Data Protection (NDPA) Compliance Statement

Purpose and scope

This statement sets out how Kursi Group Limited and its subsidiaries meet their obligations as data controllers and processors under the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation 2019 (NDPR) to the extent not inconsistent with the NDPA, and the General Application and Implementation Directive 2025 (GAID) issued by the Nigeria Data Protection Commission (NDPC).

It applies to all personal data processed by any Kursi Group company — about employees, contractors, job applicants, customers, suppliers, investors, community members, website users and visitors — in any format and on any system. It complements our public Privacy Policy and our internal data protection procedures.

Our principles

Every Kursi Group company processes personal data in line with the principles of the NDPA. Personal data must be:

• processed lawfully, fairly and transparently;
• collected for specified, explicit and legitimate purposes, and not used in ways incompatible with those purposes;
• adequate, relevant and limited to what is necessary;
• accurate and, where necessary, kept up to date;
• kept no longer than necessary for its purpose;
• processed with appropriate security, including protection against unauthorised processing, accidental loss, destruction or damage; and
• handled with accountability — we are responsible for, and able to demonstrate, compliance.

Governance and accountability

• Board oversight. The Board of Kursi Group Limited is ultimately accountable for data protection compliance and receives regular reports on it.
• Data Protection Officer. We have designated a Data Protection Officer (DPO) with the independence, resources and expertise the NDPA requires. The DPO advises the Group, monitors compliance, trains staff, and is the point of contact for data subjects and the NDPC. Contact: dpo@kursigroup.com.
• Registration. Where a Kursi Group company qualifies as a data controller or processor of major importance, it registers with the NDPC and renews that registration as required.
• Compliance audits. We engage a licensed Data Protection Compliance Organisation (DPCO) to audit our processing and file Compliance Audit Returns with the NDPC within the statutory timelines.
• Records of processing. We maintain records of our processing activities, including purposes, categories of data and recipients, retention periods and security measures.
• Policies and training. All staff with access to personal data receive data protection training at induction and at least once a year, and are bound by confidentiality obligations.

Lawful processing

Before collecting personal data, we identify and record a lawful basis under the NDPA — consent, contract, legal obligation, vital interests, public interest or legitimate interests. Where we rely on consent, it is freely given, specific, informed and unambiguous, recorded, and as easy to withdraw as to give. Sensitive personal data is processed only where an NDPA condition for such data applies.

Privacy by design and impact assessments

We consider data protection from the start of any new project, system or process. We carry out a Data Protection Impact Assessment (DPIA) before any processing likely to result in high risk to individuals — for example, large-scale CCTV or biometric access control at operating sites, or new employee monitoring tools — and consult the NDPC where the NDPA requires.

Data subject rights

We have a documented procedure for handling requests to exercise the rights described in our Privacy Policy, including access, rectification, erasure, restriction, objection, portability and withdrawal of consent. Requests are logged, the requester's identity is verified, and responses are issued within the timelines required by the NDPA and the GAID. Requests can be made to dpo@kursigroup.com or with the form at the end of this page.

Processors and third parties

We engage data processors only under written contracts that require them to process data on our documented instructions, keep it confidential and secure, assist us with data subject requests and breaches, and delete or return the data at the end of the service. We carry out due diligence on processors' security before engagement.

Cross-border transfers

Personal data is transferred outside Nigeria only on a basis permitted by the NDPA and the GAID — such as an adequacy decision, appropriate safeguards (including binding contractual clauses or binding corporate rules), or a specific derogation. Transfers are recorded and assessed for risk.

Security of processing

We apply technical and organisational measures appropriate to the risk, including:

• role-based access control and strong authentication for systems holding personal data;
• encryption of data in transit and, where appropriate, at rest;
• regular backups, patching and vulnerability management, aligned with our IT and Cybersecurity Policy;
• physical security at offices and operating sites;
• secure disposal of paper and electronic records; and
• pseudonymisation or anonymisation where possible.

Personal data breaches

Every suspected breach must be reported immediately to the DPO. We assess each incident, contain it, and keep a breach register. Where a breach is likely to result in a risk to individuals' rights and freedoms, we notify the NDPC within 72 hours of becoming aware of it, and inform affected individuals without undue delay where the risk is high.

Retention

Personal data is retained according to our records retention schedule and deleted or anonymised when no longer required. Retention periods reflect legal requirements — including the minimum five-year retention of customer due diligence records under the Money Laundering (Prevention and Prohibition) Act 2022 — and business need.

Employee data

Employee personal data, including payroll, pension, health and safety and disciplinary records, is processed for the purposes of the employment relationship and to meet our obligations under Nigerian labour, tax, pension and safety law. Employees receive a separate employee privacy notice.

Monitoring and review

The DPO monitors compliance through audits, spot checks and the annual DPCO audit. This statement is reviewed at least annually, or sooner if the law or our processing changes.

Contact and complaints

Questions about this statement should be sent to dpo@kursigroup.com. Anyone who is not satisfied with our response may complain to the Nigeria Data Protection Commission (www.ndpc.gov.ng).