Privacy Policy.

How we collect, use, and protect personal data — written in plain English, designed to comply with the Nigeria Data Protection Act 2023, the FCCPC's DEON regulations 2025, and the GDPR.

Who we are

Korevra Technology Inc. is the data controller. We are a Nigerian-incorporated company at 12b Sule Abore, Ojodu, Agege 101233, Lagos. Our Data Protection Officer is reachable at dpo@korevra.com.

What data we collect

If you are a borrower using the Korevra SureLend mobile app or USSD service via one of our customer institutions, we process: full name · phone · email · Bank Verification Number (BVN) · National Identification Number (NIN) · biometric facial scan (for liveness check only — never stored) · loan history with our institutional customer · bank transaction history (with your explicit Open Banking consent under the CBN OBCMS framework) · bills payment history · mobile location at the moment of certain transactions (only when you opt in to BillsPay+ promotions).

If you are an employee of one of our institutional customers, we process: full name · email · phone · role · branch assignment · login activity (for security) · device identifiers · GPS location during clock-in (only if your employer has enabled the Time & Attendance module).

If you visit our website, we process: IP address · browser fingerprint · pages visited · referrer · cookies (see Cookie section).

Why we collect it

• To make the lending product work — verify your identity, score your creditworthiness (the SureScore model), disburse and reconcile loans, send you reminders, take repayments.
• To comply with regulators — CBN, FCCPC, NDPC, NFIU, NIBSS, the credit bureaus (CRC · CreditRegistry · FirstCentral), and AMCON when loans default.
• To protect against fraud — pattern detection, AML/CFT screening, sanctions checking.
• To improve our products — anonymised, aggregated analytics only. We do not train models on your data without your explicit consent.

Your rights under the NDPA 2023

• Access — request a complete copy of every piece of data we hold on you. Free, fulfilled within 30 days.
• Correction — fix anything inaccurate.
• Erasure — be forgotten, except where we are legally required to retain (e.g. CBN audit trail · 12 years).
• Portability — receive your data in a machine-readable format.
• Withdrawal of consent — at any time, with immediate effect.
• Object to processing — for marketing, profiling, or any non-essential purpose.
• Complaint to NDPC — if we cannot resolve your concern, you can escalate to the Nigeria Data Protection Commission (info@ndpc.gov.ng).

To exercise any right, email dsr@korevra.com or use the in-app DSR (Data Subject Request) form. We respond within 30 days.

How we protect your data

• All data encrypted at rest with tenant-specific AES-256 keys
• All data encrypted in transit with TLS 1.3
• SOC 2 Type II audited annually
• ISO 27001 certified
• NDPC compliance attestation refreshed quarterly
• Penetration tested by external firm twice yearly
• 24/7 SOC monitoring with PagerDuty alerting
• Multi-factor authentication required for all staff accessing customer data
• Privileged access requires hardware security keys (FIDO2)
• All staff actions on customer data logged in immutable hash-chained audit trail

Data residency

Your data is stored exclusively within Nigeria, in primary AWS Africa (Cape Town) and secondary disaster-recovery in Lagos colocation. We do not transfer personal data outside Nigeria except where (a) you explicitly consent, (b) the recipient is in a jurisdiction the NDPC has whitelisted as adequate, or (c) we are legally compelled by a Nigerian court order.

Cookies

We use functional cookies (login session, language preference, density mode) and aggregated analytics cookies (anonymised page views). We do not use third-party advertising cookies, do not embed Facebook Pixel, do not embed Google Analytics by default. Specific cookies set:

• korevra.surelend.session — your login session, expires when you log out
• korevra.surelend.webadmin.v1 — your UI preferences (language, density, accent), persists 1 year
• splashSeen, waSplashSeen, etc. — session-only, dismisses splash screens
• demoBarDismissed — persists your dismissal of the about-this-demo banner

Data retention

• Active borrower data — for the life of your loan + 12 years after closure (CBN regulatory requirement)
• Audit logs — 12 years (CBN, FCCPC, NDPC retention)
• Marketing comms history — 3 years
• Anonymised analytics — indefinitely
• Browser cookies — as listed above

Changes to this policy

We will publish material changes 30 days before they take effect, notify all customers by email and in-app banner, and require re-consent for any meaningful change to data use. Minor edits (typos, clarifications) are versioned silently. Version history is available on request.