PRIVACY POLICY

First Frontier Tech Ltd (“FFTL”), trading as Ikonik (“Ikonik”, “we”, “us” or “our”), respects the privacy of individuals whose personal data we collect or process.

This Privacy Policy explains how we collect, receive, use, store, disclose, transfer and protect personal data when individuals and organisations interact with our website, platforms, APIs, dashboards, communication channels and products, including Koins, Octopus, Kairo and Recovery.

We aim to handle personal data transparently, fairly, securely and for specified, legitimate purposes.

This Policy is intended to operate alongside applicable product-specific privacy notices, customer contracts, data processing agreements and third-party notices.

Our processing practices are subject to applicable law, including the Nigeria Data Protection Act 2023 (“NDPA”), where applicable, and any other data protection requirements governing the relevant processing activity.

This Policy applies, as relevant, to:

• Visitors to the Ikonik website.
• Individual users and customers of Ikonik-powered services.
• Merchants, business owners, employees and authorised representatives.
• Customers and agents of financial institutions using Ikonik infrastructure.
• Developers, API users and integration partners.
• Individuals whose information appears in invoices, payment instructions, customer records, business contacts or other information submitted through our services.
• Individuals who contact our support, sales, complaints or other business teams.

This Policy does not automatically replace the privacy notice of a bank, payment provider or other independent organisation that provides a separate financial service.

Where a third party collects or processes your information independently, its own privacy notice may apply.

Our role depends on the service and the relationship involved.

3.1 When Ikonik acts as a data controller

Ikonik may act as a controller when it determines the purposes and essential means of processing personal data for its own activities, such as:

• Operating and securing its website and business systems.
• Managing direct customer and business relationships.
• Administering its own accounts, support services and communications.
• Maintaining business, billing, security and compliance records.
• Managing recruitment, employment, vendor or other direct business relationships.

3.2 When Ikonik acts as a data processor

A financial institution, merchant or other customer may determine the purposes for which its customers' information is processed using Ikonik infrastructure.

In those circumstances, Ikonik may process personal data on behalf of that customer under its documented instructions and applicable data processing agreement.

The customer may remain responsible for determining the lawful basis for the processing, providing appropriate privacy notices and handling requests from its customers, while Ikonik provides assistance as contractually required and legally applicable.

3.3 When roles overlap

A single service may involve multiple organisations with different responsibilities. Ikonik may act as a controller for some processing and a processor for other processing within the same product.

The applicable contract, service design, privacy notice and actual processing activities determine the relevant role. A contractual label alone does not override the legal position.

Where another organisation is an independent controller, it is responsible for its own processing activities and obligations.

The information we collect depends on the product, the functionality used, the relationship involved and the applicable legal requirements.

4.1 Identity and contact information

This may include:

• Full name and preferred name.
• Telephone number and email address.
• Date of birth where necessary.
• Residential or business address.
• Nationality or other identity details where lawfully required.
• Username, account identifier and profile information.
• Business registration details, directors and beneficial ownership information where relevant.

4.2 Identity verification and KYC information

Where required for onboarding, fraud prevention or a supported financial service, we or an authorised provider may process:

• Bank Verification Number (BVN).
• National Identification Number (NIN).
• Identity document type, number, status and verification result.
• Date of birth and other matching attributes.
• Business registration information and corporate verification records.
• Verification reference numbers, timestamps and audit results.
• Images or documents submitted for identity verification, where required.

We aim to collect only the information necessary for the relevant purpose. We do not require every category of identity information for every product.

Biometric information, where involved, may constitute sensitive personal data or be subject to additional legal protections. It will be processed only where an appropriate legal basis and safeguards exist.

4.3 Financial and transaction information

Depending on the service, we may process:

• Financial account identifiers and account references.
• Wallet or ledger identifiers and relevant balances.
• Transaction amounts, dates, status, references and descriptions.
• Payment instructions, beneficiary details and settlement information.
• Invoices, receipts, refunds, reversals and reconciliation records.
• Merchant, agent, vendor and customer payment records.
• Fees, usage credits and billing history.
• Fraud indicators, risk flags and dispute records.

We do not intend to collect or store full payment-card credentials, PINs or other authentication secrets unless expressly necessary, authorised and supported by appropriate security controls. Where third-party providers handle such information, their applicable arrangements govern that processing.

4.4 Business and operational information

When business customers use Ikonik, we may process:

• Business names, registration information and operating locations.
• Product catalogues, prices, inventory and storefront details.
• Customer and vendor contact records.
• Invoices, purchase records and receivables.
• Sales, revenue and transaction summaries.
• Promotions, announcements, reminders and customer communications.
• Branch information, agent details and employee access records.
• Business analytics, operational reports and support tickets.

Business information may also contain personal data relating to customers, employees, vendors or other identifiable individuals.

4.5 Communications and AI interactions

Where supported features are used, we may process:

• Messages and conversation history.
• Voice inputs, transcriptions or audio recordings where applicable.
• Images, documents and files submitted by users.
• Instructions provided to an AI assistant.
• Generated responses, summaries and workflow outputs.
• Feedback, corrections and customer support conversations.
• Information needed to execute, confirm or troubleshoot a requested workflow.

Users should not submit personal data about another person unless they have an appropriate lawful basis and authority to do so.

Product-specific notices will explain any additional recording, retention or AI-processing practices that require further disclosure.

4.6 Technical and usage information

We may collect:

• IP address and approximate location derived from network information.
• Device, browser and operating system information.
• Login timestamps and session information.
• API requests, usage metrics, error logs and performance data.
• Security events, access logs and authentication results.
• Cookie identifiers and website interaction data, where applicable.

We use this information to operate, secure, maintain and improve our services, subject to applicable law and consent requirements where relevant.

4.7 Information received from third parties

We may receive personal data from:

• Financial institutions and other authorised service providers.
• Payment processors, banks, billers and settlement partners.
• Identity verification and business verification providers.
• Customers and business administrators.
• Approved API integrations and connected systems.
• Publicly available company records and lawful verification sources.
• Regulators, law enforcement or other competent authorities where legally permitted or required.

Where required, we will provide appropriate notice about information obtained from third-party sources.

We may collect personal data:

1. Directly from you when you register, communicate with us or use a service.
2. From your employer, financial institution, merchant or other organisation administering the service.
3. Through an authorised API integration or connected service.
4. Through a payment, identity verification or other transaction-related provider.
5. Automatically through device, application, security and website logs.
6. Through cookies or similar technologies, subject to applicable requirements.
7. From third-party sources where the collection is lawful and necessary for the relevant purpose.

Where information is required to fulfil a contract, comply with law or complete a requested transaction, failure to provide it may prevent us or the relevant provider from delivering that service.

We will explain material requirements in the applicable onboarding flow or product notice where reasonably practicable.

Depending on the service and our role, we may process personal data to:

6.1 Provide and operate services

• Create and administer accounts.
• Authenticate users and manage permissions.
• Provide APIs, dashboards, transaction tools and integrations.
• Process authorised instructions through relevant systems.
• Support payment collection, invoicing, business management and reconciliation.
• Maintain operational records and transaction histories.
• Deliver customer support and resolve technical problems.

6.2 Verify identity and meet legal obligations

• Complete identity and business verification.
• Support KYC, AML/CFT, sanctions screening and fraud prevention where applicable.
• Meet lawful reporting, recordkeeping and audit obligations.
• Respond to valid requests from competent authorities.
• Enforce legal rights and investigate suspected unlawful activity.

6.3 Protect customers and systems

• Detect unauthorised access, account compromise and suspicious activity.
• Investigate suspected fraud and security incidents.
• Enforce access controls and transaction limits.
• Monitor system performance and service reliability.
• Maintain audit logs and incident records.
• Protect the rights, property and security of Ikonik, our customers and other persons.

6.4 Improve our products

• Diagnose errors and improve service performance.
• Evaluate feature usage and reliability.
• Understand user feedback and support needs.
• Develop and test new features, subject to appropriate safeguards.
• Produce aggregated or de-identified analytics where appropriate.

Where data is de-identified, we will take reasonable steps to prevent the information from identifying an individual. If data can still reasonably be linked to an identifiable person, it remains subject to applicable personal data protections.

6.5 Communicate with users

• Send transaction and account notifications.
• Respond to requests, complaints and enquiries.
• Provide security alerts and important service announcements.
• Send product updates and marketing communications where permitted.
• Administer service changes, billing notices and contractual communications.

You may opt out of non-essential marketing communications where applicable. Service, security and legally required notices may still be sent.

6.6 Support AI-assisted features

Where enabled, we may process prompts, messages, documents and related context to generate responses, summarise information, classify requests, support workflows or perform other documented functions.

AI features may also process limited transaction or account context needed to respond to an authorised request.

We will not use personal data for a materially different purpose without an appropriate lawful basis and any notice or consent required by law.

Where the NDPA applies, we will process personal data only where a lawful basis exists.

Depending on the circumstances, that basis may include:

• Consent: Where you have freely given consent for a specified purpose and consent is the appropriate legal basis.
• Contract: Where processing is necessary to enter into or perform a contract with you, or to take requested pre-contractual steps.
• Legal obligation: Where processing is necessary to comply with a legal duty applicable to the relevant party.
• Vital interests: Where processing is necessary to protect a person's vital interests in circumstances recognised by law.
• Public interest or official authority: Where applicable legal conditions are satisfied.
• Legitimate interests: Where a legitimate interest provides a lawful basis, the processing is necessary and applicable balancing and rights requirements are met.

The appropriate basis must be assessed for each processing purpose. We will not treat consent as the universal basis for all processing.

Where consent is relied upon, it may be withdrawn as permitted by law. Withdrawal does not invalidate processing lawfully performed before withdrawal and does not necessarily end processing that has another valid legal basis.

Where sensitive personal data is involved, additional legal conditions and safeguards may apply.

We may disclose personal data to the following categories of recipients, where necessary and lawful.

8.1 Financial institutions and service partners

These may include banks, microfinance banks, payment service providers, payment processors, switching companies, settlement partners, billers and other providers involved in a requested service.

The information shared will depend on the transaction, integration and the respective parties' roles.

8.2 Customers and business administrators

Where an organisation administers your account or uses Ikonik to provide a service, we may share relevant information with its authorised administrators, employees or representatives.

For example, a merchant may receive payment confirmation and transaction records necessary to manage a customer payment. A financial institution may receive information required to administer its customers' accounts or investigate a transaction.

Access should be restricted according to the applicable permissions, contractual arrangements and law.

8.3 Technical and operational providers

We may use cloud hosting providers, communications platforms, messaging providers, identity verification services, analytics providers, security vendors, support platforms and other processors.

Where they process personal data on our behalf, we will put appropriate contractual and security safeguards in place as required by law.

8.4 Professional advisers and corporate transactions

We may disclose information to legal advisers, auditors, insurers, financial advisers or prospective transaction counterparties where necessary and subject to appropriate confidentiality and legal protections.

8.5 Regulators, courts and law enforcement

We may disclose personal data when required by law, a valid court order, a competent authority or another lawful obligation.

Where legally permissible, we will assess the request and disclose only information reasonably necessary to comply.

8.6 With your direction or consent

We may share information where you request or authorise the disclosure, subject to the validity of the authorisation and applicable law.

8.7 No unrestricted sale of personal data

We do not sell personal data as a standalone commercial product. Any data sharing must have a legitimate, disclosed and lawful purpose.

Some Ikonik products may use AI models and automated systems supplied by Ikonik or third-party technology providers.

Depending on the feature, information may be processed to interpret a message, answer a question, create an invoice, summarise records, generate a customer response, recommend an action or support an authorised workflow.

9.1 Data used by AI features

The data processed may include prompts, messages, uploaded content, relevant account or business context, generated outputs and limited operational information.

We will seek to limit processing to what is reasonably necessary for the documented function.

9.2 Third-party AI providers

Where third-party AI services are used, relevant information may be transmitted to those providers to deliver the requested feature.

The providers' roles, retention practices, use of submitted data and transfer arrangements must be assessed and disclosed as appropriate.

We will seek contractual protections against unauthorised use of customer data and verify whether a provider uses submitted information to train its models before making any representation about that practice.

9.3 Model improvement and training

Personal data will not automatically be used to train or fine-tune a general-purpose AI model merely because a user interacts with an Ikonik product.

Any use for model training, evaluation or broader product development must be assessed for lawful basis, transparency, data minimisation, confidentiality, contractual restrictions and applicable consent requirements.

Where required, additional notice or consent will be obtained.

9.4 Automated decisions

AI-generated recommendations are not necessarily final decisions.

If an Ikonik service makes or supports a decision based solely or substantially on automated processing that produces legal or similarly significant effects for an individual, we will assess the applicable legal requirements, including relevant notice, safeguards, human intervention, review and challenge rights.

We will not represent that human review is available for every automated feature unless the feature and its operating procedures support that commitment.

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, subject to applicable law, contractual commitments and legitimate recordkeeping requirements.

Retention periods may depend on:

• The type and sensitivity of the information.
• The purpose for which it was collected.
• Whether the relevant account or contract remains active.
• Applicable financial, tax, audit or regulatory retention requirements.
• The need to resolve disputes, investigate fraud or enforce legal rights.
• Security, backup and disaster-recovery requirements.

Different categories of information may have different retention periods.

These periods must be established from actual operational practices and applicable legal obligations before publication. The placeholders are not commitments to retain data for any particular duration.

When information is no longer required, we will take reasonable steps to delete it, anonymise it or securely dispose of it, unless continued retention is required or permitted by law.

Deletion from active systems may not immediately remove information from protected backups, but retained copies will remain subject to appropriate safeguards and the applicable retention schedule.

We use technical and organisational safeguards appropriate to the nature of the personal data, the risks of processing and our role in the service.

Depending on the system, these safeguards may include:

• Encryption in transit and, where appropriate, at rest.
• Role-based access control and least-privilege permissions.
• Multi-factor authentication and secure credential management.
• Audit logging and monitoring.
• Network and application security controls.
• Secure development, testing and vulnerability management.
• Vendor assessment and contractual security requirements.
• Backup, recovery and incident-response procedures.
• Staff confidentiality and security training.

The safeguards in actual use may differ by product and service tier.

No electronic system or transmission method is completely secure. We cannot guarantee absolute security, but we will take reasonable steps to prevent unauthorised access, loss, alteration or disclosure.

Users and business customers must also maintain appropriate safeguards for their devices, accounts, integrations and credentials.

We maintain procedures for assessing and responding to suspected personal data breaches within our sphere of responsibility.

Where a breach occurs, we will investigate, take reasonable steps to contain and mitigate its effects, preserve relevant evidence and make notifications required by applicable law.

Where Ikonik acts as a processor, it will notify the relevant controller in accordance with the applicable data processing agreement and legal requirements.

Where Ikonik acts as a controller, it will assess its own notification obligations, including applicable notification deadlines and whether affected individuals must be informed.

The precise legal notification requirements depend on the circumstances, the parties' roles and the applicable law. We will not assume that every incident requires identical notifications.

Some service providers or technical infrastructure may be located outside Nigeria.

Where personal data is transferred internationally, we will assess the applicable legal requirements and implement the required safeguards, contractual arrangements or other recognised transfer mechanisms.

Depending on the circumstances, we may need to consider the destination country's protections, the recipient's obligations, the nature of the information, the purpose of the transfer and the rights of affected individuals.

Information about material international transfers or relevant safeguards will be provided where required by law.

Subject to applicable law and any lawful limitations, individuals may have rights to:

• Request access to their personal data.
• Request correction of inaccurate or incomplete information.
• Request deletion or erasure where the legal conditions are met.
• Request restriction of processing in applicable circumstances.
• Object to certain processing, including processing based on legitimate interests.
• Withdraw consent where consent is the legal basis.
• Request information about relevant processing activities.
• Request a portable copy of personal data where the legal conditions apply.
• Challenge certain decisions based solely on automated processing, where applicable.
• Lodge a complaint with the competent data protection authority.
• Seek any additional remedy available under applicable law.

These rights are not absolute in every circumstance. For example, legal retention obligations, third-party rights, fraud investigations or other statutory exceptions may affect how a request can be handled.

14.1 How to submit a request

Send a request to:

Privacy Contact: [email protected] and/or [email protected].

Please describe the right you wish to exercise and the service or account concerned. We may request reasonable information to verify your identity and protect against unauthorised disclosure.

We will respond within the timeframe required by applicable law. Where we cannot fulfil a request in full, we will explain the reason to the extent legally permitted and identify any available complaint or review route.

14.2 Data processed on behalf of another organisation

If Ikonik processes your personal data on behalf of a bank, merchant, employer or other customer, that organisation may be the appropriate controller to contact.

Where legally and contractually required, we will assist the controller in responding to your request.

If you contact Ikonik directly, we will take reasonable steps to direct your request to the responsible organisation or handle it within our own controller responsibilities.

Our website and online services may use cookies, local storage or similar technologies for purposes such as:

• Maintaining essential sessions and security.
• Remembering preferences.
• Measuring performance and diagnosing errors.
• Understanding website usage.
• Supporting analytics or marketing, where implemented and permitted.

We will provide appropriate information and obtain consent where required for non-essential cookies or similar technologies.

Users may be able to manage cookies through a consent tool or browser settings. Disabling certain cookies may affect website functionality.

The actual cookies, providers, purposes and retention periods should be documented in a separate cookie inventory before this section is published as a definitive description of current practices.

We may send service announcements, security notices, transaction notifications, billing information and other communications necessary to operate the service.

We may send marketing messages where permitted by applicable law and subject to any required consent or opt-out rights.

You can opt out of non-essential marketing communications using the method provided in the message or by contacting [email protected] and/or [email protected].

Opting out of marketing will not prevent us from sending essential service communications or notices we are legally required to provide.

Our financial and business services are not intended for children unless a specific product expressly supports their use and appropriate legal safeguards are in place.

Where a service involves a child or the processing of children's personal data, we will assess the applicable legal requirements, including age-related restrictions, parental or guardian authorisation where required, and additional safeguards.

We do not knowingly seek to collect children's personal data for a service that is not designed to support them. If you believe such data has been collected improperly, contact [email protected].

Our website and products may link to third-party websites or connect to external services.

We do not control the independent privacy practices of those third parties. Their privacy notices and terms may apply to their collection and use of your information.

Before submitting information directly to a third-party service, you should review the relevant provider's privacy notice.

This section does not remove any responsibility Ikonik has for its own selection, instructions, disclosures or contractual obligations concerning providers that process personal data on our behalf.

We may update this Policy to reflect changes in our services, data practices, technology, contractual relationships or applicable law.

The updated version will be published with a revised “Last Updated” date.

Where changes materially affect how personal data is processed, we will provide additional notice or seek consent where required.

A revised Policy does not retrospectively make previously unlawful processing lawful.

For privacy questions, data protection requests or concerns about our handling of personal data, contact:

First Frontier Tech Ltd (FFTL), trading as Ikonik
Privacy Contact: [email protected] and/or [email protected].
Website: ikonik.com.ng