This Privacy Policy explains how Plug Microfinance Bank Limited (“Plug MFB”, “the Bank”, “we”, “us”, or “our”) collects, uses, discloses, stores, and protects personal data obtained through our website, digital platforms, products, and services, in accordance with the Nigeria Data Protection Act (NDPA) 2023, applicable Central Bank of Nigeria (CBN) regulations, and other relevant laws.

By accessing our website or using our products and services, you agree to the practices described in this Privacy Policy.

1. Plug MFB: Plug Microfinance Bank Limited is a microfinance bank licensed and regulated by the Central Bank of Nigeria (CBN). We are committed to protecting the privacy and confidentiality of our customers’ personal data.

2. Personal Data We Collect: We may collect and process the following categories of personal data:

· Identification Information: Full name, Date of birth, Gender, National Identification Number (NIN), Bank Verification Number (BVN), Passport photograph, Government-issued identification documents

· Contact Information: Residential and mailing address, Email address, Phone number

· c) Financial and Transactional Information: Bank account details, Transaction history, Loan and credit information, Income and employment details

· Digital and Technical Information: IP address, Device and browser information, Login credentials (encrypted), Website usage data and cookies

· Other Information: KYC and due diligence records, Communications with the Bank, Any other information required to provide our services or comply with legal obligations

3. How We Collect Personal Data: We collect personal data through the following means;

· Account opening forms and service applications

· Our website, mobile app, and digital channels

· Communications via email, phone calls, or in person

· Third parties such as identity verification providers, credit bureaus, and regulators, where permitted by law

4. Purpose and Legal Basis for Processing: We process personal data for the following purposes:

· To open and manage customer accounts

· To provide banking and financial services

· To comply with KYC, AML, and CTF obligations

· To process transactions and payments

· To assess creditworthiness and manage risk

· To communicate with customers and respond to enquiries

· To meet legal, regulatory, and reporting obligations

· To improve our products, services, and digital platforms

Processing is based on one or more lawful grounds, including contractual necessity, legal obligation, legitimate interest, and customer consent where required.

5. Disclosure of Personal Data: We may disclose personal data when required by the following regulatory and supervisory authorities:

· CBN and law enforcement agencies

· Service providers and vendors acting on our behalf under confidentiality obligations

· Credit bureaus and payment processors

· Courts, tribunals, or government bodies where required by law

6. Data Retention: Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, comply with legal, regulatory, and audit requirements and resolve disputes or enforce agreements.

Where retention periods expire, data is securely deleted or anonymized.

7. Data Security: We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These include access controls, encryption, secure servers, and staff confidentiality obligations.

Despite these measures, no system is completely secure, and we cannot guarantee absolute security of data transmitted electronically.

8. Your Data Protection Rights: Subject to applicable law, you have the right to request access to your personal data, request correction of inaccurate or incomplete data, withdraw consent where processing is based on consent, Lodge a complaint with the Nigeria Data Protection Commission (NDPC)

Requests may be made using the contact details provided below.

9. Cookies and Tracking Technologies: Our website may use cookies and similar technologies to enhance user experience, analyse website traffic, and improve functionality. You may manage cookie preferences through your browser settings. Further details may be provided in a separate Cookie Policy.

10. Cross-Border Data Transfers: Where personal data is transferred outside Nigeria, we ensure that such transfers are carried out in accordance with the NDPA and applicable data protection safeguards.

11. Children’s Privacy: Our products and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors without appropriate consent as required by law.

12. Updates to This Privacy Policy: We may update this Privacy Policy from time to time to reflect legal, regulatory, or operational changes. Updated versions will be published on our website and take effect immediately upon posting.

13. Contact Information: For questions, requests, or complaints regarding this Privacy Policy or our data protection practices, please contact:

Data Protection Officer (DPO): Abimbola Ajibade Plug Microfinance Bank Limited
Epe Local Government Secretariat, Itamarun, Epe Lagos.
Email: escalation@plugmfbank.com
Phone: +234 810 044 6586

By using our website or services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described above.

14. Date created: This policy was created on 15th day of July 2025 and shall remain in force until it is revised or replaced.

15. Review Circle: This policy shall be reviewed every two (2) years or sooner if required due to regulatory changes or organizational restructuring