Privacy Policy

Who We Are

Chadvent MPCS ("we", "us", "our") is a cooperative financial services platform operated by Chadvent Nigeria Limited, a company registered under the laws of the Federal Republic of Nigeria. We provide a mobile application and related services for cooperative societies and their members to manage savings, deposits, loans, and transactions.

Our registered address is: Nigeria. For all privacy-related enquiries, contact our Data Protection Officer at privacy@chadventmpcs.ng.

By creating an account and using the Chadvent MPCS app, you agree to the collection and use of information as described in this Privacy Policy, in accordance with the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act 2023.

Information We Collect

2.1 Information You Provide Directly

• Identity information: Full name, date of birth, gender, nationality
• Contact information: Phone number, email address, residential address
• Cooperative membership details: Member ID, cooperative society affiliation, membership date
• Financial information: Bank Verification Number (BVN), account numbers, transaction history, savings contributions, loan applications and repayment data
• Identity documents: Government-issued ID (NIN slip, National ID card, driver's licence, international passport) for KYC verification
• Next of kin information: Name, relationship, and contact details of your designated next of kin

2.2 Information Collected Automatically

• Device information (model, operating system, unique device identifiers)
• App usage data (screens viewed, features used, session duration)
• Log data (IP address, timestamps, error logs, crash reports)
• Location data (only when you grant permission, used solely for fraud detection)

2.3 Information from Third Parties

• Paystack: Payment confirmation data, transaction references, and payment status from our payment processor
• Your cooperative society administrators: Account setup data, membership verification, and administrative updates

How We Use Your Information

We use your information strictly for the following purposes:

• Account creation and management: To register you, set up your cooperative accounts, and verify your identity
• Transaction processing: To process deposits, withdrawals, loan disbursements, and repayments accurately and in real time
• Financial record keeping: To maintain accurate account balances, generate transaction histories, and produce downloadable receipts
• Loan management: To evaluate loan applications, process approvals, and track repayment schedules
• Notifications: To send push notifications, SMS, and email alerts for transactions, account activity, and important updates
• Security and fraud prevention: To detect suspicious activity, prevent unauthorised access, and verify payment authenticity via Paystack webhooks
• Legal compliance: To fulfil our obligations under Nigerian financial regulations, anti-money laundering (AML) laws, and cooperative society regulations
• Customer support: To respond to your enquiries, complaints, and support requests
• App improvement: To analyse usage patterns and fix bugs to improve the user experience

Financial Data & Payments

All financial transactions within Chadvent MPCS are processed through Paystack, a PCI-DSS compliant payment processor. We do not store your card details on our servers. Payment card information is handled entirely by Paystack and subject to their privacy policy.

Transaction data — including amounts, timestamps, account types, narrations, and references — is stored securely on our servers as part of your financial record and audit trail. This data is essential for the operation of your cooperative accounts and is retained as required by Nigerian financial regulations.

All balance updates are performed using atomic database transactions, ensuring that your financial records are always accurate and tamper-proof. Every update is logged with a full audit trail including the initiating user, timestamp, and transaction reference.

We use Paystack webhook verification to confirm the authenticity of every payment before crediting your account. This means your balance is only updated after we have independently verified that a genuine payment was made.

Data Sharing

We do not sell, rent, or trade your personal data. We share your information only in these limited circumstances:

• Your cooperative society administrators: Administrators of your registered cooperative society may view your account balances, contribution history, loan status, and membership information as part of cooperative management functions
• Paystack: We share payment initiation data (amount, account reference, customer email) with Paystack to process transactions
• Service providers: Cloud hosting, database management, and SMS/push notification providers who are contractually bound to protect your data and process it only on our instructions
• Legal and regulatory authorities: Where required by Nigerian law, court order, or regulatory directive (e.g. CBN, EFCC, NFIU, or cooperative registrar)
• Business transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred. You will be notified in advance

All third-party service providers are required to implement appropriate data protection measures and are prohibited from using your data for their own purposes.

Data Security

We implement multiple layers of technical and organisational security measures to protect your data:

• Encryption in transit: All data transmitted between the app and our servers is encrypted using TLS 1.3
• Encryption at rest: Sensitive data fields (including financial data and identity documents) are encrypted in our database
• Atomic transactions: All balance changes use atomic database operations to prevent partial updates or data corruption
• Webhook verification: Every Paystack payment is verified using HMAC-SHA512 signature validation before any account is credited
• Backend validation: All financial operations are validated server-side; no client-side input is trusted without independent verification
• Audit logging: Every action on your account is logged with timestamps, IP addresses, and user identifiers
• Access control: Our staff access to production data is strictly limited on a need-to-know basis and is fully audited
• Regular security reviews: We conduct periodic security assessments and penetration tests of our infrastructure

Data Retention

We retain your data for as long as your cooperative membership account is active and for a period of 7 years after account closure, as required by Nigerian financial regulations and the Companies and Allied Matters Act (CAMA).

Transaction records and financial audit trails are retained for a minimum of 7 years from the date of each transaction, in compliance with AML/CFT regulations applicable to cooperative financial institutions.

If you request deletion of your account, we will deactivate your access immediately and permanently delete your personal data within 30 days, except where retention is required by law or for the resolution of any outstanding financial obligations.

Your Rights

Under the Nigeria Data Protection Act 2023 and NDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete personal data
• Right to erasure: Request deletion of your personal data (subject to legal retention obligations)
• Right to data portability: Request your data in a structured, machine-readable format
• Right to object: Object to processing of your data in certain circumstances
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time
• Right to lodge a complaint: File a complaint with the Nigeria Data Protection Commission (NDPC)

To exercise any of these rights, contact our Data Protection Officer at privacy@chadventmpcs.ng. We will respond within 30 days of receiving your request.

Cookies & Tracking

The Chadvent MPCS mobile app does not use browser cookies. However, we use the following mobile tracking technologies:

• Device identifiers: Used for security purposes and to maintain your logged-in session
• Push notification tokens: Used to send you transaction alerts and account notifications (you may opt out in your device settings)
• Analytics: Anonymised, aggregated usage analytics to understand how features are used and improve the app. No personally identifiable information is included in analytics data

You may opt out of analytics collection at any time from within the app settings menu.

Children's Privacy

Chadvent MPCS is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please contact us immediately at privacy@chadventmpcs.ng and we will delete the account and associated data promptly.

Cooperative society junior savings accounts (where permitted by the cooperative's rules) must be managed by a parent or legal guardian who is themselves a registered member.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will:

• Notify you via push notification and in-app banner at least 14 days before the changes take effect
• Send an email to your registered email address
• Update the "Last Updated" date at the top of this policy

Continued use of the Chadvent MPCS app after the effective date constitutes your acceptance of the updated Privacy Policy. If you do not agree, you may close your account before the changes take effect.

Contact Us

For all privacy-related questions, data subject requests, or concerns, please reach our Data Protection Officer: