GTI Data Protection Policy
The purpose of this document (“GTI Data Protection Policy”) is to inform the public of how GTI Group members made up of GTI Capital, GTI Microfinance Bank, GTI Securities, GTI Asset Management and Trust, GTI Trade Desk, GTI Trading Floor, GTI Finance Academy and other GTI affiliates and related companies which the group has substance interest collectively referred to as GTI Group, manages Personal Data (as defined below) which is subject to the Nigeria Data Protection Regulation 2019.
The public is expected to read this Data Protection Policy so that you know and understand the purposes for which we collect, use and disclose Personal Data.
- GTI Group Status
- Personal Data
- Collection of Personal Data
- Purpose for the Collection, Use and Disclosure
- Disclosure of Personal Data
- Data Security
- Third-Party Sites
- Data Retention
- Children Privacy
- Your Rights
- Contacting Us, Feedback, Withdrawal of Consent, Access and Correction of Personal Data
By interacting with us, filling out forms/registers (both online and offline), submitting information to us, or signing up for any products or services offered by us, the user agrees and consent to GTI Group, as well as our respective representatives and/or agents (“Representatives”) (the Companies and Representatives collectively referred to herein as “GTI Group”, “us”, “we” or “our”) collecting, using, disclosing and sharing amongst ourselves your Personal Data, and disclosing such Personal Data to the Companies’ authorised service providers and relevant third parties in the manner outlined in this Data Protection Policy.
This Data Protection Policy supplements but does not supersede nor replace any other consents you may have previously provided to GTI Group in respect of your Personal Data, and your consents herein are additional to any rights which any of the Companies may have at law to collect, use or disclose your Personal Data.
GTI Group may from time to time update this Data Protection Policy to ensure that this Data Protection Policy is consistent with our future developments, industry trends and/or any changes in legal or regulatory requirements. Subject to your rights at law, you agree to be bound by the prevailing terms of the Data Protection Policy as updated from time to time on our website http://www.gti.com.ng/Data-Protection-Policy. Please check regularly for updated information on the handling of your Personal Data.
In this Data Protection Policy, “Personal Data” refers to any data, whether true or not, about an individual who can be identified (a) from that data; or (b) from that data and other information to which we have or are likely to have access, including data in our records as may be updated from time to time.
Examples of such Personal Data you may provide to us include (depending on the nature of your interaction with us) your name, bank verification number, passport or other identification numbers, telephone number(s), mailing address, email address, transactional data and any other information relating to any individuals which you have provided us in any form you may have submitted to us (including in the form of biometric data), or via other forms of interaction with you.
Collection of Personal Data
Generally, we collect Personal Data in the following ways:
When you browse our website and platforms, you generally do so anonymously but please see the section below on cookies. We do not, at our website and platforms, automatically collect Personal Data, including your email address unless you provide such information or login with your account credentials.
If you provide us with any Personal Data relating to a third party (for example, information of your spouse, children, parents, or a Connected Person), by submitting such information to us, you represent to us that you have obtained the consent of the third party to you providing us with his/her Personal Data for the respective purposes. “Connected Person” may include but is not limited to any beneficial owner, authorised signatory, director, shareholder, an officer of a company, partner or member of a partnership, settlor, trustee, beneficial owner, protector or grantor of trust, mandate holder, power of attorney holder, surety, third party security provider, provider of funds, founder and/or employee, the payee of designated payment, representatives, agents or nominees.
You should ensure that all Personal Data submitted to us is complete, accurate, true and correct. Failure on your part to do so may result in our inability to provide you with the products and services you have requested. You agree to inform GTI Group immediately of any change of facts or circumstances which may render any information or Personal Data previously provided inaccurate, untrue or incorrect and provide any information or documentation as GTI Group may reasonably require for verifying the accuracy of the updated information or Personal Data.
Purposes for the Collection, Use and Disclosure of Your Personal Data
Generally, GTI Group, uses and discloses your Personal Data for the following purposes:
These purposes may also apply even if you do not maintain any account(s) with us or have terminated these account(s).
Also, GTI Group collects, uses and discloses your Personal Data for the following purposes depending on the nature of our relationship:
Also, where permitted under the regulation, GTI Group may also collect, process, use and disclose your Personal Data for the following purposes (which we may describe in our documents and agreements as “Additional Purposes” for the handling of Personal Data):
If you have provided your telephone number(s) and have indicated that you consent to receive marketing or promotional information via your telephone number(s), then from time to time, GTI Group may contact you using such telephone number(s) (including via voice calls, text, or other means) with information about our products and services (including discounts and special offers).
In relation to particular products or services or your interactions with us, we may also have specifically notified you of other purposes for which we collect, use or disclose your Personal Data. If so, we will collect, use and disclose your Personal Data for these additional purposes as well, unless we have specifically notified you otherwise.
GTI Group will collect and process your Personal Data in accordance with the legitimate purposes consented to by you provided that further processing may be done for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes as provided for in the Data Protection Regulation
Disclosure of Personal Data
GTI Group will take reasonable steps to protect your Personal Data against unauthorised disclosure. Subject to the provisions of any applicable law, your Personal Data may be provided, for the purposes listed above (where applicable), to the following entities or parties, whether they are located overseas or in Nigeria:
Web beacons (also known as pixel tags and clear GIFs) involve graphics that are not apparent to the user. Tracking links and/or similar technologies consist of a few lines of programming code and can be embedded in our websites or platforms. Web beacons are usually used in conjunction with cookies and primarily used for statistical analysis purposes. This technology can also be used for tracking traffic patterns on websites and platforms, as well as finding out if an e-mail has been received and opened and to see if there has been any response.
We may employ cookies and other technologies as follows:
Some cookies we use are from third party companies to provide us with web analytics and intelligence about our websites and platforms. These companies collect information about your interaction with our websites and platforms. We use such information to compile statistics about visitors who interact with the websites, platforms and other online content, to gauge the effectiveness of our communications, and to provide more pertinent information to our visitors.
GTI Group will take reasonable efforts to protect Personal Data in our possession or our control by making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. However, we cannot completely guarantee the security of any Personal Data we may have collected from or about you, or that for example, no harmful code will enter our website (for example viruses, bugs, trojan horses, spyware or adware). You should be aware of the risks associated with using websites and take any necessary precautions.
We have implemented technical and organisational security measures to safeguard the personal information in our custody and control. Such measures include, for example, limiting access to personal information only to employees and authorised service providers who need to know such information for the purposes described in this policy; adopting security protocols on networks and systems; using email security settings when sending and/or receiving highly confidential emails; applying physical access controls such as marking confidential documents clearly and prominently, storing confidential documents in locked file cabinets; restricting access to confidential documents on a need-to-know basis; using privacy filters; disposal of confidential documents that are no longer needed, through shredding or similar means; using a mode of delivery or transmission of personal data that affords the appropriate level of security (e.g. registered post instead of the normal post where appropriate); confirming the intended recipient of personal data as well as other administrative, technical and physical safeguards.
While we endeavour to protect our systems, sites, operations and information against unauthorised access, use, modification and disclosure, due to the inherent nature of the Internet as an open global communications vehicle and other risk factors, we cannot guarantee that any information, during transmission or while stored on our systems, will be safe from intrusion by others, such as hackers. We engage various forms of security method like Encryption, Backup and Recovery and Access control, all together put in place to ensure the authentication of users and protection against data breaches. Our web servers are secured under a strong security system with our trained and trusted IT workforce who work hand in hand to ensure confidentiality of data of clients in accordance to our laid down procedures and compliance with the Nigeria Data Protection Regulation.
While we strive to protect your Personal Data, we cannot ensure the security of the information you transmit to us via the Internet or electronic communication or when you use our electronic services, and we urge you to take every precaution to protect your Personal Data when you use such platforms. We recommend that you change your passwords often, use a combination of letters and numbers, and ensure that you use a secure browser.
If applicable, you undertake to keep your username, password and/or pin secure and confidential and shall not disclose or permit it to be disclosed to any unauthorised person, and to inform us as soon as reasonably practicable if you know or suspect that someone else knows your username and password or believe the confidentiality of your username and password has been lost, stolen or compromised in any way or that actual or possible unauthorised transactions have taken place. We are not liable for any damages resulting from any security breaches, on unauthorised and/or fraudulent use of your username and password.
We will only retain your personal data for as long as necessary for the purpose for which that data was collected and to the extent permitted by applicable laws. In general, we will keep your personal data for between five (5) to ten (10) years (depending on the type of information, and in accordance with our internal policies) after your relationship with us is terminated. However, there may be circumstances that mean we must retain your personal information for longer. To determine how long it is necessary to retain your personal information, we calculate retention periods in accordance with the following criteria:
Our services are not intended to be provided directly to children without parental consent. We will never knowingly collect personal information from individuals under the age of eighteen (18) years without first obtaining verifiable parental consent. If you are under the age of 18 you should not provide information to us. If we become aware that a person under 18 has provided personal information to us without verifiable parental consent, we will remove such personal information from our files.
The data protection laws provide individuals with the following rights:
Contacting Us – Feedback, Withdrawal of Consent, Access and Correction of your Personal Data
Please note that if your Personal Data has been provided to us by a third party, you should contact that such party directly to make any queries, feedback and access and correction requests to GTI Group on your behalf.
If you withdraw your consent to any or all use of your Personal Data, depending on the nature of your request, GTI Group or any of the Companies may not be in a position to continue to provide its products or services to you or administer any contractual relationship in place. A withdrawal of consent may also result in the termination of any agreements you have entered into with GTI Group or any of the Companies, and your being in breach of your contractual obligations or undertakings, and GTI Group or the Company’s legal rights and remedies in such event are expressly reserved.