Privacy Policy

Introduction

Sky Finance Company Limited (“We, Us, Our”) is committed to protecting the privacy and personal data of clients, business partners, employees and users of our digital platforms.

This Data Protection Notice explains how personal data is collected, used, and stored when individuals interact with our services, websites or representatives. This notice also outlines the rights available to individuals in relation to their personal data and the safeguards implemented to ensure that such data is processed responsibly.
This notice is issued in compliance with the requirements of the Nigeria Data Protection Act and the Nigeria Data Protection Regulation.

PRIVACY POLICY

WHO WE ARE?

Our Company is part of the Sky Capital Group which includes Sky Capital and Financial Allied International Limited, Sky Finance Company Limited, and Sky Capital Asset Management Limited. We are a financial services firm that operates a customer-focused business model, offering clients a comprehensive range of financial products & services including funds & investment management, structured & alternative finance, SME funding, venture capital, and financial advisory services which statutorily involves the collection of personal data/information from our customers necessitated by Central Bank of Nigeria’s “Know Your Customer” regulation. In order to comply with this regulation, obtaining personal information of our customers is compulsory.

Data Controller

As a Data Controller under the Nigeria Data Protection Act (NDP Act) 2023, we are committed to safeguarding the confidentiality, integrity, and security of all personal data entrusted to us. By using our services, you entrust us with your information. We understand the responsibility this carries and are dedicated to processing your data in compliance with the NDP Act 2023, GAID 2025, and other applicable regulations.

DATA WE MAY COLLECT ABOUT YOU

In order for us to serve you better, recommend and inform you of financial products and services, we need to collect some personal data about you. If you do not provide us with this information, we might be unable to serve you effectively. The types of personal data that are collected from you may include but are not limited to: We will collect and process the following personal information about you:

• Personal details such as your full name, title, occupation, nationality, country of residence, contact details, home/work address, email addresses and telephone numbers;
• Information required by Sky Finance Company Limited to meet legal and regulatory requirements in respect of anti-money laundering legislation, including personal details such as gender, date of birth, passport number(s), other government issued number(s), nationality, images of passports and driving license, signatures, occupation, source of funds and source of wealth, criminal records and political or family associations;
• Information required by Sky Finance Company Limited to meet legal and regulatory requirements relating to the exchange of tax information, including details of tax classification and tax identification numbers;
• Financial information, including billing address, bank account numbers, instruction records, transaction details, counterparty details, and specimen signatures;
• Details of meetings and telephone calls with our offices and employees;
• Information about entities with which you are connected, including your employer, your advisers, banking and other service providers and entities in which you have an interest; and any other information you may provide to us in the course of corresponding with us or might be provided to us by our clients, third parties etc.

Special Category Data

Special category data: we may collect this where we are required to do so for the purposes of our legal and/or regulatory obligations including but not limited to those in relation to anti-money laundering and combatting the financing of terrorism. This may include information revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, and similar sensitive data as defined under applicable law.

HoW WE COLLECT PERSONAL DATA

We collect this information in a variety of ways but mainly directly from you when you contact us or request information from us where we are providing services to you or we receive services from you including:

• When you register for our events,subscribe to our newsletters or miling lists;
• Information set out in any agreements entered with us;
• As part of the client due diligence process and through onboarding documentation;
• From subscription, redemption and transfer documentation, questionnaires and other forms and agreements in relation to ongoing services; and
• Personal data provided by you by way of correspondence with us by telephone, email or otherwise.



We also collect information from third parties or publicly available sources. These third parties and publicly available sources include lawyers, accountants and professional advisors, other financial institutions that process your personal data to satisfy their own regulatory requirements, credit reference agencies and financial crime databases in order to comply with our regulatory requirements as well as from other Sky Finance Company Limited affiliated companies

HOW WE USE PERSONAL DATA

We collect and use your personal information to:

• Provide and perform our obligations with respect to the services or otherwise in connection with fulfilling instructions;
• Validate authorized signatories for processing agreements and transactions;
• Contact nominated individuals in connection with transactions and contractual agreements.
• Respond to enquiries and fulfill requests from you/our clients, service providers and/or relevant third parties who may require information for providing services and to administer account(s) and manage our relationships;
• Verify an individual’s identity and/or location (or the identity or location of our client’s or service provider’s representative or agent) in order to allow access to relevant client accounts or conduct online transactions;
• Protect the security of accounts and personal data;
• Risk management/audit, compliance with our legal and regulatory obligations and for fraud detection, prevention and investigation, including “know your customer”, anti-money laundering, conflict and other necessary onboarding and ongoing client checks, due diligence and verification requirements, credit checks, credit risk analysis, compliance with sanctions procedures or rules, and tax reporting;
• Comply with applicable law including treaties or agreements with or between foreign or domestic governments (including in relation to tax reporting laws), (which may include laws outside the country you are located in), to respond to requests from public and government authorities (which may include authorities outside the country you are located in), to cooperate with law enforcement, governmental, regulatory, securities exchange or other similar agencies.
• The processing is in Sky Finance Company Limited’s legitimate interests
• For marketing and promotion of complementary services
• Monitor and record communications, including emails, for investigation and fraud prevention purposes, crime detection, prevention and investigation; and
• For clients research and management,and to improve the quality of servicess

LEGAL BASIS FOR PROCESSING

Personal data may be processed based on:

• The consent of the individual
• The Performance of a Contract
• Compliance with Legal or regulatory Obligations
• Legitimate business interests of the relevant Sky Finance Company Limited entity
• Public Interest
• Vital Interests

USE OF ARTIFICIAL INTELLIGENCE AND AUTOMATED DECISION-MAKING

We may use artificial intelligence (“AI”), machine learning systems, and other automated technologies as part of our operations. These technologies are used to support and enhance our services, including improving operational efficiency, strengthening security, and assisting in data analysis.

Nature of Processing

In certain circumstances, these technologies may be used to:

• Analyze customers informtaion for onboarding and verification purposes
• Detect and prevent fraud or suspicious activity
• Support risk assessment and Compliance processes
• Personlize user experience and service delivery

Some of these activities may involve profiling, which means the automated processing of personal data to eveluate certain personal aspects relating to an individual.

Your Rights

In accordance with applicable data protection laws, including the Nigeria Data Protection Act, you have the right to:

• Request meaningful information about the logic involved in automated processing
• Object to certain forms of profiling or automated processing
• Request human intervention in decisions made about you
• Contest a decision where you believe it was made unfairly or inaccurately

Safeguards and Governance

Sky Finance implements appropriate measures to ensure that AI and automated systems are used responsibly, Including:

• Periodic reviews of AI models and outputs
• Data quality and accuracy checks
• Monitoring for bais and discriminatory outcomes
• Internal governance and approvals processes for AI development

DISCLOSURE AND SHARING OF DATA

Personal Data may be disclosed to third parties in connection with the services we are providing. The recipients of such information will depend on the services that are being agreed and provided. Subject to any restrictions around confidentiality such disclosures may include disclosures:

• To other affiliation of the Sky Finance Company Limited entity for the purposes described in this privacy notice.
• To our third-party service providers (including in relation to website hosting, data analysis, client research, payment processing, order fulfillment, information technology and related infrastructure provision, customer service, email delivery, auditing and other services) and to our professional advisers and agents;
• To third party advisers of clients (including external legal counsel, notaries, auditors and tax advisers);
• To payment, banking and communication infrastructure providers including financial institutions or intermediaries with which we may have dealings (including correspondent banks), insurers/insurance brokers, central counterparties, clearing houses, clearing and settlement systems, exchanges, trading platforms, regulated markets, credit institutions and other service providers assisting on transactions;
• To third party storage providers (including archive service providers and document repositories) and trade data repositories;
• To third party distribution platforms and to operators of private or common carrier communications or transmission facilities, time sharing suppliers and mail or courier services;
• To other deal/transaction participants including issuers, borrowers, advisers, translation service providers and within prospectuses and marketing materials;
• To counterparties, vendors and beneficiaries, and other entities connected with our clients;
• To other persons as agreed with a client or as required or expressly permitted by applicable law;
• To central banks, regulators, trade data repositories, or approved reporting mechanisms which may be outside your country; and
• To courts, litigation counterparties, law enforcement, foreign authorities and others, pursuant to subpoena or other court order or process or otherwise as reasonably necessary, including in the context of litigation, arbitration and similar proceedings to enforce our terms and conditions, and as reasonably necessary to prepare for or conduct any litigation, arbitration and/or similar proceedings and to comply with legal and regulatory requirements

All third-party processors are required to enter into Data Processing Agreements (DPA) that ensure compliance with applicable data protection laws.

RETENTION OF YOUR DATA

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, regulatory, accounting, and reporting obligations. In determining appropriate retention periods, we consider the nature, sensitivity, and volume of personal data, the potential risk of harm from unauthorized use or disclosure, the purposes of processing, and applicable legal and regulatory requirements.

Retention Schedule

We maintain an internal Data Retention Schedule which sets out specific retention periods for different categories of personal data. Key retention periods includes:

• Know Your Customer (KYC) and Customer Due Diligence Records Retained for a minimum of five (5) years after the end of the customer relationship, in accordance with applicable anti-money laundering and regulatory requirements.
• Transaction and Financial Records Retained for a minimum of five (5) years, as required for financial reporting, audit, and regulatory compliance purposes.
• Customer Account and Service Data Retained for the duration of the customer relationship and for a defined period thereafter to address legal, regulatory, and operational requirements.
• Data Marketing and Communications Retained until the individual withdraws consent or opts out, after which it may be retained on a suppression list to ensure compliance with opt-out requests.
• CCTV and Security Footage Retained for a limited period, typically 30 to 90 days, unless required for investigation, legal proceedings, or regulatory purposes.
• Employee and Contractor Data (where applicable) Retained for the duration of engagement and for a statutory period thereafter in line with employment and tax laws.

Exceptions

In certain circumstance, Sky Finance may retain personal data for longer periods where required:

• To comply with legal or regulatory obligations
• In connection with actual or anticipated litigation
• For the establishement, exercise, or defense of legal claims
• Where required by regulators or supervisory authorities

Data Disposal

When personal data is no longer required, it is securely deleted, anonymized, or destroyed in accordance with our internal data protection and information security policies.

DATA SECURITY

We implement appropriate technical and organizational measures to safeguard personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Access to personal data is restricted to employees, agents, contractors, and third parties who have a legitimate business need to know. Such persons are subject to strict confidentiality obligations and are required to process personal data only in accordance with our instructions and applicable data protection laws. We maintain internal policies and procedures designed to ensure the ongoing confidentiality, integrity, and availability of personal data, including access controls, data security protocols, and regular monitoring of our systems.

Data Breach Management and Notification

We have established procedures to detect, investigate, and respond to suspected or actual personal data breaches. Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals: .

• The breach will be reported to the Nigeria Data Protection Commission within 72 hours of becoming aware of the breach, where feasible, in accordance with applicable law
• Affected individuals will be notified without undue delay where the breach is likely to result in a high risk to their rights and freedoms

We will also take appropriate steps to mitigate the effects of any breach and to prevent a recurrence.

CROSS BORDER TRANSFERS

In certain circumstances personal data may be transferred to service providers, affiliates, or partners located outside Nigeria. Where personal data is transferred outside Nigeria, including within entities associated with Sky Finance Company Limited or to third parties in other jurisdictions, such transfers will only take place where appropriate safeguards are in place to ensure an adequate level of protection in accordance with applicable data protection laws.

Safeguards for International Transfers

Where required, we will implement one or more of the following safeguards:

• Standard Contractual Clauses (SCC) or equivalent contractual data protection provisions
• Adequacy decisions recognizing that a jurisdiction provides an adequate level of data protection
• Binding Corporate Rules (BCR) or other approved intra-group transfer mechanisms (where applicable)
• Legally enforceable agreements ensuring that personal data is processed only for specified purposes and protected against unauthorized use or disclosure

All recipients of personal data are required to implement appropriate technical and organizational security measures and are restricted from using the data for their own purposes or disclosing it further without authorization.

YOUR RIGHTS AS A DATA SUBJECT

You have a number of legal rights in relation to the personal information that Sky Finance Company Limited holds about you, and you can exercise your rights by contacting us using the details set out below.

Depending on applicable law, these rights may include:

• Right to access. You have the right to request information regarding the processing of your personal information and access to the personal information we hold about you.
• Right to rectification. You have the right to request that Sky Finance Company Limited correct any information you believe is inaccurate. You also have the right to request Sky Finance Company Limited complete information you believe is incomplete.
• Right to erasure. You can request we erase your personal information in certain circumstances. There may be circumstances where you request us to erase your personal information, but we are legally entitled to retain it.
• Right to restrict processing. You have the right to request that Sky Finance Company Limited restrict the processing of your personal data under certain conditions. There may be circumstances where you object to or ask us to restrict our processing of your personal information, but we are legally entitled to refuse that request.
• Right to withdraw consent. You have the right to withdraw consent at any time where the sole legal basis for processing your personal data is your consen
• Right to object to processing. You have the right to object to Sky Finance Company Limited’s processing of your personal data under certain conditions.
• Right to data portability. You have the right to request that we transfer the data we have collected to another organization or directly to you under certain conditions.
• Right to Non-Discrimination – You have the right not to be discriminated against for exercising any of your data protection rights.
• Right to be Informed – You have the right to receive clear, concise, and transparent information about the collection and use of your personal data, including the purposes, legal basis, retention period, and recipients.
• Make a complaint. You can lodge a complaint with Nigeria Data Protection Commission (NDPC) if you think that any of your rights have been infringed by us.

How to Exercise Your Rights

You may exercise your rights by submitting a request to us via email to the Data Protection Officer at: dpo@skycapitallimited.com Your request should include sufficient information to enable us to identify you and understand the nature of your request.

Identity Verification


To protect your personal data, we may require you to verify your identity before processing your request. This may involve requesting additional information or documentation to confirm your identity.

Response Timeline


Sky Finance will respond to all valid requests within 10 working days of receipt, subject to verification of the requestor’s identity and the complexity of the request. Where a request is complex or involves multiple data sets, we may extend the response period in accordance with applicable law, in which case we will notify you of the delay and the reasons for it.

Limitations and Refusals

In certain circumstances, Sky Finance may refuse or limit a request where:

• The request is manifestly unfounded or excessive
• Compliance would adversely affect the rights and freedoms of others
• The data is required for legal, regulatory, or compliance purposes
• The data is subject to ongoing investigations or legal proceedings



Where a request is refused, we will provide reasons for the refusal and inform you of your rights to lodge a complaint with the Nigeria Data Protection Commission.

RECORDING OF COMMUNICATION

When individuals communicate with Sky Finance Company Limited by way of telephone conversations and electronic communications, including emails, text messages and instant messages, these may be recorded and/or monitored for evidentiary, compliance, quality assurance and governance purposes or as required by applicable law.

DATA PRIVACY IMPACT ASSESSMENT (DPIA)

The Company shall conduct a DPIA whenever processing is likely to result in high risk to the rights and freedoms of data subjects, particularly in circumstances listed under Article 28(3) of the GAID 2025, including:

• i. Profiling, scoring, or automated decision-making
• ii. Systematic monitoring
• iii. Processing of sensitive data
• iv. Processing involving vulnerable data subjects
• v. Deployment of new technologies
• vi. Survelliance using CCTV
• vii Financial services using digital platforms
• viii Cross-border data transfer



All DPIAs shall comply with the requirements of the GAID 2025 and be vetted by a certified DPO accredited by the Commission.

EMAIL MARKETING AND SUBSCRIPTION

You can stop the delivery of marketing emails from Sky Finance Company Limited at any time by unsubscribing or opting out via the link included in every email. Alternatively, you can make a direct request to unsubscribe by emailing info@skycapitallimited.com

How To Contact Us

If you have any concerns or questions about this privacy notice or would like to exercise your rights as a data subject, you can contact our Data Protection Officer: Email: dpo@skycapitallimited.com

UPDATES

We will update this privacy notice when necessary to reflect changes in the law, our practices and in our services, as well as to ensure it is accurate and up to date. When we make an update we will amend the date at the top of this notice, you are therefore advised to check this privacy notice periodically. We may also notify you in other ways from time to time about the processing of your personal information.

DEFINITIONS

or the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

Personla Data

Sensitive Personal Data

Processing

Data Subject

Data Controller

Data Processor

Third Party

Affiliate

Consent

Legitimate Interest

Personal Data Breach

Profiling

Cross-Border Transfer

Supervisory Authority