Privacy Policy
Last updated: October 15th 2026
We collect only the data we need to verify you through your employer, lend to you responsibly and collect repayments through payroll. We never sell your data and never access your phone contacts, photos or call logs. This policy follows the Nigeria Data Protection Act 2023 (NDPA). Cadnetwork Limited is the data controller.
1. What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Identity | Full name, staff ID, job title | You and your employer |
| Contact | Work email, phone number | You and your employer |
| Employment and pay | Employer, net monthly salary, employment status | Your employer |
| Bank details | Account number, bank, verified account name | You, checked through Paystack |
| Loan and wallet records | Applications, loans, repayments, withdrawals | Our platform |
| Security | PIN (stored encrypted, never visible to staff), login times, device and IP address | Our platform |
| Support | Messages, complaints, call notes | You |
We do not collect your BVN, phone contacts, photos, SMS or location.
2. Why we use it, and our legal basis
| Purpose | Legal basis under the NDPA |
|---|---|
| Verify you are a staff member and protect you from impersonation | Contract; legitimate interest in preventing fraud |
| Assess and approve loans within the 35% affordability limit | Contract |
| Disburse loans and process withdrawals | Contract |
| Share repayment schedules with your employer and record payments | Contract (your payroll deduction authority) |
| Send reminders and service messages | Contract |
| Report to credit bureaus and regulators | Legal obligation |
| Anti-money-laundering checks | Legal obligation |
| Product updates and offers | Your consent, which you can withdraw at any time |
3. Who we share it with
- Your employer: your loan amount, instalments and repayment status only, so they can run payroll deductions. They never see your wallet activity.
- Bobble Microfinance Bank: the licensed bank that funds and books your loan.
- Paystack: to pay out loans, verify bank account names and process withdrawals.
- Credit bureaus: licensed bureaus, as Nigerian law requires.
- Regulators and law enforcement: the CBN, FCCPC, NDPC or courts, when the law requires.
- Service providers: hosting, email and SMS providers, under written data-protection contracts.
We never share your data with your colleagues, family or phone contacts.
4. Transfers outside Nigeria
Some providers store data on servers outside Nigeria. We only use providers that offer adequate protection under the NDPA, such as contract clauses approved for this purpose.
5. How long we keep it
- Loan and transaction records: [6] years after your last loan closes, as financial regulations require.
- Account and verification data: until you close your account, then [2] years for fraud prevention.
- Marketing preferences: until you withdraw consent.
6. How we protect it
Data is encrypted in transit and at rest. PINs are hashed. Staff access is limited to what their role needs and is logged. We will tell you and the Nigeria Data Protection Commission (NDPC) within 72 hours of a breach that puts your data at risk.
7. Your rights
Under the NDPA you can:
- Ask for a copy of your data.
- Correct wrong or incomplete data.
- Ask us to delete data we no longer need (we must keep loan records the law requires).
- Object to or restrict some processing.
- Withdraw marketing consent.
- Ask for your data in a portable format.
- Complain to the Nigeria Data Protection Commission.
Email [privacy email] to use any of these rights. We will reply within 30 days.
8. Children
Promise is only for adults aged 18 and over. We do not knowingly collect data about anyone under 18.
9. Changes
We will tell you of significant changes by email or in the app before they take effect.
10. Contact
info@cadnetwork.org