Privacy Policy

1. Introduction and Identity of the Data Controller

1.1 This Privacy Policy ("Policy") is issued by BrikkShare Technologies Limited ("BrikkShare", "we", "us", or "our"), the operator of the BrikkShare digital property investment platform, accessible via our website at www.brikkshare.com and our mobile application ("the Platform"). BrikkShare is incorporated under the laws of the Federal Republic of Nigeria and is registered with the Corporate Affairs Commission

1.2 This Policy sets out how BrikkShare collects, uses, stores, shares, transfers, and protects your personal data when you access or use the Platform. It also sets out your rights in relation to your personal data and how to exercise them.

1.3 BrikkShare is a data controller within the meaning of the Nigeria Data Protection Act 2023 ("NDPA 2023") and is registered with the Nigeria Data Protection Commission ("NDPC") as a data controller of major importance. Registration ID: NDPC/DCP/13260

1.4 This Policy should be read alongside our Terms and Conditions, which govern your use of the Platform generally. By accessing or using the Platform, creating an account, or investing through the Platform, you confirm that you have read and understood this Policy.

2. Scope and Application

2.1 This Policy applies to all personal data processed by BrikkShare in connection with the Platform, including personal data collected through our website, mobile application, customer communications, KYC onboarding process, and investment transactions.

2.2 This Policy applies to all users of the Platform, including individual investors, corporate investors, registered users who have not yet invested, and visitors to our website.

2.3 Where third-party services or linked websites are accessible from the Platform, those third parties operate their own privacy policies. BrikkShare is not responsible for the data practices of third parties, and we encourage you to review their policies before sharing any personal data with them.

3. Personal Data We Collect

3.1 BrikkShare collects the following categories of personal data, depending on the nature of your interaction with the Platform:

a) Identity and Verification Data

1. i. Full legal name
2. ii. Date of birth
3. iii. Nationality and country of residence
4. iv. Government-issued identification — National Identification Number (NIN), Bank Verification Number (BVN), international passport, driver's licence, or other acceptable identity document
5. v. Biometric data collected for identity verification purposes (where applicable, via our KYC service providers)
6. vi. Photograph or selfie submitted for liveness verification

b) Contact and Account Data

• Email address
• Phone number
• Residential and correspondence address
• Username and account login credentials (stored in encrypted form)

c) Financial and Investment Data

1. i. Bank account name and number
2. ii. Investment amounts, portfolio composition, and transaction history
3. iii. Wallet balance and payout records
4. iv. Source of funds information (where required for AML/CFT compliance)
5. v. Tax identification number (where applicable or required)

d) Technical and Usage Data

1. i. IP address and device identifier
2. ii. Device type, operating system, and browser type
3. iii. App usage data, including pages visited, features accessed, and session duration
4. iv. Location data (general, not precise GPS, derived from IP address)
5. v. Cookies and similar tracking technology data (see Section 10)

e) Communications Data

1. i. Records of your communications with BrikkShare customer support
2. ii. Feedback, reviews, or survey responses you submit
3. iii. Records of your consent to receive marketing communications

3.2 BrikkShare does not knowingly collect personal data from individuals under the age of 18. If you are under 18, you must not use the Platform. If we become aware that we have inadvertently collected personal data from a minor, we will delete it promptly. As an additional technical control, the Platform's registration process will not permit account creation where a date of birth entered indicates the applicant is under 18 years of age.

4. How We Collect Your Personal Data

4.1 We collect personal data through the following means:

a) Directly from You

1. i. When you register an account on the Platform
2. ii. When you complete the KYC onboarding process
3. iii. When you make an investment or carry out a transaction
4. iv. When you contact our customer support team
5. v. When you respond to surveys or participate in promotions
6. vi. When you subscribe to our newsletter or marketing communications

b) Automatically

1. i. When you access our website or mobile application, through cookies and similar tracking technologies (see Section 10)
2. ii. Through our analytics tools, which collect aggregated usage data
3. iii. Through your device settings and operating system where permissions have been granted

c) From Third Parties

1. i. From identity verification service providers when they carry out verification checks on your behalf
2. ii. From credit reference agencies or anti-fraud databases, where permitted by law
3. iii. From government or regulatory databases in connection with KYC and AML compliance
4. iv. From payment processors in connection with transaction processing and fraud prevention

5. Lawful Basis and Purposes of Processing

5.1 BrikkShare processes your personal data on the following lawful bases under the NDPA 2023 and applicable data protection law:

5.2 We process your personal data for the following purposes:

1. a) To verify your identity and carry out know-your-customer (KYC) and anti-money laundering (AML) checks as required by Nigerian law
2. b) To create and administer your account on the Platform
3. c) To process your investments, execute transactions, and manage your portfolio
4. d) To disburse returns and payouts to your designated bank account
5. e) To communicate with you about your account, transactions, and investments
6. f) To detect and prevent fraud, financial crime, and unauthorised access
7. g) To comply with our legal and regulatory obligations, including reporting to the NDPC, EFCC, and other authorities where required by law
8. h) To improve the Platform's features, performance, and user experience
9. i) To send you marketing communications about BrikkShare products and investment opportunities, where you have consented to receive them
10. j) To respond to your enquiries and resolve complaints

6. Disclosure and Sharing of Personal Data

BrikkShare does not sell your personal data to third parties. We do not share your personal data except in the circumstances described in this section.

6.1 Service Providers and Data Processors

We share personal data with trusted third parties who provide services on our behalf, subject to binding contractual data processing agreements. These include:

6.2 Property Developers and Sponsors

Where you invest in a specific property, BrikkShare may share relevant details of your investment with the property developer or sponsor as required to give effect to the investment structure. We do not share more information than is necessary for this purpose.

6.3 Legal and Regulatory Disclosure

We may disclose your personal data to governmental, regulatory, or law enforcement authorities where we are required or permitted to do so by law. This includes:

1. a) The Nigeria Data Protection Commission (NDPC)
2. b) The Financial Intelligence Unit (FIU) and the Economic and Financial Crimes Commission (EFCC) in connection with AML/CFT obligations
3. c) The Securities and Exchange Commission (SEC) of Nigeria where required by securities regulation
4. d) Any court of competent jurisdiction pursuant to a valid order

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of BrikkShare's business or assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify you before your personal data is transferred and becomes subject to a different privacy policy.

7. Data Retention

7.1 We retain your personal data for as long as your account is active and for such period thereafter as is necessary to fulfil our legal obligations, resolve disputes, and enforce our agreements. The key retention periods applicable to different categories of data are as follows:

7.2 Where data is no longer required for the purposes for which it was collected, it will be securely deleted or anonymised so that it can no longer be linked to you.

8. International Data Transfers

8.1 BrikkShare is based in Nigeria. Some of our service providers including cloud infrastructure providers and identity verification services may process your personal data on servers located outside Nigeria.

8.2 Where we transfer personal data outside Nigeria, we ensure that adequate safeguards are in place in accordance with the NDPA 2023. These safeguards include:

1. a) Binding contractual clauses (Data Processing Agreements) that impose data protection obligations equivalent to those under the NDPA 2023
2. b) Transfers to countries that have been assessed as providing an adequate level of data protection
3. c) Other mechanisms permitted under the NDPA 2023 and any regulations or guidelines issued by the NDPC

8.3 You may request information about the specific safeguards applied to international transfers of your personal data by contacting our Data Protection Officer at privacy@brikkshare.com.

9. Data Security

9.1 BrikkShare takes the security of your personal data seriously. We implement technical and organisational measures designed to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These measures include:

1. a) Encryption of data in transit using TLS 1.2 or higher
2. b) Encryption of sensitive data at rest
3. c) Multi-factor authentication (MFA) for all platform accounts and internal administrative access
4. d) Role-based access controls ensuring that staff access only the data necessary for their role
5. e) Regular security assessments and penetration testing
6. f) Incident response and data breach management procedures

9.2 In the event of a personal data breach that poses a risk to your rights and freedoms, BrikkShare will notify the NDPC within 72 hours of becoming aware of the breach, as required by the NDPA 2023. We will also notify you directly where the breach is likely to result in a high risk to your rights and freedoms.

9.3 While we take all reasonable precautions, no system is completely secure. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately if you suspect unauthorised access to your account.

10. Cookies and Tracking Technologies

10.1 BrikkShare uses cookies and similar tracking technologies on our website and mobile application. A cookie is a small text file placed on your device that allows us to recognise you and remember your preferences.

10.2 You can manage your cookie preferences at any time through your browser settings or through the cookie preference centre in the Platform. Please note that disabling certain cookies may affect the functionality of the Platform.

11. Direct Marketing

11.1 BrikkShare may send you information about new investment opportunities, platform features, and promotional offers. We will only do so where you have consented to receive marketing communications from us.

11.2 You may withdraw your consent to receive marketing communications at any time by:

1. a) Clicking the unsubscribe link in any marketing email
2. b) Adjusting your notification preferences in your account settings
3. c) Contacting us at support@brikkshare.com

11.3 Withdrawal of consent to receive marketing will not affect the lawfulness of processing carried out before the withdrawal, and will not affect your ability to use the Platform or receive transactional communications about your investments.

12. Your Data Protection Rights

12.1 Under the NDPA 2023, you have the following rights in relation to your personal data:

12.2 To exercise any of the above rights, please contact our Data Protection Officer in writing at privacy@brikkshare.com . We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

12.3 Please note that certain rights are subject to limitations under the NDPA 2023 and other applicable laws — for example, we may be required to retain certain data for AML/CFT purposes even if you request deletion.

13. Children's Data

13.1 The Platform is not directed at individuals under the age of 18, and we do not knowingly collect personal data from minors. If you are a parent or guardian and believe that your child has provided personal data to us, please contact us immediately at privacy@brikkshare.com and we will take steps to delete that data.

14. Changes to This Policy

14.1 BrikkShare may update this Policy from time to time to reflect changes in our data practices, applicable law, or platform features. Where we make material changes, we will notify you by email or through a prominent notice on the Platform at least 14 days before the changes take effect.

14.2 Your continued use of the Platform after the effective date of any updated Policy constitutes your acknowledgment of the revised Policy. If you do not agree with any changes, you should discontinue use of the Platform and contact us to close your account.

15. Contact Us

15.1 If you have any questions about this Policy, wish to exercise your data protection rights, or have a concern about how your personal data has been handled, please contact us: