Last updated: 2 July 2026 · Effective date: Upon publication on Google Play
1. Who we are
The NEPZA Ethical Cooperative Society ("NECS", "we", "us", "our") operates the NECS mobile application (the "App") for the benefit of its members. NECS is the data controller responsible for your personal data.
Operator / legal entity: NEPZA Ethical Cooperative Society
This policy is provided in line with the Nigeria Data Protection Act, 2023 (NDPA) and other applicable law.
2. Scope
This policy applies to personal data we collect through the App and the related back-office systems used to administer your membership. It does not cover third-party services that have their own privacy policies (see Section 6).
3. Information we collect
3.1 Information you provide during registration and use
Identity & KYC data: full name, National Identification Number (NIN), Bank Verification Number (BVN), staff/employee ID, and IPPIS number.
Contact data: phone number, email address, and address (if collected).
Employment/payroll data: grade/level and salary-deduction mandate details used to process monthly contributions via payroll.
Next-of-kin data: name, relationship, phone number, address, and email of the next of kin you nominate.
Identity documents (images): a passport photograph, a government-issued ID image, and your signature image, captured for verification.
Membership elections: your monthly savings and investment amounts and any target-savings goals you create.
Payment evidence: where you pay by bank transfer, an image/receipt you upload as proof of payment.
3.2 Financial and transaction data
Balances and records of your savings, investment, target savings, loan applications and repayments, contributions, cooperative fees, and the transaction/statement history associated with your account.
3.3 Payment information
Card and bank payments are processed by our payment provider, Paystack. We do not collect or store your full card number, CVV, or bank login credentials — these are handled directly by Paystack. We receive a payment reference and status to record your transaction.
3.4 Authentication and security data
Your email and a password (stored only in hashed/managed form by our authentication provider — we never see your plaintext password).
A transaction PIN used to authorise sensitive actions (handled securely; not stored in plaintext).
Biometric unlock (fingerprint/face), if you enable it: handled by your device's operating system and never leaves your device — we do not receive or store biometric data.
3.5 Information collected automatically
Device and push data: a Firebase Cloud Messaging (FCM) token to deliver notifications, and basic device/app information.
Technical and security data: IP address, app version, and integrity/anti-abuse signals (via Firebase App Check / reCAPTCHA).
Diagnostics: limited crash and performance data.
4. How we use your information
create and administer your cooperative membership account;
verify your identity and meet Know-Your-Customer (KYC) and anti-fraud obligations;
record and reconcile monthly contributions (including via payroll/IPPIS), savings, investment, target savings, loans, repayments, and fees;
process payments you make through Paystack or by uploaded bank-transfer evidence;
send you transaction alerts, notices, and service messages;
provide member support and respond to your requests;
maintain the security, integrity, and proper functioning of the App; and
comply with legal, regulatory, and cooperative bye-law requirements.
5. Legal basis for processing (NDPA)
We process your data on one or more of these bases: your consent; performance of the membership contract with you; compliance with a legal obligation; and our legitimate interests in operating the cooperative securely and preventing fraud. Where we rely on consent, you may withdraw it at any time (see Section 10).
6. How we share your information
We do not sell your personal data. We share it only as follows:
Service providers (processors) acting on our instructions:
Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging, Hosting, App Check) — our core app and data infrastructure.
Paystack — to process card/bank payments.
Galaxy Backbone — the Nigerian government email service provider, used to send registration confirmations and notices.
Cooperative officers/administrators (e.g. the Financial Secretary and administrators) who administer registrations, membership, contributions, and payments.
Your employer / payroll administrator — limited data (e.g. IPPIS number and contribution amounts) for salary-deduction and reconciliation.
Authorities and regulators — where required by law, regulation, or valid legal process.
Professional advisers / auditors — where necessary and under confidentiality.
7. Data storage and international transfers
Your data is stored on Google Firebase infrastructure. Our database is hosted in the United States (Firestore multi-region nam5), so your data is processed and stored outside Nigeria. Where data is transferred internationally, we rely on appropriate safeguards consistent with the NDPA.
8. Data retention
We keep your personal data for as long as you remain a member and, after your account is closed, for 6 years after account closure to meet legal, accounting, tax, audit, and regulatory obligations, resolve disputes, and enforce our agreements — or longer where the law specifically requires. When no longer needed, data is securely deleted or anonymised.
9. Security
We use technical and organisational measures to protect your data, including encryption in transit, restricted role-based access, server-side authorisation of sensitive actions, transaction-PIN/biometric protection, and anti-abuse controls (App Check). No system is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to notify you and the relevant authority of a breach where the law requires.
10. Your rights
Subject to the NDPA and applicable law, you have the right to: access; correction; deletion (subject to legal retention duties); objection/restriction; withdrawal of consent; portability; and to lodge a complaint with the Nigeria Data Protection Commission (NDPC).
To exercise any right, contact us at necs@nepza.gov.ng. Some data (e.g. KYC records) may need to be retained even after a deletion request where the law requires.
11. Children
The App is intended for cooperative members who are 18 years or older and is not directed to children. We do not knowingly collect data from anyone under 18.
We may update this policy from time to time. We will post the updated version with a new "Last updated" date and, where changes are significant, notify you in the App or by email.