Privacy Policy

Credla helps customers purchase products through flexible instalment plans. This policy explains how we collect, use, share and protect personal information when you use our app or contact us.

Credla Africa Limited is responsible for determining how your personal information is processed.

Address: Magodo Phase 2, Lagos State, Nigeria

Email: credlaltd@credla.africa

• Account information: your name, email address, phone number, login credentials and account preferences.
• Identity information: your Bank Verification Number (BVN), National Identification Number (NIN), selfies and related verification results.
• Financial information: bank statements you provide and the financial information they contain, including transactions and balances.
• Location information: location data collected through the app, subject to the permissions and notices presented when collection occurs.
• Purchase and payment information: products ordered, instalment schedules, transaction references, payment status, outstanding balances and refunds.
• Delivery information: recipient names, delivery addresses, contact details, delivery instructions and proof of delivery.
• Support information: messages, complaints and documents you send us.

We collect information directly from you and receive relevant information from service providers involved in verification, payments and fulfilment. Where information is required for a service, we explain this when requesting it. Without it, we may be unable to verify your identity, assess your application or complete your purchase.

We use information to create and manage accounts, assess purchase applications, administer instalment plans, record payments, arrange delivery, handle refunds and provide customer support. Processing necessary to enter into or perform our agreement with you is based on that agreement.

We use relevant identity and financial information to verify identity, assess affordability and prevent fraud. Depending on the activity, we rely on steps necessary to consider your application, an applicable legal obligation, or legitimate interests. We obtain consent where required.

Our legitimate interests include protecting customers and Credla against fraud, securing our services and resolving disputes. We assess these interests against your privacy rights. We also process information to meet applicable legal and recordkeeping obligations.

Optional marketing is sent where you have consented or another lawful basis permits it. You can opt out at any time. Where we rely on consent, you may withdraw it by contacting us. Withdrawal does not affect processing lawfully carried out beforehand. Using Credla does not, by itself, constitute consent to optional processing.

BVN, NIN, selfies and bank statements are used only for specified, lawful purposes connected with our services. We explain the purpose of verification and financial information requests when collecting them. Where selfie processing involves biometric identification, the additional legal conditions and safeguards for sensitive personal data apply.

Payment providers process payments connected with your purchases. We use transaction records and payment confirmations to update instalment plans, reconcile payments and manage refunds. Providers may also process information for their own legal and regulatory purposes under their privacy policies.

Where necessary for the purposes described in this policy, relevant information may be shared with:

• Identity verification and financial assessment providers
• Payment providers and financial partners involved in your transaction
• Merchants
• Delivery partners
• Providers supporting hosting, communications, security and customer service

We may also share information with professional advisers for legal, accounting and compliance purposes, and with regulators, courts or law enforcement bodies where disclosure is legally required or otherwise lawfully justified.

Merchants and delivery partners receive information relevant to fulfilling your order. Sharing should be limited to what is needed for the relevant purpose. Providers acting on our behalf must process information under appropriate contractual instructions and safeguards. Some providers act as independent controllers for their own processing.

Where a feature requires permission, such as camera access for a verification selfie or access to location, we explain the purpose when requesting it. You can manage permissions through your device settings. Disabling a permission may affect the associated feature. Where consent is required for optional tracking, we request it before tracking begins and provide a way to withdraw it.

Where applicable law protects you against decisions based solely on automated processing that have legal or similarly significant effects, you may request human intervention, express your views and contest the decision by contacting us at credlaltd@credla.africa.

Where information is transferred outside Nigeria, we use a transfer mechanism permitted by applicable law, including an adequate level of protection or other legally recognised safeguards. Contact us for information about safeguards relevant to your data.

We keep personal information only for as long as necessary to provide our services, fulfil applicable legal obligations and resolve disputes. Retention depends on the type of information, your account and transaction status, applicable recordkeeping requirements and any ongoing dispute or investigation.

When information is no longer needed, we delete or anonymise it. Information awaiting deletion from backups remains protected until removed through the backup retention cycle.

We maintain appropriate technical and organisational safeguards designed to protect personal information against unauthorised access, loss, alteration and disclosure. No system guarantees absolute security. If a personal data breach occurs, we assess it and notify the relevant authority and affected individuals where required by law.

Subject to applicable law, you may:

• Request access to your information
• Correct inaccurate or incomplete information
• Request deletion or restriction of processing
• Object to certain processing, including direct marketing
• Withdraw consent
• Request a portable copy where applicable
• Exercise applicable rights concerning automated decisions

To exercise your rights or request account deletion, email credlaltd@credla.africa. We may request proportionate information to verify your identity. We respond within applicable legal time limits and explain any lawful reason for declining or limiting a request.

Account closure does not automatically erase records we must lawfully retain or cancel outstanding contractual obligations. Information retained after closure is used only for the relevant permitted purposes.

Credla's services are intended for people aged 18 and above. If you believe a child has provided personal information to us, contact us so we can investigate and take appropriate action.

For privacy concerns or complaints, email credlaltd@credla.africa. You may also complain directly to the Nigeria Data Protection Commission (ndpc.gov.ng (opens in a new tab)). You do not need to complete our internal complaints process first.

We may update this policy as our services or legal obligations change. We will publish an updated effective date and provide appropriate notice of material changes. Where fresh consent is required, we will request it.

Credla Africa Limited

Magodo Phase 2, Lagos State, Nigeria

credlaltd@credla.africa