Privacy Policy

This Privacy Policy ("Policy") governs the collection and processing of personal data by Veliqo Technologies Limited, a company incorporated in the Federal Republic of Nigeria with registration number RC 9645282 and registered office at Lekki Gardens, Lagos, Nigeria ("Veliqo", "we", "us", or "our").

This Policy applies to all visitors, registered users, and any other persons (collectively, "you" or "Users") who access or use the Veliqo website, web application, mobile applications, application programming interfaces (APIs), and all related services (collectively, the "Platform").

We are committed to processing personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation 2019 (NDPR) where applicable, and, where we process the personal data of individuals located in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) and UK GDPR respectively. Where you are a resident of the State of California, certain provisions of the California Consumer Privacy Act (CCPA/CPRA) may also apply to you.

By accessing or using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, you must not access or use the Platform.

For the purposes of this Policy, the following terms shall have the meanings assigned below:

• Personal Data — any information relating to an identified or identifiable natural person, including a name, email address, identification number, location data, or online identifier.
• Processing — any operation performed on personal data, whether or not by automated means, including collection, recording, storage, use, disclosure, and erasure.
• Data Controller — the entity which determines the purposes and means of processing personal data. For the Platform, Veliqo is the Data Controller.
• Data Processor — a third party that processes personal data on behalf of the Data Controller.
• Data Subject — the identified or identifiable natural person to whom personal data relates.
• NDPA — the Nigeria Data Protection Act 2023 and any regulations, directives, or guidance issued thereunder.
• Consent — any freely given, specific, informed, and unambiguous indication of the Data Subject's agreement to the processing of their personal data.

We collect personal data in the following categories, depending on how you interact with the Platform:

3.1 Data You Provide Directly

3.2 Data Collected Automatically

3.3 Data From Third Parties

Where you sign in using a third-party authentication provider (such as Google), we receive your name, email address, and profile identifier from that provider in accordance with the permissions you grant. We may also receive aggregated, non-identifying analytics and advertising performance data from our advertising partners.

We process your personal data for the following purposes:

• To create, maintain, and administer your account and provide the Platform's features and services;
• To deliver personalised functionality such as watchlists, saved screens, portfolio tracking, and price alerts;
• To communicate with you regarding service updates, security notices, and (where you have consented) marketing communications;
• To display advertising, including personalised advertising served through Google AdSense and Google Ad Manager, as described in Section 7;
• To analyse usage patterns, improve the Platform, develop new features, and conduct internal research and analytics;
• To detect, prevent, and address fraud, security incidents, abuse, and violations of our Terms of Service;
• To comply with legal obligations, respond to lawful requests from public authorities, and enforce our legal rights.

We will not use your personal data for purposes that are incompatible with those listed above without first providing notice and, where required, obtaining your consent.

Under the NDPA and, where applicable, the GDPR, we rely on one or more of the following lawful bases to process your personal data:

Where we rely on consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interests, we have conducted a balancing assessment to ensure your rights and freedoms are not overridden.

The Platform uses cookies and similar tracking technologies (such as web beacons, pixels, and local storage) to operate, secure, analyse, and monetise the service. A cookie is a small text file stored on your device.

6.1 Categories of Cookies We Use

6.2 Managing Cookies

On your first visit, you will be presented with a cookie consent banner allowing you to accept or reject non-essential cookies. You may change your preferences at any time through the cookie settings link in the Platform footer. You may also control cookies through your browser settings, though disabling certain cookies may impair Platform functionality.

For advertising cookies served by Google, you may opt out of personalised advertising at www.google.com/settings/ads and www.aboutads.info/choices.

The Platform displays advertising as a core part of its business model. This advertising falls into two categories: programmatic advertising served by third-party networks, and direct/sponsored advertising sold by Veliqo to specific advertisers.

7.1 Google AdSense and Google Ad Manager

We use Google AdSense and Google Ad Manager to serve advertisements on the Platform. As a third-party vendor, Google uses cookies (including the DoubleClick cookie) to serve advertisements based on your prior visits to the Platform and other websites on the internet.

• Google's use of advertising cookies enables it and its partners to serve advertisements to you based on your visits to the Platform and/or other sites on the internet;
• You may opt out of personalised advertising by visiting Google's Ads Settings at www.google.com/settings/ads;
• Where Google's tools are unavailable, you may opt out of a third-party vendor's use of cookies for personalised advertising by visiting www.aboutads.info;
• Google's handling of data collected through its advertising services is governed by the Google Privacy Policy, available at policies.google.com/privacy.

7.2 Direct & Sponsored Advertising

Veliqo sells direct advertising placements and sponsorships to financial institutions, brokerages, fintech companies, and other advertisers ("Sponsors"). Sponsored content is identified with a "Sponsored", "Advertisement", or "Powered by" label. The appearance of any Sponsor on the Platform does not constitute an endorsement, recommendation, or guarantee by Veliqo of that Sponsor, its products, or its services.

We do not sell your personal data. We share personal data only in the following circumstances and with the following categories of recipients:

All Data Processors acting on our behalf are bound by written agreements that require them to process personal data only on our instructions and to implement appropriate technical and organisational security measures. In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity, subject to the protections of this Policy.

Because we use cloud infrastructure and service providers located outside Nigeria (including in the European Union and the United States), your personal data may be transferred to, stored in, and processed in countries other than your country of residence.

Where we transfer personal data outside Nigeria, we do so in accordance with the NDPA's requirements for cross-border transfers, ensuring that the recipient jurisdiction provides an adequate level of protection or that appropriate safeguards (such as standard contractual clauses or binding corporate rules) are in place. Where we transfer personal data of EEA or UK residents, we rely on transfer mechanisms recognised under the GDPR, including the European Commission's Standard Contractual Clauses.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, regulatory, or reporting requirements.

• Account data is retained for the duration of your account plus a period of 24 months following account closure, unless a longer period is required by law;
• Usage and analytics data is retained in identifiable form for up to 14 months, after which it is aggregated or anonymised;
• Marketing data is retained until you withdraw consent or object to processing.

When personal data is no longer required, we securely delete or irreversibly anonymise it.

Subject to applicable law, you have the following rights in respect of your personal data:

• Right of access — to obtain confirmation of whether we process your data and a copy of that data;
• Right to rectification — to have inaccurate or incomplete data corrected;
• Right to erasure — to request deletion of your data in certain circumstances;
• Right to restriction — to request that we limit the processing of your data;
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format;
• Right to object — to object to processing based on legitimate interests or for direct marketing;
• Right to withdraw consent — to withdraw consent at any time where processing is based on consent;
• Right to lodge a complaint — to complain to the Nigeria Data Protection Commission (NDPC) or, if you are in the EEA/UK, your local supervisory authority.

To exercise any of these rights, contact us using the details in Section 14. We will respond within the timeframe required by applicable law (generally 30 days under the NDPA). We may need to verify your identity before processing your request. The exercise of these rights is free of charge, save where requests are manifestly unfounded or excessive.

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS) and at rest, role-based access controls, secure password hashing, network firewalls, regular security testing, and access logging.

While we take reasonable steps to protect your data, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the NDPC and affected individuals as required by the NDPA.

The Platform is not directed to, and is not intended for use by, persons under the age of 18 years. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without verified parental or guardian consent, we will take steps to delete that data promptly. If you believe a child has provided us with personal data, please contact us using the details in Section 14.

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated Policy on the Platform with a revised "Last Updated" date and, where appropriate, by additional notice such as email.

If you have questions, concerns, or requests regarding this Policy or your personal data, please contact us using the details below.