Privacy Policy
INTRODUCTION
This Privacy Policy ("Policy") outlines how Rank Microfinance Bank Limited ("Rank," "We," "Us," or "Our") collects, uses, stores, discloses, and protects the personal data of individuals, including customers, employees, clients, vendors, and other third parties. We are committed to processing personal data in a lawful, fair, and transparent manner, in full compliance with the Nigeria Data Protection Act (NDPA) 2023. This Policy explains our data handling practices and the rights available to you regarding the use of your personal data.
SCOPE
This Policy applies to all personal data collected, processed, or stored by Rank across all operational channels and touchpoints. These include, but are not limited to:
a. our mobile and web applications,
b. physical and digital forms,
c. voice communications (e.g., phone calls),
d. emails, text messages, and customer service chats,
e. in-person interactions and other communication mediums, etc.
All personal data, regardless of format or means of collection, is handled in accordance with the standards, safeguards, and user rights outlined in this Policy.
LEGAL BASIS FOR PROCESSING: WHY WE HOLD YOUR DATA
This Policy is guided by the legal requirements set out in the Nigeria Data Protection Act (NDPA) 2023, which specifies lawful grounds for the collection and processing of personal data. Rank processes personal data only when there is a valid legal basis for doing so. These include:
Consent: You provide consent to our processing of your personal data when you access our website, download our mobile application, or engage with our services. Consent may be withdrawn at any time, subject to legal or contractual restrictions.
Legal Obligation: We may process your personal data to comply with legal and regulatory obligations under Nigerian law. For example, we are required to collect specific data for compliance with Anti-Money Laundering (AML) and Countering the Financing of Terrorism (CFT) regulations.
Legitimate Interest: We may process your personal data when it is necessary to pursue our legitimate business interests, provided such interests do not override your fundamental rights and freedoms. These interests may include:
ensuring the security of our systems and operations
preventing fraud and financial crime
enhancing and improving our services
supporting operational efficiency and innovation
YOUR PRIVACY RIGHTS
Under the Nigeria Data Protection Act (NDPA) 2023, you have several rights in relation to your personal data. These rights empower you to maintain control over how your personal data is collected, processed, and used by Rank Microfinance Bank Limited. They are:
4.1 Right of Access: You have the right to request a comprehensive report of all personal data we hold about you. This includes information on:
why and how your data is processed,
the categories of data involved,
any third-party recipients with whom your data has been shared.
4.2 Right to Rectification: You may request that we correct or update any of your personal information that is inaccurate, incomplete, or outdated.
4.3 Right to Erasure ("Right to be Forgotten"): You have the right to request the deletion of your personal data from our records, especially when it is no longer necessary for the purposes for which it was collected. Please note that this right may be subject to legal or regulatory obligations, such as Know Your Customer (KYC) and Customer Due Diligence (CDD) rules that require financial institutions to retain certain information for a specified period.
4.4 Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request that we transfer it to another service provider where technically feasible.
4.5 Right to Restrict Processing: You may request that we restrict the processing of your personal data to certain purposes or services, particularly where the accuracy of the data is contested, or the processing is unlawful.
4.6 Right to Object: You have the right to object to the processing of your personal data, particularly where it involves direct marketing, profiling, or is based on our legitimate interests, if you believe it impacts your fundamental rights or freedoms.
4.7 Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Please note that your withdrawal of consent does not affect the lawfulness of any processing carried out prior to such withdrawal.
4.8 Right to Lodge a Complaint: If you believe your data has been mishandled, you may file a complaint with us by contacting our Data Protection Officer. If you are not satisfied with our response, you may escalate your complaint to the Nigerian Data Protection Commission (NDPC).
4.9 How to Exercise Your Rights: To exercise any of your rights under this Policy, please send a clear written request specifying the right you wish to invoke to our Data Protection Team at: dataprotection@userank.com
PERSONAL DATA WE COLLECT
We collect personal data during various interactions with our services in accordance with theNigeria Data Protection Act (NDPA) 2023. This data helps us provide secure, compliant, and personalised financial services. The types of personal data we collect may include, but are not limited to, the following categories:
5.1 Know Your Customer (KYC) / Customer Due Diligence (CDD) Data: To comply with regulatory requirements and verify your identity, we may collect the following:
full name,
b. residential and mailing addresses,
c. email address and phone number,
d. date of birth, gender, and marital status,
e. Bank Verification Number (BVN) and National Identification Number (NIN),
f. government-issued identification (e.g., national ID card, driver’s license, international
passport),
g. biometric data (e.g., facial recognition, fingerprint scans),
h. photographs,
i. employment or business information,
j. credit history and loan application details,
k. financial statements and transaction records,
l. account history,
m. company registration documents,
n. ownership structures, cash flow analyses.
5.2 Device and Application Usage Data: To enhance platform performance and user experience, we may collect technical data from your devices, such as:
device type and model
b. operating system and version
c. unique device identifiers (e.g., IMEI, MAC address)
d. Internet Protocol (IP) address
e. browser type and settings
f. mobile network information
g. app usage statistics and crash reports
With your explicit consent, we may also access:
GPS location data,
camera access (e.g., for photo id verification or mobile check deposits),
contacts (e.g., for referrals or in-app money transfers),
calendar access (e.g., for setting reminders or appointments).
5.3 Third-Party Data Sources: We may collect additional personal data from reliable third-party sources to meet regulatory obligations, assess risk, and improve service delivery. These sources include:
identity verification service providers,
credit bureaus and fraud prevention agencies,
banks, payment processors, and other financial institutions,
public records and regulatory databases,
marketing or analytics partners (only where legally permitted).
5.4 Cookies and Performance Tracking Technologies: We use cookies and similar technologies on our mobile app and website to:
a. enable essential platform functionality,
b. analyse user behaviour and performance metrics,
c. personalize your experience.
You may manage your cookie preferences through your device or browser settings. For more information, please refer to our Cookie Policy.
HOW WE USE YOUR PERSONAL DATA
By creating an account or using the Rank App or any other electronic channel, you give us express, informed, and revocable consent to collect, control, and process your personal data. We use your personal data to deliver secure, compliant, and personalised financial services. Below are the primary purposes for which we use your personal data:
6.1 Service Delivery: Your personal data enables us to provide and manage our core financial services, including but not limited to:
opening and maintaining accounts,
b. processing payments and fund transfers,
c. assessing and disbursing loan applications,
d. facilitating deposits, withdrawals, and other transactions,
e. enabling access to digital banking and mobile app features.
6.2 Regulatory Compliance: As a licensed financial institution, we are legally obligated to
comply with various Nigerian laws and regulations. Your data is processed to:
perform KYC and CDD checks,
b. conduct AML and CFT screenings,
c. comply with tax, reporting, and audit requirements,
d. respond to lawful requests from regulators, law enforcement, or the judiciary.
6.3 Innovation and Service Improvement: We may analyse personal data to improve and innovate our services. This includes:
conducting internal research and market analysis,
understanding customer behavior and usage trends,
enhancing features and user experience,
testing and refining new tools, features, or financial products.
6.4 Communication and Customer Support: We use your data to communicate with you and provide assistance, including:
a. transaction alerts and service notifications and updates,
b. customer service and dispute resolution,
c. marketing messages, promotions, and service updates (subject to your preferences),
d. feedback requests and satisfaction surveys.
Please Note: You may opt out of receiving promotional communications at any time via your account settings or by using the unsubscribe link in our emails and messages.
6.5 Security and Fraud Prevention: Your personal data is essential for ensuring the safety and integrity of our systems. It helps us:
a. monitor for and detect fraud in real-time,
b. verify user identity and transaction authenticity,
c. investigate suspicious or unauthorized activity,
d. prevent cyberattacks and secure our infrastructure.
HOW WE SHARE YOUR DATA: THIRD-PARTY PROCESSING AND DISCLOSURES
We take your privacy seriously and only share your personal data when necessary and in accordance with this Policy.
7.1 Third-Party Service Providers: We may share your personal data with third-party partners who assist us in delivering our services, fulfilling legal obligations, or supporting our operations. These may include:
payment processors,
b. identity verification providers,
c. credit bureaus and fraud prevention agencies,
d. data analytics firms,
e. IT and cloud hosting providers,
f. legal, regulatory, compliance, or audit professionals
g. other subcontractors or persons acting as our agents.
By using our mobile application or website, or other electronic channel, you expressly authorise Us to share your personal data with such partners for the purposes outlined in this Policy. We implement reasonable contractual and technical safeguards to ensure that third parties handle your data in compliance with globally recognised data protection standards. However, Rank shall not be liable for unauthorized access, misuse, or security breaches caused by these third parties beyond our control.
7.2 Disclosures in Fraud Investigations and Legal Requests: In cases of actual or suspected fraud or unlawful activity, we may disclose your personal data to law enforcement or regulatory authorities, including but not limited to:
the Nigerian Police Force (NPF),
b. the Economic and Financial Crimes Commission (EFCC),
c. the Nigerian Financial Intelligence Unit (NFIU),
d. the Central Bank of Nigeria (CBN),
e. other authorised government bodies and courts.
Disclosed information may include, but is not limited to: full name and contact details, Bank Verification Number (BVN), transaction records and account history, identification documents and other relevant personal data.
Important Notes:
Disclosures in fraud investigations and legal requests disclosures may be made without prior notice to you, where required by law or necessary to prevent harm or support an active investigation.
We will ensure that disclosures are made in good faith, in accordance with applicable laws, and only upon reasonable suspicion or evidence of misconduct.
DATA RETENTION
We retain your personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable laws and regulations. In particular, as a regulated financial institution, we are obligated to retain certain data (e.g., KYC and transaction records) for a minimum period of five (5) years after the end of your relationship with Us, in compliance with relevant anti-money laundering and financial regulations. After the applicable retention period, your data will be securely deleted, anonymized, or archived, unless further retention is required for:the Website will be uninterrupted, secure, or free from errors, defects, viruses, or other harmful components;
legal proceedings or investigations
tax or regulatory audits
fraud prevention or enforcement actions
You may request further details on our data retention practices by contacting our Data Protection Team at dataprotection@userank.com.
DATA SECURITY MEASURES
We implement a range of technical, organisational, and administrative security measures to protect your personal data against unauthorised access, loss, misuse, alteration, or destruction. These include:Rank shall also not be liable for any damages resulting from:
end-to-end encryption of data in transit and at rest,
secure login and authentication protocols,
regular security audits and penetration testing,
role-based access controls for staff,
continuous fraud monitoring, audit for security threats and anomalies.
Despite our best efforts, no method of data transmission or storage can be guaranteed to be 100% secure. Therefore, we encourage you to also take steps to protect your data, such as keeping your login credentials confidential and enabling multi-factor authentication where applicable. If you suspect that your account has been compromised or your data has been mishandled, please contact us immediately at hello@userank.com.
UPDATES TO THIS POLICY
We may update this Privacy Policy from time to time to reflect changes in our practices, services, legal obligations, or regulatory requirements. When changes are made:Your use or misuse of the Website;
We will post the updated version on our website and/or mobile app,
If the changes are material, we will notify you via email or in-app notification. A summary of significant updates will accompany each revision to ensure clarity,
The effective date of the updated policy will be clearly stated at the top of the document.
Updates to our Policy shall take effect on the day on which they are published. We encourage you to review this Policy periodically to stay informed about how we protect your personal data.
CONTACT US
If you have any questions, concerns, complaints, or requests related to this Privacy Policy or the processing of your personal data, you may contact our Data Protection Team with details below:
i. Email: dataprotection@userank.com
ii. General Inquiries: hello@userank.com
iii. Office Address: 1, Mufutau Idogo Street, Opposite Beachwood Estate, Ibeju-
Lekki, Lagos.
If you are unsatisfied with our response, you may escalate your concerns to the NDPC via their official website: https://ndpc.gov.ng
