Privacy Policy

Lucred Technologies is the data controller responsible for your personal data collected through the Service. If you have any questions about how we handle your data, contact our Data Protection Officer at privacy@lucred.co.

We collect the following categories of personal data:

a) Information you provide

• Full name, email address, phone number, and date of birth
• Government-issued ID and proof of address (for KYC verification)
• Delivery address (for physical card issuance)
• Wallet address on the Celo network (if using MiniPay repayment)
• Communications with our support team

b) Information generated automatically

• Device information (type, OS, browser, app version)
• IP address and approximate location
• Log data including pages visited, timestamps, and errors
• Session and authentication tokens

c) Financial and transactional data

• Card transaction history (merchant name, amount, date, status)
• Repayment records and outstanding balances
• Credit performance scores and tier information
• On-chain transaction hashes for stablecoin repayments
• Sub-account details assigned for bank transfer repayments

d) Information from third parties

• Identity verification results from our KYC partner
• Card transaction data from Sudo Africa (our card infrastructure provider)
• Bank account verification data from our payment processing partners

We use your personal data to:

• Create and manage your Lucred account
• Conduct KYC and AML checks as required by law
• Issue and manage your virtual and physical cards
• Process transactions and repayments
• Calculate credit limits, performance scores, and interest
• Detect and prevent fraud, abuse, and security incidents
• Send transactional notifications (repayment reminders, grace period alerts)
• Provide customer support
• Comply with legal and regulatory obligations
• Improve the Service through anonymised analytics (we never sell personal data for advertising)

We process your personal data on the following legal bases under the Nigeria Data Protection Act (NDPA) and applicable regulations:

• Contract performance: Processing necessary to provide the Service you have signed up for.
• Legal obligation: KYC, AML, and tax compliance.
• Legitimate interests: Fraud prevention, security, and improving our Service.
• Consent: For marketing communications (you may withdraw consent at any time).

We do not sell your personal data. We share your data only in the following circumstances:

• Service providers: Card infrastructure (Sudo Africa), KYC verification partners, cloud hosting providers, and payment processors — bound by data processing agreements.
• Regulatory authorities: When required by Nigerian law, a court order, or a financial regulator (e.g. CBN).
• Fraud prevention: With other financial institutions or law enforcement where we suspect fraud or illegal activity.
• Business transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred to the acquiring entity subject to equivalent privacy protections.

We require all third-party processors to implement appropriate security measures and prohibit them from using your data for their own purposes.

When you use MiniPay stablecoin repayment, your Celo wallet address and on-chain transaction hashes are recorded. Please be aware that blockchain transactions are publicly visible and immutable by nature. Lucred has no ability to reverse or erase data recorded on the Celo blockchain. We store only the minimum on-chain data required to verify and reconcile repayments.

We retain your personal data for as long as your account is active and as required by applicable law:

• Account and identity data: 7 years after account closure (AML/KYC regulatory requirement)
• Transaction records: 7 years (financial records regulation)
• Support communications: 3 years
• Log data: 12 months

After retention periods expire, data is securely deleted or anonymised.

We implement industry-standard security measures to protect your personal data:

• End-to-end encryption for card sensitive data (PAN, CVV, PIN) via Sudo Vault — never stored on Lucred servers
• TLS/HTTPS encryption for all data in transit
• AES-256 encryption for data at rest
• Token-based authentication with short-lived session tokens
• Regular security audits and penetration testing
• Strict internal access controls and role-based permissions

Despite these measures, no system is completely secure. If you suspect a security breach involving your account, contact us immediately at security@lucred.co.

Under the Nigeria Data Protection Act (NDPA) and other applicable laws, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your data (subject to legal retention obligations).
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Restriction: Request that we restrict processing in certain circumstances.
• Withdraw consent: For processing based on consent (e.g. marketing emails), at any time.

To exercise any of these rights, email privacy@lucred.co with the subject line "Data Subject Request". We will respond within 30 days.

The Lucred web application uses strictly necessary session cookies to maintain your authenticated session. We do not use third-party advertising or tracking cookies. Analytics, if collected, are anonymised and aggregate only.

The Service is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of significant changes via in-app notification or email at least 14 days before the changes take effect. The "effective date" at the top of this page will always reflect the latest version.

For questions, requests, or complaints about this Privacy Policy:

• Data Protection Officer: privacy@lucred.co
• General support: support@lucred.co

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.