4. Cookies

When you access our Service, we may make use of the standard practice of placing tiny data files called cookies, flash cookies, pixel tags, or other tracking tools (herein, “Cookies”) on your computer or other devices used to visit Apex. We use Cookies to help us recognize you as a customer, collect information about your use of Apex to better customize our services and content for you, and collect information about your computer or other access devices to:

1. Ensure compliance with the Nigerian Data Protection Act (“NDPA”) 2023, Nigerian Data Protection Regulation (“NDPR,”) 2019, and the European General Data Protection Regulation (“GDPR”) 2018;
2. Ensure that your account security has not been compromised by detecting irregular, suspicious, or potentially fraudulent account activities; and
3. Assess and improve our services and advertising campaigns.

We use the following types of cookies on our online channels, such as our website:

• Strictly necessary cookies: These cookies are mandatory and are required for the effective operation and functioning of our website on your device. They enable you to use the website and the features on the website and cannot be switched off.
• Performance cookies: These are optional cookies that collect information about how you use the website but not any personal information. Performance information is anonymous and mostly statistical and is used to improve the performance of our website.
• Marketing cookies or advertising cookies: These cookies are also optional and are used to deliver and display advertisements that are relevant and engaging for you as the user. They help us measure how effective our advertising campaigns are by your interaction with the advertisement.
• Session cookies: These cookies are temporary and optional and only exist while you browse our website to remember your activities on the website. As soon as you close the website or move to a different website, the cookies are deleted.
• Persistent cookies: These are permanent, optional cookies that are stored on your device until they reach a set expiry date or until you delete them. They remember your preferences or actions on our website (or in some cases across different websites). We may use them for various reasons, for example to remember your preferences and choices when you use our website, or to display relevant advertising campaigns to you.
• First-party cookies: These are cookies that we create and store when you use our website and relate to information obtained directly from you.

5. Direct Marketing

Subject to applicable laws and regulations, we may from time to time send direct marketing materials promoting services, products, facilities, or activities to you using information collected from or about you. You may opt-out of such marketing communications at any time by visiting the privacy tab of your Account page. You may also opt-out of such communications by following the directions provided in any marketing communication. It is our policy to not provide your Personal Information to third parties for their own direct marketing purposes without your consent. If you opt-out of marketing communications, please note that we may still send you necessary information about transactions or our business relationship.

6. Children’s Personal Information

Apex is not intended for children under the age of 18, and we do not knowingly collect Personal Information of children under the age of 18. If we learn that we have collected any Personal Information from a child under the age of 18, we will promptly delete it from our systems.

7. Information Security

We take reasonable measures, including administrative, technical, and physical safeguards, to protect your Personal Information from loss, theft, or misuse, and from unauthorized access, disclosure, alteration, and destruction. Nevertheless, no security is foolproof, and the Internet is an insecure medium. We cannot guarantee absolute security, but we work hard to protect Apex and you from unauthorized access to or unauthorized alteration, disclosure, or destruction of Personal Information we collect and store. Measures we take may include encryption of the Apex website communications with SSL; required two-factor authentication for all sessions; periodic review of our Personal Information collection, storage, and processing practices; and restricted access to your Personal Information on a need-to-know basis for our employees, contractors, and agents who are subject to strict contractual confidentiality obligations and may be disciplined or terminated if they fail to meet these obligations.

8. Retention

We retain your Personal Information for as long as is reasonably necessary to provide services to you, for our legitimate business purposes, and to comply with our legal and regulatory obligations. If you close your account with us, we will continue to retain your Personal Information as necessary to comply with our legal and regulatory obligations, including for fraud monitoring, detection and prevention; and for our tax, accounting, and financial reporting obligations.

9. International Transfers

Apex aims to be a global business. As a result, Personal Information may be stored and processed in any country where we have operations or where we engage service providers. We may transfer Personal Information that we maintain about you to recipients in countries other than the country in which the Personal Information was originally collected. Those other countries may have data protection or privacy rules that are different from those in Nigeria. However, we will take measures to ensure that any such transfers comply with applicable data protection laws and that your Personal Information remains protected to the standards described in this Privacy Notice. In certain circumstances, courts, law enforcement agencies, regulatory agencies, or security authorities in those other countries may be entitled to access your Personal Information.

If you are located in the European Economic Area (“EEA”), the UK, or Switzerland, we comply with applicable GDPR law to provide an adequate level of data protection for the transfer of your Personal Information to the US or other third countries. Apex enters into the appropriate data processing agreements and, if required, standard contractual clauses for the transfer of data which have been approved by the applicable data protection regulatory authority.

10. What are your Rights?

We value your trust and want you to be familiar with your rights under the NDPA and to know how you can exercise them in your interactions with Apex. You have the right to:

• Request Access: You may request access to the personal information we hold about you, and to correct and update your information. You may submit a request that Apex disclose the categories of Personal Information we have collected about you, the categories of sources from which your Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing your Personal Information, the categories of third parties with whom we disclose your Personal Information, and the specific pieces of Personal Information we have collected about you.
• Information: You may request information that we maintain about you, subject to appropriate verification.
• Request Erasure/Deletion: You may submit a request that Apex delete the personal information about you that we have collected from you. Note that there are some reasons we will not be able to fully address your request, such as if we need to complete a transaction for you, to detect and protect against fraudulent and illegal activity, to exercise our rights, for our internal purposes, or to comply with a legal obligation.
• Rectification: You may submit a request that Apex correct inaccurate Personal information we have collected and maintained about you.
• Data Portability: You have the right to receive the personal data you have provided to us in an electronic format and to transmit that Personal Information to another data controller.
• Object: You may object to our processing your personal information, where applicable.
• Be notified that your personal information is being collected by us or has been accessed or acquired by an unauthorized person.
• Knowledge of the existence of automated decision-making processes in the application for products and/or services, except under certain circumstances.
• To request reasons or make a representation to us if your application for products and/or services is refused.

How to Submit a Request:

You may submit a request to access, delete, or correct your Personal Information by emailing us at [email protected]. We are legally obligated to verify your identity when you submit a request.

We may request additional information from you, like your date of birth or a personal identification number, to verify your identity. Apex will confirm receipt of your request within 10 business days and will respond to your request within 45 calendar days, after proper verification, unless we need additional time, in which case we will let you know.

If we are unable to verify your identity, we may deny your request. If you submit a request to delete your Personal Information, you will also be required to confirm the deletion request by email.

Please understand that we are not obligated to provide you with access to your Personal Information more than twice in a 12-month period.

If your request is manifestly unfounded or excessive, we may either charge a reasonable fee or refuse to act on the request, in which case we will notify you of the reason for refusing the request.

11. Information for Persons Subject to UK Data Protection Laws

If you are located in the UK and are provided services, we adhere to relevant UK data protection laws and provide individuals with the following additional information. For purposes of this section, “personal data” has the meaning provided in the General Data Protection Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018(“GDPR”).

Lawful bases for processing

• Legal Obligation: to conduct anti-fraud and identity verification and authentication checks and to fulfill our retention obligations;
• Contractual Obligation:to satisfy our obligations to you under our Terms, including to provide you with our services and customer support services, and to optimize and enhance Apex;
• Legitimate Interest: to monitor the usage of Apex, conduct automated and manual security checks of our service, to protect our rights; and
• Consent: to market Apex and our services to you. You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before consent is withdrawn.

European privacy rights

• Rights to Access and Rectification: You may submit a request that Apex disclose the personal data that we process about you and correct any inaccurate personal data.
• Right to Erasure: You may submit a request that Apex delete the personal data that we have about you.
• Right to Restriction of Processing and Right to Object: You have the right to restrict or object to our processing of your personal data under certain circumstances.
• Right to Data Portability: You have the right to receive the personal data you have provided to us in an electronic format and to transmit that Personal Information to another data controller.

When handling requests to exercise your privacy rights, we check the identity of the requesting party to ensure that he or she is the person legally entitled to make such a request. While we maintain a policy to respond to these requests free of charge, should your request be repetitive or unduly onerous, we reserve the right to charge you a reasonable fee for compliance with your request.

Automated decision-making

We may engage in automated decision-making for purposes of fraud detection and prevention. When we do, we implement suitable measures to safeguard your rights and freedoms and legitimate interests, including the right to obtain human intervention, to express your point of view and to contest the decision.

12. Updates To this Privacy Notice

We may change this Privacy Notice from time to time to reflect changes to our privacy practices, enhance user experience, or comply with relevant laws. The “Last updated” legend at the top of this Privacy Notice indicates when this Privacy Notice was last revised. Any changes are effective when we post the revised Privacy Notice. Your continued use of Apex after our posting of changes to this Privacy Notice means that you understand and agree to such changes.