Cardholder Privacy Policy

1.1 Overview. This Privacy Policy ("Policy") describes how Tiva Finance Services Ltd., a company registered in Nigeria under registration number RC 8542671, with its registered office at P10 Henry Ojogho Crescent, Lekki, Lagos, Nigeria (collectively, "Tiva," "Company," "we," "us," or "our"), collects, uses, discloses, stores, and protects personal information when you access or use the Client website at www.tivafinance.com (the "Site"), application cards.tivafinance.com (the "App"), and all services provided or facilitated thereby (collectively, the "Platform" or "Services").

1.2 Acceptance. By accessing or using the Platform, creating an Account, or otherwise providing information to us, you acknowledge that you have read, understood, and agree to the practices described in this Policy. If you do not agree to this Policy, you must immediately cease all access to and use of the Platform.

1.3 Infrastructure Partner and Technology. Platform technology is provided by SquareFi Inc., a Delaware corporation ("Technology Provider"), which supplies the technology layer only and is not a financial institution. Card program infrastructure, KYC/KYB verification checks, and AML compliance and monitoring are provided by BUYEASY TECHNOLOGY CO., LTD, a company incorporated in Ontario, Canada (the "Infrastructure Partner"), our sole Infrastructure Partner, together with its licensed financial partners (including card issuers) where applicable. All Cardholders must complete identity verification before a Card may be issued or used. We collect Customer Information through the Platform and transmit it to the Infrastructure Partner's verification flow (including tools such as Sumsub). The Infrastructure Partner performs verification checks, AML monitoring, and determines verification outcomes. The Infrastructure Partner does not itself act as the card issuer and does not have a direct contractual relationship with you unless required by applicable law.

1.4 Scope. This Policy governs personal information we collect through the Platform, including information submitted for KYC and KYB verification. All Cardholders must complete identity verification to receive or use a Card or Payment Services. Verification checks are performed by our Infrastructure Partner, BUYEASY TECHNOLOGY CO., LTD, not by us.

2.1 Information You Provide. We collect information you voluntarily provide, including: (a) account information such as full legal name, date of birth, email address, phone number, residential address, username, and password; (b) identity verification information such as government-issued identification documents, photographs, tax identification numbers, and other documentation required for verification; (c) business information for entity accounts such as registered business name, jurisdiction of incorporation, business address, nature of business, corporate documentation, and information about administrators and authorized users; (d) beneficial ownership information including names, dates of birth, addresses, identification documents, and ownership percentages of Ultimate Beneficial Owners; (e) financial information such as bank account details, payment card information, transaction history, and source of funds documentation; and (f) communications including records of correspondence with us, support inquiries, and feedback.

2.2 Information Collected Automatically. When you use the Platform, we automatically collect: (a) device information such as device type, operating system, unique device identifiers, browser type and version, and mobile network information; (b) usage information such as pages viewed, features used, clickstream data, session duration, and interaction patterns; (c) location information such as IP address, approximate geographic location, and time zone; and (d) log data such as access times, error logs, and diagnostic information.

2.3 Information from Third Parties. We may receive information from: (a) identity verification providers including results of identity checks, document verification, and fraud screening; (b) financial service providers including transaction data, account status, and compliance-related information; and (c) public sources including publicly available information for verification and compliance purposes.

2.4 Cookies and Tracking Technologies. We use cookies, pixels, and similar technologies to collect information about your use of the Platform, remember your preferences, and improve your experience. We use: (a) essential cookies required for Platform functionality and security; (b) analytics cookies to understand how users interact with the Platform; and (c) preference cookies to remember your settings. You may manage cookie preferences through your browser settings; however, disabling certain cookies may affect Platform functionality.

3.1 Service Provision. We use your information to: (a) create and manage your Account; (b) provide and operate the financial services accessed through the Platform; (c) process and display transactions; (d) provide customer support; and (e) communicate with you about your Account and Services.

3.2 Compliance and Security. We use your information to: (a) collect and transmit Customer Information for KYC/KYB verification performed by our Infrastructure Partner, BUYEASY TECHNOLOGY CO., LTD; (b) support compliance with Anti-Money Laundering ("AML") laws and regulations applicable to the Infrastructure Partner; (c) detect, prevent, and investigate fraud, unauthorized access, and other illegal activities; (d) comply with legal obligations, court orders, and regulatory requests; and (e) enforce our Cardholder Terms of Service and protect our rights.

3.3 Improvement and Analytics. We use your information to: (a) analyze usage patterns and improve the Platform; (b) develop new features and services; (c) conduct research and analytics; and (d) personalize your experience.

3.4 Communications. We use your information to: (a) send service-related notices and updates; (b) respond to your inquiries; and (c) send marketing communications where you have provided consent or as otherwise permitted by law.

4.1 Infrastructure Partner. We disclose your information to our Infrastructure Partner, BUYEASY TECHNOLOGY CO., LTD, and, where required, its licensed financial partners, to perform KYC/KYB verification checks, AML compliance and monitoring, card issuance and Payment Services, and to deliver the card program infrastructure underlying the Services. Such disclosures are made under this Policy and applicable law.

4.2 Service Vendors. We disclose information to vendors who assist us in operating the Platform, including: (a) cloud hosting, database, and secure document storage providers; (b) analytics services; (c) identity verification providers; (d) customer support tools; (e) payment processors; (f) error monitoring and diagnostics services; and (g) email, SMS, and push notification services. We use, and may from time to time engage, third-party service providers for these and similar purposes, including analytics, error monitoring, push notifications, and customer support. Such vendors are contractually obligated to protect your information and use it only for the purposes for which it was disclosed.

4.3 Legal and Compliance. We may disclose your information: (a) to comply with applicable laws, regulations, or legal processes; (b) in response to requests from government authorities or law enforcement; (c) to protect our rights, privacy, safety, or property, or that of our users or third parties; and (d) in connection with investigations of suspected fraud, illegal activity, or violations of our Cardholder Terms of Service.

4.4 Business Transfers. In connection with any merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred to the acquiring or successor entity.

4.5 With Consent. We may disclose your information for other purposes with your explicit consent.

4.6 No Sale of Personal Information. We do not sell your personal information to third parties.

5.1 Retention Period. We retain your personal information for as long as necessary to: (a) provide Services and maintain your Account; (b) comply with legal and regulatory obligations, including AML record-keeping requirements of at least five (5) years after Account closure; (c) resolve disputes and enforce agreements; and (d) meet audit and compliance requirements.

5.2 Deletion. When retention is no longer required, we shall securely delete or anonymize your information in accordance with our data retention policies and applicable law.

6.1 Security Measures. We implement appropriate technical and organizational measures to protect your information, including: (a) encryption of data in transit and at rest; (b) access controls and authentication mechanisms; (c) regular security assessments and monitoring; and (d) employee training on data protection.

6.2 No Guarantee. While we implement reasonable security measures, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your information.

6.3 Breach Notification. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will follow our incident response procedures and notify affected individuals and the relevant supervisory authorities as and when required by applicable law, without undue delay.

7.1 General Rights. Subject to applicable law and certain exceptions, you may have the right to: (a) access and obtain a copy of the personal information we hold about you; (b) request correction of inaccurate or incomplete information; (c) request deletion of your personal information; (d) request a copy of your data in a structured, machine-readable format; (e) request restriction of processing in certain circumstances; (f) object to processing based on legitimate interests; and (g) withdraw consent where processing is based on consent.

7.2 GDPR Rights. If you are located in the European Economic Area or United Kingdom, you have rights under the General Data Protection Regulation ("GDPR") and applicable local law, including the rights set forth in Section 7.1. Our legal bases for processing include: (a) performance of a contract; (b) compliance with legal obligations; (c) legitimate interests; and (d) consent.

7.3 CCPA/CPRA Rights. If you are a California resident, you have rights under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), including the right to: (a) know what personal information we collect, use, and disclose; (b) request deletion of your personal information; (c) opt-out of the sale or sharing of your personal information; (d) correct inaccurate personal information; (e) limit use of sensitive personal information; and (f) non-discrimination for exercising your rights. We do not sell your personal information.

7.4 PIPEDA Rights (Canada). If your personal information is processed under Canadian jurisdiction, the Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial privacy laws govern that processing. We rely on consent, performance of a contract, or compliance with legal obligations as the basis for processing. Subject to legal and contractual restrictions, you may withhold or withdraw consent and request access to or correction of your personal information. If you have a privacy concern that we are unable to resolve, you may contact the Office of the Privacy Commissioner of Canada (OPC).

7.5 Other Jurisdictions. If you are located in another jurisdiction with applicable data protection laws, you may have additional rights under those laws.

7.6 Exercising Rights. To exercise any of your rights, submit a request to legal@tivafinance.com. We shall respond within the timeframe required by applicable law and may require verification of your identity prior to processing your request.

7.7 Marketing Opt-Out. You may opt out of marketing communications at any time by: (a) clicking "unsubscribe" in any marketing email; or (b) contacting us at legal@tivafinance.com. You shall continue to receive transactional and service-related communications.

7.8 Automated Decision-Making. We may use automated tools for identity verification, sanctions screening, fraud detection, and risk scoring as part of providing the Services and meeting our regulatory obligations. Where an automated decision produces a legal or similarly significant effect concerning you, we provide, where required by applicable law, information about the logic involved and its significance, and a means to request human review.

8.1 Transfer Locations. Your information may be transferred to and processed in countries other than your country of residence, including the United States, where data protection laws may differ from those in your jurisdiction.

8.2 Safeguards. When we transfer data internationally, we implement appropriate safeguards as required by applicable law, including standard contractual clauses approved by relevant authorities.

The Platform is not intended for individuals under eighteen (18) years of age or the age of majority in their jurisdiction, whichever is greater. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we shall promptly delete such information.

10.1 Modifications. We may update this Policy from time to time by posting the revised Policy on the Platform and updating the "Last Updated" date. Material changes shall be communicated via email or Platform notification where required by law.

10.2 Continued Use. Your continued use of the Platform after changes become effective constitutes acceptance of the updated Policy.

10.3 Version Control. We maintain version control and update logs for this Policy for at least five (5) years. Previous versions are available upon request to legal@tivafinance.com.

Privacy Inquiries:

Tiva Finance Services Ltd.

Attn: Legal and Privacy

P10 Henry Ojogho Crescent, Lekki

Lagos, Nigeria

Email: legal@tivafinance.com

General Support:

Email: support@tivafinance.com

For inquiries regarding how your personal information is processed, please contact us using the details above.