Privacy Policy

This Privacy Policy regulates how Covenant Microfinance Bank Ltd (“the Bank”) can process the personal information of its customers. In line with the provisions of the Nigeria Data Protection Act (NDPA), 2023, and other applicable Data Privacy laws and regulations, Covenant Microfinance Bank Ltd maintains the following privacy principles, which govern how we collect, use, record, organise, structure, store, adapt or alter, retrieve, consult, disclose, disseminate, align, combine, restrict, erase or destroy and generally manage your personal data (“Processing” or “process” of your Personal Data”).

Personal Data under this privacy policy is as defined by the Nigeria Data Protection Act (NDPA), 2023, and the Nigeria Data Protection Commission, which is the body empowered to make regulations or directives prescribing categories of sensitive personal data, further grounds for processing the same, and the safeguards that must apply.

Basis for collecting and processing Personal Data by the Bank

The Bank processes your personal data relying on any of the following legal grounds:

• Where your Consent as the Data Subject has been obtained.
• Offering banking and allied services to the Data Subject.
• Offer of employment to the Data Subject.
• Where the processing of your personal data is necessary for the performance of a contract to which you are a party.
• For compliance with a legal obligation to which the data controller is subject.
• Where it is necessary to protect the vital interests of a person in line with Data Privacy regulations.
• Where it is necessary for the performance of a task carried out in the public interest.
• Where it is in the legitimate interests of the Bank (except where the interests or rights and freedoms of the data subject override those interests).

Collection of Personal Information

As a responsible business, Covenant Microfinance Bank Ltd is committed to complying with the relevant applicable data protection regulations when processing your personal data. The NDPA gives you certain rights regarding our use of your personal data, including the right to:

• Request access to the Personal Data we have collected about you to review, modify, or request deletion of your Personal Data.
• Request a copy of the Personal Data we have collected about you and correct any inaccuracies.
• Request that we cease processing your Personal Data.
• Lodge complaints with a competent Data Protection Authority.
• Request for your personal data to be transferred to another organisation in a commonly used and machine-readable format.

What do we need?

Covenant Microfinance Bank Ltd will be known as the “controller” and “processor” of the personal data you provide to us. We may collect your information from:

• Website visits, applications, and banking channels
• Identification documents
• Curriculum vitae (for employment)
• Personal financial statements
• Interactions with relationship managers
• Third-party sources

Types of data we collect include:

• Basic personal information (Name, Address, Nationality, Email, Phone number, ID)
• National Identity Number, Bank Verification Number (BVN), family-related information
• Biometric information (e.g., fingerprint for BVN verification at ATMs, POS, etc.), IP address, device information, and location
• Financial information such as account balance, transaction history, and debit/credit card usage
• Visual images and video footage from visits to our premises and ATMs, as well as recorded calls with our contact centre
• Employment-related data from prospective employees

We may also process sensitive personal information for specific and limited purposes such as detecting and preventing financial crime or ensuring accessibility to customers, but only with explicit consent or where required by law.

Please note that Covenant Microfinance Bank Ltd will NEVER ask for personal banking information such as card details (CVV), PIN, Password, Secure Passcode, or Token number.

Why do we need it?

We require your basic personal data to provide you with the banking services you have engaged us for, in line with applicable Central Bank requirements and Data Privacy regulations.

What do we do with it?

We collect, store, and process your personal data as required by law to enable you to obtain banking services.

All personal data is held securely at our head office or authorised service providers, where applicable. Your data will remain confidential unless disclosure is required by law or regulation.

The Bank complies with the latest Information Security standards such as PCI-DSS and ISO/IEC 27001:2022.

How long do we keep it?

As a regulated financial institution, Covenant Microfinance Bank Ltd will retain your personal data as required by law. Once retention requirements are satisfied, your data will be securely disposed of.

Sharing of Personal Data

We may share personal data with third parties and service providers where necessary to deliver services to you, in line with NDPA and other applicable regulations. This may include:

• Legal obligations and regulatory requests
• Law enforcement and government agencies
• Protection of vital interests and fraud prevention
• Auditing, compliance, and corporate governance functions

Data Security

At Covenant Microfinance Bank Ltd, security is a top priority. We implement strong physical, electronic, and managerial safeguards to protect your data against unauthorised access. Our web servers are protected behind firewalls, and sensitive systems are continuously monitored.

Only authorised staff, agents, and contractors (bound by confidentiality agreements) have access to your data.

Shared Responsibility

We encourage all customers to play an active role in protecting their online banking details. Do not share your User ID, PIN, or Password with anyone.

Cross-Border Transfers

We may process data in multiple locations but will not transfer your personal data outside Nigeria or to any international organisation in contravention of NDPA or other applicable laws.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, regulatory, or operational changes. Updates will be published on our website: www.covenantmfb.com

Privacy Contact Information

For questions or concerns about our Privacy Policy, please contact:

You may also engage the Nigeria Data Protection Commission if you are dissatisfied with how Covenant Microfinance Bank Ltd handles your data.