Privacy Policy

Rockshield Microfinance Bank Limited ("Rockshield MFB", "we", "us" or "our") is a Central Bank of Nigeria (CBN) licensed microfinance bank whose depositors' funds are insured by the Nigeria Deposit Insurance Corporation (NDIC). We are committed to protecting the privacy of everyone who visits our website, uses our banking channels or interacts with our staff.

This Privacy Policy is issued in compliance with the Nigeria Data Protection Act 2023, the Nigeria Data Protection Regulation (NDPR) 2019 and applicable CBN customer-protection guidelines. It applies to all customers, prospective customers, website visitors, mobile app users, guarantors, next-of-kin and any other person whose personal data we process.

• Identity data — full name, date of birth, gender, marital status, photograph, signature, BVN, NIN and government-issued ID numbers.
• Contact data — residential and business address, email address, mobile number and next-of-kin details.
• Financial data — account numbers, transaction history, balances, income, employer details, loan applications and repayment records.
• Technical data — IP address, device identifiers, browser type, operating system, geolocation and log files when you use our website or mobile app.
• Behavioural data — pages visited, features used and preferences within our digital channels.
• KYC and due-diligence data — utility bills, employment letters, tax identification, source-of-funds evidence and CAC documents where applicable.

We collect information directly from you when you open an account, apply for a loan, request a card, use our mobile app or contact us. We also receive information from:

• Credit bureaus and other licensed reference agencies.
• The Central Bank of Nigeria and the NDIC.
• The Nigerian Interbank Settlement System (NIBSS) and other financial-market infrastructure providers.
• Your employer or business partners where you have authorised this.
• Publicly available sources such as regulatory registries.

• To open, operate and maintain your accounts and process your transactions.
• To perform Know-Your-Customer (KYC), anti-money-laundering (AML) and counter-terrorism-financing (CFT) checks.
• To assess credit applications and manage credit exposure.
• To detect, investigate and prevent fraud, cybercrime and financial abuse.
• To meet obligations to the CBN, NDIC, EFCC, FIRS, NFIU and other regulators.
• To improve our products, personalise your experience and provide customer support.
• To send you transaction alerts, statements, service updates and — with your consent — marketing communications.

We process your personal data on one or more of the following lawful bases under the Nigeria Data Protection Act: performance of a contract; compliance with a legal obligation; your consent; protection of vital interests; and our legitimate interests in providing safe, efficient banking services.

We do not sell your personal information. We may share it with:

• Regulators and law-enforcement agencies where required by law.
• NIBSS, card schemes (Verve, Mastercard, Visa), switching companies and other payment infrastructure providers to complete your transactions.
• Licensed credit bureaus for credit assessment and reporting.
• External auditors, legal advisers and professional consultants under strict confidentiality.
• Technology service providers (cloud hosting, SMS, email, analytics) bound by written data-processing agreements.
• Recovery agents where a loan account has become delinquent.

We retain your personal data for as long as your relationship with the Bank is active and for a minimum of ten (10) years after account closure, in line with CBN and NDIC record-keeping requirements — or longer where required for legal, tax or regulatory purposes.

We apply administrative, physical and technical safeguards — including encryption in transit, access controls, multi-factor authentication, network segmentation, staff training and regular penetration testing — to protect your information from unauthorised access, alteration, disclosure or destruction.

Subject to Nigerian data-protection law, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data where we no longer need it and no law requires us to keep it.
• Object to or restrict certain processing.
• Withdraw consent to marketing at any time.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

Our website uses cookies and similar technologies. Please refer to our Cookie Policy for full details on the categories used and how to manage them.

Our website and app may contain links to third-party sites. We are not responsible for the privacy practices of those sites and encourage you to read their policies.

Our services are not directed at persons under 18 without the consent of a parent or legal guardian. We do not knowingly collect personal data from minors outside our documented under-18 savings products.

We may update this Privacy Policy from time to time. Material changes will be communicated via our website, email or in-app notifications.

Questions, complaints or data-subject requests can be sent to:

Data Protection Officer
Rockshield Microfinance Bank Limited
79 Ladipo Street, Mushin, Lagos State
Email: dpo@rockshieldmfb.com