Parkway’s Privacy Policy

At Parkway Projects Limited ("Parkway”, "we,” "us," or "our"), we respect the privacy of our online visitors and registered users ("Users"), and as such, we will take reasonable steps to protect your information.

This Privacy Policy describes how we collect and use Personal Data from customers and other individuals collectively ("YOU", "YOUR"), who access or use our websites, which are collectively referred to herein as our ("Website"), products, or services (the "Services").

"Personal Data" is any information that relates to an identified or identifiable individual. By using our Services, you understand that we will collect and use your data as described in this Privacy Policy. Parkway developed this Privacy Policy to explain how we may manage, process, share, store, and transfer Personal Data that you provide when you use any of our products. All collection, use, and disclosure of your Personal Data will be governed by this Privacy Policy.

The Websites and the Services are not meant for individuals under the age of 18 years of age. We do not knowingly collect Personal Data from individuals under 18. If you are under 18, we request that you not provide Personal Data through this Website or our Services. If we learn we have collected or received personal data from an individual under 18, we will delete that information. If you believe we might have any information from or about a minor under 18, don't hesitate to contact us at dpo@parkway.ng

By accessing our website and services, as well as by clicking the “I accept” button, you acknowledge and fully understand this Privacy Policy Statement and freely consent to the information collection and use practices described in this Privacy Policy Statement.

Parkway obtains Personal Data about you from various sources to provide and manage our products and services. You may be a visitor to one of our websites, a user of one or more of our Services, or a customer of one of our Services. In cases where we act as a data processor, your Personal Data may also be governed by a separate agreement between you and a third party that is interacting with our Services on your behalf, although generally subject to the provisions of relevant laws on data protection, including the NDPA. If you have questions about this scenario, direct them to the user with whom you are transacting. Where such questions come to us directly, we may respond to them through the appropriate party that obtained your Personal Data.

Personal Data we collect directly from you may include:

• Financial information: such as Bank Verification Number (BVN) and personal account details.
• Identity Data: Information such as your full name(s), your sex, nationality, photograph, liveliness video, State, LGA, date of birth, and National Identity number
• Personal contact information including your home address, personal telephone number(s) and personal email address.
• Business contact information if applicable including business email address, telephone number, and office address.
• Cardholder data: Information such as Primary Account Number (PAN), cardholder name or expiration date.

We collect information directly when you:

• Create an account for any of our products or services.
• Fill our online forms
• Contact our product support team
• Contact us through any of our websites

When you visit our website or subscribe to any of our services, our company servers will automatically record information that your browser sends whenever you visit a website. This data may include:

• Your computer's IP address
• Browser type
• The pages within the website you visit
• The time spent on those pages, items, and information searched for on our site, access times and dates, and other statistics.

This information is collected for analysis and evaluation to help us improve our site and the services and products we provide. This data will not be used in association with any other personal information.

We will only use and share your information where it is necessary for us to carry out our lawful business activities and in accordance with the data protection principles required under the Nigeria Data Protection Act (NDPA) 2023. This means that all processing of your Personal Data will be:

• Lawful, fair, and transparent – we process your information in ways that are permitted by law, are fair to you, and clearly explained.
• For specified and legitimate purposes – we only collect and use your information for clearly defined business, regulatory, and service-related purposes, and we do not use it for unrelated or undisclosed activities.
• Adequate, relevant, and limited to what is necessary – we only request and process the information needed to deliver our services and comply with legal obligations.
• Accurate and kept up to date – we take reasonable steps to ensure your information remains correct, and we encourage you to notify us of changes.
• Protected with appropriate security measures – we implement suitable technical and organisational safeguards to protect your data from loss, misuse, or unauthorised access

In line with these principles, the lawful bases for processing your Personal Data are:

Legal obligationWhen you sign up for one of our products or services (and throughout your relationship with us), we are required by law to collect and process certain personal information about you. This ensures we are fully compliant with all applicable financial legislation such as AntiMoney Laundering and Counter-Terrorist Financing Laws.

Contractual NecessityWe may process your information where it is necessary to enter a contract with you to provide our products or services or perform our obligations under that contract.

Legitimate interestsWe may process your information in our legitimate interests as an organization and without prejudicing your interests or fundamental rights and freedoms.

ConsentYou consent to us collecting your Personal Data by using our Services. You have the right to withdraw your consent at any time, if we do not have another legal basis to keep processing your data.

When using our Services: We may collect and use the following kinds of personal data provided by you for the purposes of registering with us, such as information about transactions carried out over the website, information that you provide for the purpose of subscribing to our services and any other information that you send to us.

Marketing and Promotions: We may use your personal data to send you information about our services and products, supply the services that you purchase, send you statements and invoices, collect payments from you, and send you marketing communications.

Third Party disclosure: Where we disclose your personal data to our agents or subcontractors for these purposes, the agent or subcontractor in question will be obligated to use that personal data per the terms of this privacy statement.

In addition to the disclosures necessary for the purposes identified elsewhere above, we may disclose your personal data to the extent that it is required to do so by law, in connection with any legal proceedings or prospective legal proceedings, and to establish, exercise, or defend our legal rights. Also, personal data may be disclosed where it is necessary to prevent a threat to life or health.

We may also disclose information about our users to law enforcement officers or others in good faith that such disclosure is reasonably necessary to: enforce our Terms of Use, respond to claims that any posting or other content violates the rights of third parties; or protect the rights, property, or personal safety of Parkway, its users, or the general public.

We may provide the data collected from you to members of our group companies or other third parties, including our agents and contractors, in connection with the service. We will inform you before disclosing your information to any third party. Suppose you can be identified from the information that is disclosed. In that case, we will not disclose such information without prior notification to you, and we will obtain your permission to do so. You may inform us at any time not to pass on or share your personal data with any third parties.

The information you provide when you subscribe to any of our services may be required to access our products. We will store this information and data and use it to contact you, provide you with further details of the services and otherwise for the normal use, provision of services, and improvement of the site, unless you ask us not to do so.

The information may be disclosed to third parties to enable you to gain access to any restricted part of the site, enable you to receive data that you have requested to be sent to you by post, or for you to receive specified services.

We want to make sure you are fully aware of all your data protection rights. Every user is entitled to the following:

• The right to access – You have the right to request copies of your data. We may charge you a small fee for this service. We will respond to your access request within one month of receiving your request. Where we are not able to provide this personal data to you within the One-Month timeline provided by law, we will communicate the same to you and may request an additional time within which we will provide the information to you. Your Personal Data shall be provided to you in a structured, commonly used, and machine-readable format.
• The right to rectification – You have the right to request that we correct any information you believe is inaccurate. You also have the right to request that we complete the information you think is incomplete.
• The right to erasure – You have the right to request that we erase your data.
• The right to restrict processing – You have the right to request that we restrict the processing of your data.
• The right to object to processing –You have the right to object to the processing of your personal data where such processing affects your freedom, privacy, or dignity. You may also object at any time to the use of your personal data for direct marketing purposes. This right may be overridden where the processing is necessary for reasons of national security, the prevention or investigation of crimes, the protection of the rights and freedoms of others, or for other overriding public interest and considerations.
• The right not to be subjected to automated decision-making – You have the right to express concern when your personal data is used for automated decision-making processes, including activities such as risk profiling or fraud-scoring algorithms. Where such decisions significantly affect you, you have the right to request human intervention, to obtain an explanation of the decision, and to contest the outcome.
• The right to data portability - You have the right to request that we transfer the data that we have collected to another organisation or directly to you under certain conditions.

If you would like to exercise any of these rights, don't hesitate to get in touch with us at dpo@parkway.ng.

We are committed to managing your information with the highest standards of information security.

We have implemented various measures, following best practice standards such as the Information security management standard (ISO 27001) and Payment Card Industry Data Security Standard ("PCI-DSS"), to help ensure the security and confidentiality of personal information housed in our system.

These measures include appropriate administrative, technical, and physical safeguards designed to protect against anticipated threats or hazards to the security or integrity of such information and unauthorised access to or use of such information.

We use computer safeguards such as firewalls and data encryption, pseudonymization, enforce physical access to our buildings and files, and only authorise access to personal information to employees who require it to fulfil their job responsibilities.

We maintain a business continuity plan as a contingency plan, which identifies our business functions, and assets (including personal data) that would need to be maintained in the event of a disaster and set out the procedures for protecting and restoring them if necessary.

In respect of detection and investigation of breaches where they occur, we have in place relevant controls, which should alert us to a breach in security. We endeavor to investigate every breach of security.

In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data, we shall, within 72 (Seventytwo) hours of knowing about such breach, report the details of the breach to the regulatory authority

Furthermore, where we ascertain that such a breach is detrimental to your rights and freedoms in relation to your Personal Data, we shall, within 7 (Seven) days of knowing the occurrence of such a breach, take steps to inform you of the breach incident, the risk to your rights and freedoms resulting from such breach, and any course of action to remedy said breach.