Privacy Policy

1. Introduction

CAPSA Technology Limited (“CAPSA”, “we”, “us”, “our”) provides invoice factoring, invoice discounting and supply chain finance services (the “Services”). This Privacy Policy explains how we collect, use, disclose, retain and protect personal data when you visit our website at www.getcapsa.com (the “Website”) or, having logged in via the Website's Login function, use our onboarding and service application (the “Platform”) – together “our Services”. Any undefined capitalised terms used in this Privacy Policy have the meaning given to them in our Terms of Use, User Terms & Conditions and internal policies (together, the “Terms”).

This Privacy Policy is issued in compliance with the Nigeria Data Protection Act, 2023 (“NDPA”) and its General Application and Implementation Directive, 2025 (“GAID”), both administered by the Nigeria Data Protection Commission (“NDPC”) (“Data Protection Legislation”).

By using the Website or the Platform, you agree to this Privacy Policy. If you do not agree, please do not use the Website or the Platform. We will revise the version date at the foot of this Privacy Policy whenever we make changes, and where a change materially reduces your rights, we will notify you before it takes effect. We encourage you to read this Privacy Policy each time you visit the Website or use the Platform, especially before providing any Personal Data (as defined below).

Where processing of your Personal Data is based on consent, we shall obtain the requisite consent at the time of collection of the personal information. In this regard, you consent to the processing of your personal information when you access our Website, or use our Services, content, features, technologies, or functions offered on our platform or other digital channels. You can withdraw your consent at any time, but such withdrawal will not affect the lawfulness of the processing of your data based on consent given before its withdrawal.

Where your Personal Data is to be processed for a different purpose that is incompatible with the purpose or purposes for which that Personal Data was originally collected, and which was not disclosed to you when you first provided your consent, we will obtain your consent to the new purpose or purposes.

2. Scope of this Policy

The Website is our public-facing site. It uses cookies and similar technologies to understand how visitors use it (see “Cookies” in Section 12 below) and is also the channel through which our commercial partners – anchors, financiers and other counterparties – upload trade documents such as invoices and supporting records in connection with transactions (“Partner Documents”).

The Platform is the password-protected part of the Website, reached via the Login button at www.getcapsa.com, through which prospective and existing Users (vendors, anchors and financiers) are onboarded, identified and verified, and through which we deliver the Services. Identity and corporate documents used for Know-Your-Customer/Customer Due Diligence (“KYC/CDD”), sanctions and politically-exposed-person (“PEP”) screening, and ongoing monitoring are collected through the Platform, not the public pages of the Website.

References in this Privacy Policy to the Website include, where the context requires, the Platform, since both are accessed at www.getcapsa.com. This Privacy Policy applies to the public pages of the Website, the Platform, and to Partner Documents uploaded through the Website.

We confirm that www.getcapsa.com – comprising the public pages of the Website and the password-protected Platform – is the only channel through which we collect Personal Data. We do not collect Personal Data through USSD, WhatsApp or any third-party onboarding widget.

3. Information We Collect

3.1 Through the Website

• Technical and usage information such as session duration, pages viewed, referring domain, and device, browser and operating-system type, collected via cookies and server logs (see “Cookies”).
• Information provided by you when you contact us, subscribe to our updates, or upload Partner Documents – including your name, email address, and the content of any documents you upload.

3.2 Through the Platform (onboarding and KYC/CDD)

• Identity information: Bank Verification Number (BVN), National Identification Number (NIN), government-issued identification, and proof of address, for you and, where applicable, your company's directors, signatories and persons with significant control.
• Corporate information: company registration number (RC/BN), Tax Identification Number (TIN), CAC Status Report, and beneficial-ownership information.
• Trade information: invoices and related documents submitted for financing.
• Screening and risk information: the results of sanctions, adverse-media and PEP screening, and the risk tier (Simplified/Standard/Enhanced Due Diligence) assigned to you.

We refer to the information described in this section 3, and any other information that identifies or can identify you, as “Personal Data” (referred to as “Personal Information” in our earlier privacy notices); the individual to whom Personal Data relates is a “Data Subject” (“you”).

You are not required by law to provide us with any of the above information; however, if you do not, we may be unable to provide you with the Services, in whole or in part.

Your Personal Data must be accurate and kept up to date. In this regard, CAPSA shall ensure that any data it collects and/or processes is accurate and not misleading in a way that could be harmful to you; make efforts to keep your Personal Data updated where reasonable and applicable; and make timely efforts to correct or erase your Personal Data when inaccuracies are discovered.

You are responsible for ensuring that the information you provide to us is accurate, complete, and up to date. You can update your information at any time through your Platform settings or by contacting us at hello@getcapsa.com.

4. Why We Process Your Personal Data, and Our Lawful Basis

Data Protection Legislation requires us to have a lawful basis for each purpose for which we process Personal Data. We rely on the following, which may apply simultaneously to the same processing activity:

• KYC/CDD, sanctions/PEP screening and risk classification – compliance with a legal obligation (our AML/CFT/CPF obligations) and performance of our contract with you, to identify, verify, screen and risk-tier Users before and during the provision of the Services. This basis should be applied only to the extent CAPSA is subject to the relevant AML/CFT/CPF obligation for the processing activity.
• Providing and supporting the Services – performance of our contract with you.
• Improving and developing the Services, and internal management and administration – our legitimate interest in maintaining and improving our Services and our internal compliance, balanced against your rights and interests.
• Maintaining a safe and secure environment – our legitimate interest in protecting our Services and our Users against fraud, abuse and security incidents, and compliance with legal obligations.
• Personalising content and marketing – our legitimate interest in tailoring your experience, or your consent where required; you may opt out at any time (see “Opt In or Opt Out” in Section 13 below).
• Cookies and website analytics – your consent, where required by applicable rules, or our legitimate interest in understanding use of the Website.

5. Automated Decision-Making

Your risk classification is decided by a member of our Compliance team after reviewing your documents and screening results – it is not a solely automated decision, so it does not currently engage the automated-decision-making protections under the Data Protection Legislation. Only the verification of your BVN and NIN against the relevant national databases is automated. If we introduce automated or algorithmic risk-scoring in future without human review, we will update this Privacy Policy and put in place appropriate safeguards, including a right for you to obtain human review of, and to contest, the outcome.

6. Disclosure of Personal Data

We do not sell your Personal Data. Depending on the purpose, we may share it with:

• Our affiliates and subsidiaries;
• Service providers who process Personal Data on our behalf and under our instructions, such as identity-verification providers, cloud-infrastructure and hosting providers, sanctions/PEP screening providers, analytics providers, professional advisers, including legal, accounting and audit advisers and the accounting and CRM tools we use for internal transaction tracking and reporting (a current list of our processors is available on request from our Data Protection Officer);
• Financiers, anchors and other counterparties, strictly as necessary to facilitate a transaction you have entered into through the Services;
• Regulators, law-enforcement bodies and other authorities, where required or permitted by law; to the extent practicable and legally permitted, we will attempt to advise you prior to any such disclosure, so that you may seek a protective order or other relief limiting such disclosure.
• A successor entity, in connection with a merger, acquisition, financing, or sale of related assets.

We will notify you as soon as we become aware of a harmful data breach which may result in a risk to your rights and freedom.

Where a service provider processes Personal Data on our behalf, we require them, by way of a written data processing agreement to: process Personal Data only on our documented instructions and for the purposes we specify; apply appropriate technical and organisational security measures; assist us in responding to Data Subject requests and in meeting our Data Protection Legislation obligations; notify us of any personal data breach without undue delay; and delete or return Personal Data at the end of our relationship with them.

7. International Transfer of Personal Data

Your Personal Data – including identity information collected for KYC/CDD purposes, and transaction data used for internal tracking and reporting – is currently stored and processed on infrastructure located outside Nigeria, in the United States. As the NDPC has not made an adequacy decision in respect of the United States, we ensure this transfer is made subject to appropriate safeguards recognised under the Data Protection Legislation, including contractual data-protection clauses (such as standard contractual clauses) with our infrastructure and service providers, requiring them to protect your Personal Data to a standard consistent with Nigerian law.

Where such contractual safeguards are not yet in place with a given provider, we will only transfer your Personal Data where the transfer is necessary for the performance of our contract with you (for example, to verify your identity and deliver the Services you have requested), or where you have given your informed, explicit consent to the transfer, having been made aware of the risks involved in the absence of an NDPC adequacy decision. By submitting Personal Data to us for the provision of the Services, you acknowledge that it may be transferred outside Nigeria on this basis.

You may request further information about the safeguards applicable to a specific transfer, or object to a transfer, by contacting our Data Protection Officer (see “Contact Us and Your Rights” in Section 16 below).

8. Data Retention

We retain Personal Data for as long as necessary to provide the Services and to meet our legal, regulatory and legitimate business needs, in line with our internal Data Retention & Archival Schedule. Personal Data collected for AML/CFT/CPF purposes is retained for a minimum of five (5) years from the end of the relevant relationship, or such longer period as applicable law requires, after which it is archived or securely disposed of. Where consent is our lawful basis and you withdraw it, we will erase the relevant Personal Data unless we are required to keep it to comply with a legal obligation (including our AML/CFT/CPF obligations) or to establish, exercise or defend a legal claim.

9. Information Security and Breach Notification

CAPSA maintains administrative, technical and physical safeguards designed to protect Personal Data against unauthorised access, loss, misuse or disclosure, including encryption of data in transit (TLS/SSL) and secure password hashing (bcrypt) for account credentials, with our database infrastructure held within a private network with no public access. No system can be guaranteed completely secure, and CAPSA cannot guarantee that its systems will be immune from wrongdoing, malfunction or unlawful interception.

If a personal data breach occurs that is likely to affect your rights and freedoms, we will notify the NDPC within seventy-two (72) hours of becoming aware of it. Where the breach poses a high risk to you, we will also notify you directly and without undue delay, in clear and plain language, together with guidance on steps you can take to protect yourself.

10. Data Confidentiality

Your information is regarded as confidential and will not be divulged to any third party, except under legal and/or regulatory conditions. You have the right to request copies of any and all information we keep on you, if such requests are made in compliance with applicable laws and other relevant enactments. While we are responsible for safeguarding the information entrusted to us, your role in fulfilling confidentiality duties includes, but is not limited to, adopting and enforcing appropriate security measures such as non-sharing of passwords and other platform login details, adherence with physical security protocols, and dealing only with authorised officers of CAPSA.

11. Training

We shall ensure that employees who collect, access, and process your Personal Data receive adequate data privacy and protection training in order to develop the necessary knowledge, skills, and competence required to effectively manage the compliance framework under this Policy and the Data Protection Legislation with regard to the protection of Personal Data. On an annual basis, we shall develop a capacity building plan for our employees on data privacy and protection in accordance with the Data Protection Legislation.

12. Cookies

We use two broad categories of cookies and similar technologies on the Website:

• Essential/session cookies – used to keep you securely logged into the Platform once you have used the Login button, and to support core security functions. These are necessary for the Services to function and cannot be disabled without losing access to the Platform.
• Analytics and preference cookies – used on the public pages of the Website to understand how visitors use it and to adjust the Website to your preferences. This aggregated tracking information may record the pages you visited, the length of time you stayed, and the location from which you accessed the Website.

You may modify your browser settings to reject non-essential cookies or to remove cookies already placed on your device; doing so may limit some Website functionality but will not prevent you from using the Platform once logged in.

13. Opt In or Opt Out

You are always in control of your data. If you have chosen to receive information from us, our affiliates or our service providers, you may change your mind at any time by writing to us at support@getcapsa.com. It is not always possible to immediately remove or modify information already in our databases and servers, but we will make reasonable efforts to do so upon your request, subject to “Data Retention” above.

14. Your Rights

As a Data Subject under the NDPA, subject to certain limitations and exceptions, you have the right to:

• be informed about how we process your Personal Data, which this Privacy Policy is intended to satisfy;
• access a copy of the Personal Data we hold about you;
• request correction of inaccurate or incomplete Personal Data;
• request erasure of your Personal Data, where we no longer have a lawful basis to keep it;
• request that we restrict our processing of your Personal Data in certain circumstances;
• withdraw consent at any time, where consent is our lawful basis for processing, without affecting the lawfulness of processing carried out before withdrawal;
• object to processing carried out on the basis of our legitimate interest, including for marketing;
• receive a copy of the Personal Data you provided to us in a structured, commonly-used, machine-readable format, where technically feasible;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you (see “Automated Decision-Making” above); and
• lodge a complaint with the Nigeria Data Protection Commission or with any other competent supervisory authority, without prejudice to any other administrative or judicial remedy available to you.

To exercise any of the rights above, please contact us at support@getcapsa.com. We may request additional information to verify your identity and/or authority. If we deny your request, you may appeal our decision by contacting us at the address set out in “Contact Us and Your Rights” in Section 16 below. We will not discriminate against you for exercising any of these rights

Our ability to give full effect to erasure and similar rights is limited where we are subject to a legal obligation (such as our AML/CFT/CPF retention duties) or need to establish, exercise or defend a legal claim, as described under “Data Retention” above.

15. Limitation of Liability

We exercise reasonable efforts to safeguard the security and confidentiality of your Personal Data; however, we will not be liable for unauthorised disclosure of Personal Data that occurs through no fault of ours.

16. Contact Us and Your Rights

To exercise any of the rights above, or if you have questions about this Privacy Policy or our data practices, please contact our Data Protection Officer:

• Email: support@getcapsa.com
• Phone: +234-704-627-2950

We will make reasonable efforts to respond to and fulfil your request within the timeframes required by the Data Protection Legislation. We may request information reasonably necessary to verify your Identity and, where applicable, your authority to make a request before we can process it.

17. Links to Other Websites

The Website may provide links to other websites. These are not covered by this Privacy Policy, which does not extend to the information practices of other providers of products or services, advertisers, or other websites, companies or individuals not owned or controlled by CAPSA. We recommend reading the privacy policy of any linked website before sharing your Personal Data with it.

18. Children's Privacy

The Website and the Platform are not intended for children under the age of 18. We do not knowingly or intentionally collect Personal Data about individuals under 18 years of age. 4.2.Individuals under the age of 18 (eighteen) years may only access the Services with the involvement, supervision, and approval of a parent or legal guardian who has agreed to these terms on their behalf.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our Services, or applicable law, including further guidance issued by the NDPC under the Data Protection Legislation. We will revise the version date below whenever we do so, and where a change materially reduces your rights, we will provide notice before it takes effect.

20. Governing Law and Jurisdiction

This Privacy Policy is governed by the Nigeria Data Protection Act 2023, its General Application and Implementation Directive 2025, and other applicable laws of the Federal Republic of Nigeria. You expressly agree that the competent courts of Nigeria shall have exclusive jurisdiction over any claim or action arising out of or relating to this Privacy Policy, to the exclusion of any other jurisdiction.