as you are a member, so you can always see your history, and for 5 years after your membership ends, in line with the law on preventing money laundering. Longer only while a dispute is open.
• An account application that cannot be completed: deleted straight away, or within one day if something goes wrong.
• Website analytics: for 30 days.

10. How we protect it

We protect your data with technical and organisational measures, including encryption and access limited to staff who need it.

11. Your rights

Under the NDPA, you have the right to:

• be told how we use your personal data, as this notice does
• get a copy of the personal data we hold about you
• have inaccurate data corrected
• have your data deleted where we no longer need to keep it by law
• restrict or object to how we use it
• receive your data in a commonly used format, or have it sent to another provider
• withdraw your consent where we rely on it
• not be subject to a decision based only on automated processing that significantly affects you

To use any of these rights, contact our Data Protection Officer. We will respond within 30 days.

12. Cookies and similar technologies

Our website uses cookies that keep you signed in. They are essential for the member portal to work and expire when you sign out or after 7 days without use.

Our website analytics, including recordings of how you use the website, runs only if you agree to it in our cookie banner. You can change your choice at any time from Cookie Settings at the bottom of our website pages, or on the Account page when you are signed in.

13. If something goes wrong

If a breach of personal data is likely to put your rights at risk, we will report it to the NDPC within 72 hours of becoming aware of it, and tell you without undue delay where the risk to you is high.

14. Children

Our member services are for people aged 18 and over. We do not knowingly collect personal data from children through the website.

15. Complaints

If you are unhappy with how we have handled your personal data, contact our Data Protection Officer first. You also have the right to complain to the Nigeria Data Protection Commission.

16. Changes to this notice

We will update this notice when the way we handle personal data changes, and tell you about changes that affect you. The date at the top shows when it was last updated.