Privacy Policy

1. Policy Statement

This Privacy Policy sets out the basis upon which LasLas Digital Services Ltd (“LasLas”, “the Company”, “we”, “our”, or “us”) collects, processes, stores, discloses, and protects personal data in accordance with the Nigeria Data Protection Regulation (NDPR), applicable guidelines issued by the Central Bank of Nigeria (CBN), and other relevant data protection and financial services laws in the Federal Republic of Nigeria. By accessing or using any of the Company’s platforms, products, or services, you (“User”, “Data Subject”) expressly consent to the collection and processing of your personal data in accordance with this Policy.

2. Scope of Application

This Policy applies to all personal data processed by LasLas in connection with:

• Digital financial services and transaction processing
• Customer onboarding and identity verification (KYC)
• Agency banking, remittances, and merchant services
• Insurance onboarding and related financial integrations
• Website, mobile applications, and digital platforms

3. Categories of Personal Data Collected

LasLas may collect and process, including but not limited to, the following categories of personal data:

• Identity Data: Full name, date of birth, gender, government-issued identification (e.g., NIN, BVN, passport)
• Contact Data: Phone number, email address, residential and business address
• Financial Data: Bank account details, transaction history, payment records
• Technical Data: IP address, device identifiers, login credentials, usage logs
• Behavioral Data: Transaction patterns, service usage behavior, risk profiling indicators

4. Legal Basis for Processing

LasLas processes personal data on the following lawful bases:

• Consent of the Data Subject
• Performance of a Contract to which the Data Subject is a party
• Compliance with Legal and Regulatory Obligations, including AML/CTF requirements
• Legitimate Business Interests, provided such interests do not override fundamental rights

5. Purpose of Data Processing

Personal data is processed strictly for the following purposes:

• Customer identification and verification (KYC compliance)
• Execution and settlement of financial transactions
• Fraud detection, prevention, and risk management
• Compliance with regulatory and statutory obligations
• Customer support and service delivery
• Product development, analytics, and operational improvement

6. Data Sharing and Disclosure

LasLas may disclose personal data to:

• Licensed financial institutions, payment processors, and service partners as legally binding.
• Regulatory authorities, law enforcement agencies, and government bodies where required by law.
• Third-party service providers engaged in data processing on behalf of LasLas.

All disclosures are made subject to strict confidentiality obligations and in compliance with applicable data protection laws.

7. Cross-Border Data Transfer

Where personal data is transferred outside Nigeria, LasLas shall ensure that:

• Adequate data protection safeguards are in place.
• Transfers comply with NDPR requirements.
• Recipient entities maintain equivalent levels of data protection.

8. Data Security Measures

LasLas implements appropriate technical and organizational measures, including but not limited to:

• Encryption of sensitive data
• Role-based access controls
• Multi-factor authentication mechanisms
• Continuous monitoring and threat detection systems

These measures are designed to prevent unauthorized access, disclosure, alteration, or destruction of personal data.

9. Data Retention

Personal data shall be retained only for as long as necessary to:

• Fulfill the purposes for which it was collected
• Comply with legal, regulatory, and audit requirements
• Resolve disputes and enforce contractual obligations

Upon expiration of retention periods, data shall be securely deleted or anonymized.

10. Rights of Data Subjects

In accordance with NDPR, Data Subjects have the right to:

• Request access to their personal data
• Request correction or rectification of inaccurate data
• Request erasure of personal data, subject to legal limitations
• Object to or restrict processing under certain conditions
• Withdraw consent at any time, without affecting prior lawful processing

Requests may be submitted through designated communication channels.

11. Cookies and Tracking Technologies

LasLas may utilize cookies and similar technologies to:

• Enhance user experience
• Analyze platform usage
• Improve service performance

Users may control cookie preferences through their device or browser settings.

12. Breach Notification

In the event of a data breach, LasLas shall:

• Take immediate steps to contain and mitigate the breach
• Notify relevant regulatory authorities where required
• Inform affected Data Subjects where there is a significant risk

13. Limitation of Liability

LasLas shall not be liable for:

• Unauthorized access arising from user negligence or ignorance
• Users Unauthorized share of data to third party applications or business
• Third-party breaches beyond the Company’s reasonable control
• Indirect or consequential damages arising from data-related incidents

Liability shall be limited to the extent permitted under applicable law.

14. Amendments to Policy

LasLas reserves the right to amend this Policy at any time to reflect:

• Changes in legal or regulatory requirements
• Technological advancements
• Operational updates

Users will be notified of material changes, and continued use of services constitutes acceptance.

15. Governing Law

This Policy shall be governed by and construed in accordance with the laws of the Federal Republic of Nigeria.

16. Contact Information

For inquiries, complaints, or data protection requests:

• LasLas Digital Services Ltd
• Suite C3, 2nd floor HCR Complex, Plot 521 Sylvester Ugo Crescent Jabi. FCT Abuja
• office@laslas.app
• +234 8176028499