Privacy Policy
At BainesCredit Microfinance Bank Limited, we recognize that your personal and financial information requires the utmost care, confidentiality, and protection. This policy outlines how your data is collected, processed, and safeguarded across all our banking services.
Contents
Personalized & Regulated Banking
As a licensed Microfinance Bank, BainesCredit operates under strict regulatory oversight by the Central Bank of Nigeria (CBN) and the Nigeria Data Protection Commission (NDPC).
- We NEVER sell your personal data
- Bank-grade 256-bit AES encryption
- Full NDPA 2023 Subject Rights honored
- Strict KYC & AML/CFT standards
Data Protection Officer
Privacy Inquiries & Rights
Overview & Data Controller Information
This Privacy Policy explains how BainesCredit Microfinance Bank Limited (collectively referred to as "BainesCredit", "Baines", "the Bank", "we", "us", or "our") collects, utilizes, shares, stores, and protects personal and financial data obtained from:
- Personal and Retail Banking customers
- Business, SME & Corporate Banking clients
- Digital channel users (Web, Mobile App, USSD)
- Loan applicants, guarantors & website visitors
BainesCredit Microfinance Bank Limited is duly licensed by the Central Bank of Nigeria (CBN) under the Banks and Other Financial Institutions Act (BOFIA) and functions as the Data Controller under the provisions of the Nigeria Data Protection Act, 2023 (NDPA). Our corporate headquarters is situated at:
BainesCredit Microfinance Bank Limited
161c, Raufu Taylor Close, Off Idejo Street,
Victoria Island, Lagos State, Nigeria.
Website: www.bainescredit.com | CBN Licensed Microfinance Bank
Our Core Privacy Principles
In adherence to Section 24 of the Nigeria Data Protection Act 2023, BainesCredit observes six foundational principles whenever personal data is processed:
1. Lawfulness & Fairness
Processed transparently with a verified legal basis and never in a deceptive manner.
2. Purpose Limitation
Collected strictly for defined, explicit financial and banking operations.
3. Data Minimization
Limited to what is adequate, relevant, and necessary for the intended purpose.
4. Data Accuracy
Maintained accurately and updated periodically as provided by the customer.
5. Storage Limitation
Retained only for the duration required by Nigerian banking laws and regulations.
6. Integrity & Confidentiality
Protected by robust technical, organizational, and cryptographic security measures.
Categories of Information We Collect
To provide banking services, conduct required Know Your Customer (KYC) validations, and satisfy Central Bank of Nigeria requirements, we collect the following categories of information:
A. Identity & Know Your Customer (KYC) Data
Full legal name, maiden name, title, gender, date of birth, nationality, marital status, passport photographs, and government-issued identification numbers (e.g., National Identification Number [NIN], International Passport, Driver's License, or Voter's Card).
B. Financial & Banking Identifiers
Bank Verification Number (BVN), Tax Identification Number (TIN), BainesCredit account numbers, debit card tokenized identifiers, account balances, transaction histories, inward and outward transfer receipts, source of funds, and employment/income details.
C. Corporate & Business Customer Data
Corporate Affairs Commission (CAC) registration documentation, Certificate of Incorporation, Memorandum and Articles of Association, Tax Clearance Certificates, Special Control Unit against Money Laundering (SCUML) registration, board resolutions, and identification/BVN of directors, authorized signatories, and Ultimate Beneficial Owners (UBOs).
D. Credit Risk & Lending Information
Credit scores, past loan performance, debt obligations, repayment records, and credit bureau reports from licensed credit rating agencies (CRC, CRCC, FirstCentral) as mandated by the CBN Credit Risk Management System (CRMS).
E. Digital, Device & Geolocation Data
IP addresses, device model and unique device identifiers, operating system, browser type, app version, login timestamps, and device geolocation (utilized strictly for anti-fraud detection and verifying geographic transaction legitimacy).
Lawful Bases for Processing
Under the Nigeria Data Protection Act (NDPA 2023), BainesCredit only processes your data where there is a recognized legal basis:
| Legal Basis | Operational Banking Purpose |
|---|---|
| Contractual Necessity | To open, maintain, and administer savings, current, and corporate accounts; disburse loans; execute fund transfers; and issue payment cards. |
| Legal & Regulatory Mandate | Compliance with CBN guidelines, the Money Laundering (Prevention and Prohibition) Act, NDIC reporting, NFIU suspicious transaction reporting, and tax statutory withholdings. |
| Legitimate Banking Interest | Preventing electronic payment fraud, safeguarding IT infrastructure, credit underwriting assessment, loan recovery, and continuous risk management. |
| Explicit Consent | Direct marketing communications, promotional offers, cross-selling optional financial products, or optional cookies (which you can revoke anytime). |
How We Use Your Personal & Banking Data
We process your information exclusively for legitimate banking operations, including:
Sharing & Third-Party Disclosure
BainesCredit does not sell, rent, or trade your personal or financial records to third-party marketing companies. We only share information with authorized entities under strict confidentiality agreements:
1. Regulatory and Law Enforcement Authorities
The Central Bank of Nigeria (CBN), Nigeria Deposit Insurance Corporation (NDIC), Nigerian Financial Intelligence Unit (NFIU), Economic and Financial Crimes Commission (EFCC), Federal Inland Revenue Service (FIRS), or law enforcement agencies when compelled by a valid court subpoena or statutory reporting enactment.
2. National Payment Infrastructure & Switches
Nigeria Inter-Bank Settlement System (NIBSS), payment switches, clearinghouses, and licensed card networks necessary to route and finalize customer debit card transactions and electronic transfers.
3. Vetted Technical Service Providers
Cloud infrastructure providers, core banking software vendors, SMS gateway aggregators, and fraud analytics partners bound by binding Data Processing Agreements (DPAs) in total compliance with the NDPA 2023.
Credit Bureau Reporting & Inquiries
As a responsible lending institution regulated by the Central Bank of Nigeria:
- Credit Assessment: When you apply for a loan, overdraft, or credit facility, we perform credit reference inquiries across CBN-licensed Credit Bureaus (including CRC, CRCC, and FirstCentral).
- Mandatory Performance Reporting: In compliance with the Credit Reporting Act and CBN guidelines, BainesCredit shares details of your active credit facilities, repayment track record, and any defaults with licensed Credit Bureaus.
- Resolution of Inaccuracies: If you believe a credit record reported by BainesCredit is inaccurate, you possess the right to dispute it by notifying our Credit Risk unit at
creditrisk@bainescredit.comfor immediate investigation.
Automated Credit Decisions & Profiling
To provide instant credit products (such as Salary Advance and fast retail loans), BainesCredit utilizes automated decision-making algorithms that analyze:
Human Intervention Guarantee:
Under the NDPA 2023, you have the right to request a manual human review of an automated credit rejection, understand the underlying assessment criteria, and submit additional supporting documentation for re-evaluation.Data Security & Encryption Safeguards
Security is fundamental to our banking infrastructure. We maintain advanced technological and administrative defenses:
All data in transit is protected using TLS 1.3 cryptographic protocols, and stored data is encrypted with AES-256 standards.
Strict two-factor authentication (2FA) and One-Time Passwords (OTPs) for authorizing electronic transactions and logins.
Continuous Security Operations Center (SOC) monitoring to isolate anomalies, intrusion attempts, and unauthorized access.
In the rare event of a data breach posing a risk to you, we will notify the NDPC and impacted users within 72 hours as mandated by law.
Data Retention Schedules
Under Nigerian financial regulations, including the Money Laundering (Prevention and Prohibition) Act 2022 and Central Bank of Nigeria mandates, BainesCredit is legally obligated to retain customer account records, identification data, and transaction histories for a minimum of five (5) to seven (7) years following the formal closure of an account or final settlement of a credit facility.
Upon the expiration of the statutory retention duration, records are systematically anonymized or securely purged using certified data sanitization standards.
Your Legal Rights Under the NDPA 2023
As a data subject under the Nigeria Data Protection Act, you are entitled to exercise the following statutory rights regarding your personal data:
To exercise any of these rights, please email our Data Protection Office at privacy@bainescredit.com. We will verify your identity and respond within thirty (30) days as provided by law.
Cross-Border Data Transfers
BainesCredit primarily stores and processes customer data within secure cloud hosting facilities and data centers adhering to Central Bank of Nigeria requirements. In instances where international card settlement or secure cloud computing requires processing outside Nigeria, such transfers are conducted under the adequacy standards prescribed by the Nigeria Data Protection Commission (NDPC).
Policy Revisions & Notifications
We may periodically update this Privacy Policy to reflect modifications in our banking offerings, technology upgrades, or amendments to statutory Nigerian laws. When material changes occur, we will notify account holders via email notifications, online banking banners, or a prominent notice on www.bainescredit.com.
Contact Our Data Protection Officer
If you have questions, feedback, or wish to exercise your rights under the Nigeria Data Protection Act, please contact our Data Protection Officer or Compliance Department:
BainesCredit Microfinance Bank Limited
161c, Raufu Taylor Close, Off Idejo Street,
Victoria Island, Lagos State, Nigeria.
Statutory Supervisory Authority:
You also have the right to lodge a formal complaint with the Nigeria Data Protection Commission (NDPC) at www.ndpc.gov.ng if you believe your privacy rights have not been adequately redressed.