Privacy Policy
Effective 17 September 2026 · Version 1.0
This Notice explains what personal data we collect, why we use it, who we share it with and the rights you have. We’ve kept it short and in plain language. If anything isn’t clear, email dataprotection@sciartfinance.com and we’ll explain.
On this page
1. Who we are
The Sciart Finance Company Limited ("Sciart", "we", "us") is a finance company licensed by the Central Bank of Nigeria. Registered office: Suite 12, Trocadero Square, The Rock Drive, Lekki Phase 1, Lagos, Nigeria. RC 1845306.
We’re registered with the Nigeria Data Protection Commission (NDPC) as a Data Controller of Major Importance (Ultra-High Level).
We’re the data controller for the personal data described in this Notice.
Data Protection Officer
Post: The Data Protection Officer, The Sciart Finance Company Limited, Suite 12, Trocadero Square, The Rock Drive, Lekki Phase 1, Lagos, Nigeria
2. Who this Notice covers
This Notice applies to customers, loan applicants, guarantors, investors, business contacts and anyone who uses our website (sciartfinance.com), the TYFYS web application or our mobile app, or who contacts us by email, phone or in person.
Employees, contractors and job applicants are covered by a separate notice that we provide to them directly.
3. The personal data we collect
| Category | Examples |
|---|---|
| Identity | Name, date of birth, gender, nationality, photograph, signature, BVN, NIN, identity documents |
| Contact | Address, phone number, email address |
| Financial | Bank account details, income and employment details, credit history, repayment records, transaction history |
| Employment | Employer, job title, work address, payroll details (for salary-linked products) |
| Guarantor and next of kin | Names and contact details you give us for guarantors, next of kin or beneficiaries |
| Device and usage | IP address, device identifiers, browser type, app activity, cookie data (see our Cookie Policy) |
| Communications | Emails, call recordings, chat and support messages, complaint records |
We don’t ask for sensitive personal data (such as health, biometric, religious or political information) unless a specific service requires it. Where it does, we’ll tell you why and ask for your explicit consent. Biometric data captured during electronic identity verification is used only to confirm your identity.
4. Where we get it
We collect personal data:
- directly from you, through applications, forms, our website and apps, calls and emails;
- from identity and verification services (BVN and NIN verification);
- from licensed credit bureaus in Nigeria;
- from your employer or payroll provider, where you apply for a salary-linked product;
- from guarantors and referees you nominate; and
- from public sources and regulators.
If you give us personal data about someone else (a guarantor, next of kin or beneficiary), you confirm that you’re entitled to do so and that you’ve told them about this Notice.
5. Why we use it and our legal basis
The Nigeria Data Protection Act 2023 (NDPA) requires us to have a legal basis for each way we use your data. The table below sets out ours.
| Purpose | Legal basis (NDPA 2023) |
|---|---|
| Verifying your identity and address; opening and managing your account | Contract; legal obligation |
| Assessing loan applications, creditworthiness and affordability | Contract; legitimate interests |
| Providing loans and placements (investments you make with us), collecting repayments and paying returns | Contract |
| Meeting KYC, anti-money laundering, sanctions, tax and regulatory reporting obligations, including reporting to credit bureaus and the CBN | Legal obligation |
| Detecting and preventing fraud, and keeping our systems secure | Legitimate interests; legal obligation |
| Recovering amounts owed, and establishing or defending legal claims | Legitimate interests |
| Responding to enquiries and complaints | Contract; legal obligation |
| Improving our products, services and digital channels | Legitimate interests |
| Sending you marketing about our products | Consent |
| Non-essential cookies and analytics on our website | Consent |
Where we rely on legitimate interests, we’ve assessed that our interest doesn’t override your rights. You can ask us for details of that assessment.
6. Marketing
We only send marketing by email, SMS, WhatsApp or phone with your consent. Every message tells you how to opt out, and you can withdraw consent at any time by emailing dataprotection@sciartfinance.com. Opting out doesn’t affect service messages about your account.
7. Automated decisions
We use automated tools to support credit scoring, affordability checks and fraud detection. Where a decision that significantly affects you (for example, declining a loan) is made solely by automated means, you have the right to ask for a human review, to express your point of view and to contest the decision. Email dataprotection@sciartfinance.com to exercise this right.
8. Who we share it with
| Recipient | Why |
|---|---|
| Regulators and authorities: Central Bank of Nigeria, Nigeria Data Protection Commission, Nigerian Financial Intelligence Unit, tax authorities, courts and law enforcement | Legal and regulatory obligations |
| Licensed credit bureaus in Nigeria | Credit checks and mandatory credit reporting |
| Identity verification providers (BVN and NIN validation) | Confirming your identity |
| Our core banking, payment and fraud-monitoring providers (including Interswitch) | Operating your account and processing payments |
| Cloud and productivity providers (Microsoft 365, HubSpot, Google) | Secure storage, customer relationship management, website analytics |
| Your employer or payroll provider | Salary-linked loan verification and repayment only |
| Auditors, legal advisers, insurers and professional consultants | Audit, legal and compliance purposes |
| Debt recovery agents | Recovering amounts owed, where applicable |
We don’t sell personal data. Service providers act on our instructions under written data processing agreements and may use your data only to provide the agreed service.
9. International transfers
Some of our service providers store or process data outside Nigeria, principally in the European Union and the United States (for example, Microsoft, HubSpot and Google). We transfer data only where the NDPA permits it: to jurisdictions recognised as providing adequate protection, or under contractual safeguards that bind the recipient to protect your data to Nigerian standards. You can ask us for details of the safeguard that applies to a particular transfer.
10. How long we keep it
We keep personal data only as long as we need it for the purposes above and to meet legal requirements. When we no longer need it, we delete or anonymise it securely.
| Records | Kept for |
|---|---|
| Identity and verification records (BVN, NIN, ID documents, proof of address) | 6 years after your relationship with us ends |
| Account, transaction and repayment records | 7 years after your account closes |
| Loan and credit files | 7 years after the loan is repaid or written off |
| Complaints and dispute records | 7 years after resolution |
| Marketing and consent records | 3 years after your last interaction or consent event |
| Office visitor CCTV | 120 days, unless needed for an investigation |
| Website and app analytics data | As set out in our Cookie Policy |
We may keep records longer where the law, a regulator or a legal claim requires it.
11. How we protect it
We use encryption in transit and at rest, access controls, multi-factor authentication, monitoring and staff training, and we require the same of our service providers. No system is completely secure. If a breach is likely to put you at high risk, we’ll tell you without undue delay, and we report notifiable breaches to the NDPC within 72 hours.
12. Your rights
Under the NDPA you can ask us to:
- give you access to the personal data we hold about you;
- correct it where it's inaccurate or incomplete;
- delete it, where we're not required to keep it;
- restrict or object to how we use it;
- provide it to you, or to another provider, in a machine-readable format;
- withdraw consent at any time; and
- review any decision made solely by automated means.
To exercise a right, email dataprotection@sciartfinance.com or write to the Data Protection Officer at the address above. You can also use our data subject request form. We’ll verify your identity and respond within 30 days. Requests are free unless they’re manifestly unfounded or excessive.
13. Complaints
If you’re unhappy with how we handle your data, contact our Data Protection Officer first. We acknowledge complaints within 5 business days and aim to resolve them within 30 days. You may also complain to the Nigeria Data Protection Commission (ndpc.gov.ng) at any time.
14. Children
Our products are for adults aged 18 and over. We don’t knowingly collect personal data from anyone under 18. If we learn that we have, we’ll delete it.
15. Cookies
Our website uses cookies and similar technologies. See our Cookie Policy for what we use and how to manage your preferences.
16. Changes to this Notice
We review this Notice at least once a year and will post any updated version here with a new effective date. If a change materially affects existing customers, we’ll tell you directly.
The Sciart Finance Company Limited · RC 1845306 · Licensed by the Central Bank of Nigeria · Privacy Notice v1.0, effective 17 September 2026