Data Privacy
This Data Privacy notice explains how Coronation collects and processes personal data through this IPO subscription portal, including identity details such as BVN, NIN, and CAC information, for verification, account setup, and IPO subscription purposes under the Nigeria Data Protection Act 2023 (NDPA).
Coronation is the data controller and data processor of personal information collected and processed through this portal. This notice should be read together with our Privacy Policy.
Personal Data We Process
Personal data means any information about an individual from which that person can be identified. It does not include where the identity has been removed (anonymous data).
We collect information about you from a variety of sources, such as website visits, applications, identification documents, interactions with relationship managers, and other third parties (e.g., payment gateway), and other written or electronic communications reflecting information such as your name, address, passport details, identification numbers, telephone number, occupation, assets, income and any other information we deem necessary. We may also gather information from publicly available sources such as the press, public search engines, sanction screening tools, etc.
We may also use your transactional account history including your payment records. We may also use the information received from third parties such as family, solicitors, friends, or employers, website / social media pages made public by you, government agencies, regulators, supervisory or credit agencies.
We collect and store personal information through:
- Physical and online forms
- Cookies — see our Cookie Policy
- CCTV recordings
How We Use Personal Data
We may use the personal data we obtain to:
- Provide and administer our services
- Process and keep you informed on the status of your business relationship with us
- Provide investor services
- Communicate and administer our services and events (such as sending promotional materials, newsletters, and other marketing communications)
- Provide customer support
- Verify your identity and protect against and prevent fraud and other unlawful activity, unauthorized transactions, claims, and other liabilities
Where applicable by law, we will obtain your consent for the processing of your personal data for direct marketing purposes.
Lawful Bases for Processing
The table below sets out why and how we use your personal data, as well as the legal reasons on which we rely under Data Protection Legislation.
| Purpose / activity | Lawful basis for processing |
|---|---|
| Provision of services, including the administration and management of customer / client records and information | Performance of a contractual agreement with you |
| Establishing your identity and assessing applications for our service | Performance of a contractual agreement with you; consent from you |
| Updating and enhancing our records | Performance of a contractual agreement with you |
| Managing our relationship with you | Performance of a contract with you |
| Identifying and informing you about other services | Consent from you |
| Complying with our legal obligations and assisting government and law enforcement agencies or regulators | Compliance with a legal obligation |
| Processing in the public interest | Processing in the public interest |
Consent
We will provide you with our Privacy Notice whenever we are collecting your personal information irrespective of the medium used. For the electronic medium, your consent is obtained by asking you to click on a button to show acknowledgment of the Notice. On the other hand, for your personal information collected via a paper document, we will require you to sign off on the document showing your understanding of our Privacy Notice.
Information Sharing with Third Parties
Coronation does not sell or otherwise disclose personal data about you except as described in this notice or at the time of collection. We will only disclose your personal information in accordance with applicable laws and regulations.
We may engage the services of third parties in order to process your personally identifiable information. The processing by such third parties shall be governed by a written contract to ensure adequate protection and security measures are put in place by the third party for the protection of Personal Data in accordance with the terms of this Notice and the NDPA.
We share personal data with the following categories of third parties:
| Who | Examples |
|---|---|
| Other Coronation entities | Coronation Registrars; Coronation Insurance; Coronation Life Assurance; Coronation Trustees; Coronation Asset Management; Coronation Capital; Coronation Insurance Ghana; Trium Network Limited; Coronation Technology Limited |
| Legal or regulatory authorities that may require disclosure on legal grounds, or other relevant government departments where reasonably necessary | Securities and Exchange Commission (SEC); Economic and Financial Crimes Commission (EFCC); NGX Regulations Limited; Nigerian Financial Intelligence Unit (NFIU) |
| Service providers / strategic partners engaged by us to help run our business and perform the services / our contract with you | Cloud storage providers engaged by us to provide electronic storage facilities for our business data and your information |
| Relatives / power of attorney / next of kin, acting on your behalf whenever you make such requests | Next of kin making decisions for the data subject in an emergency |
| External auditors | Annual financial auditors |
International Transfer
Where Personal Data is to be transferred to a country outside Nigeria, we shall put adequate measures in place to ensure the security of such Personal Data. We shall, among other things, conduct a detailed assessment of whether the said country is on the National Information Technology Development Agency (NITDA) Whitelist of Countries with adequate data protection laws.
Transfer of Personal Data out of Nigeria would be in accordance with the provisions of the NDPA. We will therefore only transfer Personal Data out of Nigeria on one of the following conditions:
- The consent of the Data Subject has been obtained.
- The transfer is necessary for the performance of a contract between the entity and the Data Subject, or the implementation of pre-contractual measures taken at the Data Subject’s request.
- The transfer is necessary to conclude a contract between the entity and a third party in the interest of the Data Subject.
- The transfer is necessary for reasons of public interest.
- The transfer is for the establishment, exercise, or defence of legal claims.
- The transfer is necessary to protect the vital interests of the Data Subject or other persons, where the Data Subject is physically or legally incapable of giving consent.
Provided, in all circumstances, that the Data Subject has been manifestly made to understand through clear warnings of the specific principle(s) of data protection that are likely to be violated in the event of transfer to a third country, this provision shall not apply to any instance where the Data Subject is answerable in duly established legal action for any civil or criminal claim in a third country.
Coronation will take all necessary steps to ensure that the Personal Data is transmitted in a safe and secure manner. Details of the protection given to your information when it is transferred outside Nigeria shall be provided to you upon request.
Information Retention and Storage
Your personal data will be retained only for as long as is necessary for the purposes set out in this notice. We will retain and use your personal data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies. We will retain and use your personal data to the extent necessary to fulfil our contractual obligations with you and only retain your information further in line with regulatory requirements.
All personal information you provide to us is stored on our secure servers as well as secure physical locations and cloud infrastructure (where applicable). The data that we collect from you may be transferred to and stored at a destination outside Nigeria or the European Economic Area (EEA). Whenever your information is transferred to another location, we will take all necessary steps to ensure that your data is handled securely and in accordance with this notice and our Privacy Policy.
Your Rights
Subject to applicable laws and other data protection regulations, you have the right to access, rectify, delete, object to, or restrict processing of your personal data, and to request a machine-readable copy of the personal data you have given to us. You may also withdraw consent where we rely on consent, and lodge a complaint with the Nigerian Data Protection Commission (NDPC) at info@ndpc.gov.ng.
To exercise these rights, contact our Data Protection Officer at InformationSecurity@coronationgroup.com. A full description of your rights is set out in our Privacy Policy.
Contact
Questions, comments, and requests regarding this notice should be addressed to:
Data Privacy Officer: InformationSecurity@coronationgroup.com