Definitions:

1. Data protection principles

   OAK Pensions Limited is a Data Controller and Data Administrator as contemplated under the NDPR and is committed to processing data in accordance with its responsibilities under the NDPR. Article 2.5 of the NDPR requires that personal data shall be:

   1. Collected and processed in accordance with specific, legitimate and lawful purpose as consented to by you, the Data Subject;
   2. Adequate, accurate and without prejudice to the dignity of human person;
   3. Stored only for the period within which it is reasonably needed;
   4. Secured against all foreseeable hazards and breaches such as theft, cyberattack, viral attack, dissemination, manipulations of any kind, damage by rain, fire or exposure to other natural elements.

2. General provisions

   1. This policy applies to all personal data processed by OAK Pensions.
   2. This policy shall be reviewed at least annually.

3. 3. Consent

   You accept this Privacy Policy and hereby give us consent to save, process, and use your Personal Data to the extent as allowed by the law by clicking on the “accept” button. We will request for further consent when your personal data is to be transferred to a third party or when it is to be further processed in a manner which would require your further consent.
   Note that you can withdraw your consent at any time before, during and after we process your personal data.
   Personal information is information that can be directly used to identify you and includes but is not limited to your name, address, telephone number, email address and any other information of like nature.
   We may use and transfer your Personal Data either with your consent, for compliance with a legal obligation to which we are subject or when we have assessed that it is necessary for the purposes of the legitimate interests pursued by us or by a third party to whom it may be necessary to disclose information. We may also use your personal information to further develop the quality of our services.

4. Lawful, fair and transparent processing

   1. To ensure its processing of data is lawful, fair and transparent, OAK Pensions shall maintain a Register of Systems which shall be reviewed periodically.
   2. Individuals have the right to access their personal data and any such requests made to OAK Pensions shall be dealt with in a timely manner.

5. Lawful purposes

   1. All data processed by OAK Pensions is done on one of the following lawful bases: consent, contract, legal obligation, vital interests, public task or legitimate interest.

6. Personal Information

   The Personal Data we collect include but is not limited to the following:
   1. Your name, gender, date of birth, billing/delivery address, orders and receipts, email and telephone number. For your security, we will also keep an encrypted record of your login password.
   2. Details of your interactions with us through our offices, contact centres, in store or online.
   3. Copies of documents you provide to prove your age or identity where the law requires this. If you provide a passport, the data will also include your place of birth, gender and nationality.
   4. Details of your visits to our website and which site you came from to ours.

7. Purpose of Collection of Personal Data

   1. We collect your personal data in order to improve the quality of our services to you and also tailor our services to meet your individual preferences. We also collect your personal data in order to communicate any development in our services.

8. Your Rights

   1. The law gives you certain rights in respect of the information we hold about you. Below is a highlight of some of those rights. It is not a complete, exhaustive statement of your rights in respect of your personal data.
   2. You have a right to consent to this Privacy Policy and to withdraw your consent at any time.
   3. You have a right to a copy of the personal data we hold about you, as well as the information about what we do with it, who we share it with and how long we hold it for. We may make a reasonable charge for additional copies of that data in the case of unfounded and excessive requests.
   4. In the event that you request for a copy of your personal data, we will provide a copy to you within 1 (one) month of your request. Where we are unable to provide you with a copy of your personal data, we will take alternate courses of action such as communicating to you the reasons for not taking action on your request and the possibility of lodging a complaint with a supervisory authority.
   5. You have a right to freely transfer your data received from us to any other person.
   6. You have the right to have the information we hold about you corrected, if it is factually inaccurate. You may contact us for this purpose.
   7. Subject to the provisions of the NDPR, you have the right to the deletion of the information that we hold about you in certain circumstances.
   8. You have a right to lodge a complaint about the handling of your personal information with the National Information Technology Development Agency (NITDA) at info@nitda.gov.ng.
   9. You have the right to ask us not to process your personal data for marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes.
   10. NITDA’s website (https://nitda.gov.ng/) has a wealth of useful information in respect of your rights over your Personal Data. If you wish to exercise your rights, you may contact our Data Protection Officer at [jideo@oakpensions.com] or you may write to us at 266 Murtala Mohammed Way, Alagomeji, Yaba, Lagos, Nigeria.

9. Access by 3^rd Parties

   1. In the course of providing services to you, we may share your personal data with trusted third parties. We provide only information they need to perform their specific services and we will work closely with them to ensure that your privacy is respected and protected at all times. In the event that we no longer require their services, any of your data held by them will be irrecoverably deleted.
   2. For fraud management or in line with public interest, we may share information about fraudulent or potentially fraudulent activity in our system which may include sharing data about individuals with law enforcement bodies.
   3. We may also be required to disclose your personal data to law enforcement, regulatory or government body upon a valid request to do so. These requests however will be assessed on a case-by-case basis and the privacy of our customers shall be considered.

10. Data minimization

    1. OAK Pensions shall ensure that personal data are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

11. Accuracy

    1. OAK Pensions shall take reasonable steps to ensure personal data is accurate.
    2. Where necessary for the lawful basis on which data is processed, steps shall then be put in place to ensure that personal data is kept up to date.

12. Archiving / Deletion

    1. To ensure that personal data is kept for no longer than necessary, OAK Pensions shall put in place an archiving policy for each area in which personal data is processed and review this process annually.
    2. The archiving policy shall consider what data should/must be retained, for how long, and why. The archiving policy, particularly the details regarding how long information is to be stored shall be communicated to you. Where the duration for retaining such information cannot be ascertained, the criteria used to determine such period will be communicated to you.

13. Security

    1. OAK Pensions shall ensure that personal data is stored securely using modern software that is kept-up-to-date.
    2. Access to personal data shall be limited to personnel who need access and appropriate security should be in place to avoid unauthorized sharing of information.
    3. When personal data is deleted this should be done safely such that the data is irrecoverable.
    4. Appropriate back-up and disaster recovery solutions shall be in place.

14. Breach/ Privacy Violation

    In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data, OAK Pensions shall assess the risk to your rights and freedoms and if appropriate report this breach to NITDA within 72 hours of ascertaining such breach or violation poses risk to your rights and freedoms.
    
    If you feel that your data has not been handled correctly or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have a right to lodge a complaint with the National Information Technology Development Agency.

15. Cookies and Other Technologies.

    1. Cookies allow a web server to transfer data to a computer or device for recordkeeping and other purposes. We use cookies and other technologies to, among other things, better serve you with more tailored information and facilitate your ongoing access to and use of our website. If you do not want information collected through the use of cookies, there is a simple procedure in most browsers that allows you to decline the use of cookies. To learn more about cookies, please visit http://www.allaboutcookies.org/.

16. Changes to our Privacy Policy

    1. Any changes we make to this policy in the future will be posted on this page and if necessary, will be communicated to you by e-mail. Please check back frequently to see an updates or changes to this Policy.

17. Contact

    1. Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to our Data Protection Officer at [jideo@oakpensions.com] or our offices at 266 Murtala Mohammed Way, Alagomeji, Yaba, Lagos, Nigeria.