Privacy Policy
1. Executive Introduction & Scope
Cooperative Mortgage Bank Plc (“CMB”, “the Bank”, “We”, “Us”, or “Our”) is committed to protecting the privacy, confidentiality, and security of all personal data provided by individuals who visit our website, utilize our online banking applications, or interact with our digital mortgage services. This Privacy Policy outlines how Cooperative Mortgage Bank collects, processes, stores, discloses, and protects personal data in strict compliance with the Nigeria Data Protection Act (NDPA) 2023, the Central Bank of Nigeria (CBN) Consumer Protection Framework, and applicable international data governance standards.
This policy applies to all visitors, mortgage applicants, account holders, stakeholders, and online users (“User”, “You”) accessing our website (www.cmbankng.com) and associated digital portals.
2. Lawful Basis for Data Processing
In accordance with Section 25 of the NDPA 2023, Cooperative Mortgage Bank collects and processes personal data under one or more of the following legal bases:
- Consent: Where you have given explicit, informed, and unambiguous consent to process your personal data for specified purpose(s).
- Contractual Necessity: Where processing is necessary for the performance of a mortgage contract, loan assessment, or opening a savings/depository account at your request.
- Legal & Regulatory Compliance: Where processing is required to satisfy statutory mandates established by the Central Bank of Nigeria (CBN), Nigeria Data Protection Commission (NDPC), Anti-Money Laundering/Combating the Financing of Terrorism (AML/CFT) laws, and Financial Intelligence Regulations.
- Legitimate Interests: Where processing is necessary for our legitimate operational interests, such as network security, fraud prevention, IT system maintenance, and service enhancement, provided these do not override your constitutional privacy rights
3. Information We Collect
We collect data to provide seamless financial and mortgage services. The personal data collected through our website includes:
3.1 Personal Identification Data
- Full Legal Name, Contact Details: Including physical address, email address, and active telephone numbers.
- Government-Issued Identifiers: Bank Verification Number (BVN), National Identification Number (NIN), International Passport, or Tax Identification Number (TIN) collected during digital onboarding or mortgage application processes.
- Demographic & Employment Data: Date of birth, gender, employer details, employment history, and income statements required for loan origination.
3.2 Financial & Transactional Data
- Account Details: Account numbers, transaction history, mortgage payment records, and account balances.
- Payment Credentials: Masked card numbers, payment gateway tokens, and billing addresses.
3.3 Technical & Telemetry Data
- Device & System Information: IP address, browser type and version, operating system, device identifiers, time zone settings, and geolocation data.
- Usage Metrics: Pages visited, link clicks, navigation patterns, referral URLs, and session lengths collected via cookies and analytics software.
4. How We Use Your Personal Data
Cooperative Mortgage Bank utilizes your personal data strictly for defined enterprise purposes:
- Service Delivery: Processing mortgage applications, opening accounts, managing loan repayments, and facilitating digital banking operations.
- Customer Support: Responding to inquiries, managing complaints, and providing real-time operational feedback.
- Security & Fraud Prevention: Verifying identity, detecting suspicious transactions, conducting Know-Your-Customer (KYC) checks, and preventing cyber threats.
- Regulatory Reporting: Submitting mandatory compliance returns to the Central Bank of Nigeria (CBN), Nigeria Financial Intelligence Unit (NFIU), and NDPC.
- Marketing & Analytics (Subject to Consent): Delivering personalized financial product updates and evaluating website interaction efficiency.
5. Data Sharing & Third-Party Disclosures
Cooperative Mortgage Bank does not sell, rent, or trade your personal data. We may share information only under strict confidentiality agreements with authorized third parties, including:
- Regulatory & Law Enforcement Authorities: Central Bank of Nigeria (CBN), NFIU, NDPC, and judicial authorities pursuant to valid legal processes.
- Credit Rating Agencies & Registries: Licensed Credit Bureaus and the National Housing Fund (NHF) scheme for mortgage validation and loan risk assessment.
- Technical Service Providers: Hosting providers, core banking IT vendors, payment processors, and cybersecurity partners who process data strictly under our instructions as Data Processors.
6. International Data Transfers
Where personal data is transferred or hosted outside Nigeria (e.g., cloud storage facilities), Cooperative Mortgage Bank ensures that appropriate safeguards are enforced in accordance with Section 41 of the NDPA 2023. This includes confirming adequate data protection legal regimes in the destination country or executing Standard Contractual Clauses (SCCs).
7. Data Security & Storage Management
CMB implements robust technical, organizational, and physical security measures to protect data against unauthorized access, loss, alteration, or disclosure. These measures include AES-256 end-to-end encryption, multi-factor authentication (MFA), web application firewalls, regular vulnerability assessments, and strict role-based access control (RBAC).
8. Data Retention Policy
Personal data is retained only for as long as necessary to fulfill the purposes outlined in this policy or as mandated by Nigerian financial regulations. Specifically, customer financial and identity records are retained for a minimum of ten (10) years following account closure or loan liquidation in compliance with CBN AML/CFT guidelines.
9. Your Data Subject Rights
Under the NDPA 2023, you possess fundamental privacy rights regarding your personal data held by CMB:
- Right to Information & Access: Request confirmation and copies of personal data processed by the Bank.
- Right to Rectification: Request correction of inaccurate, incomplete, or outdated data.
- Right to Erasure (‘Right to be Forgotten’): Request deletion of data where processing lacks a lawful basis (subject to legal retention mandates).
- Right to Restrict or Object: Restrict or object to data processing, including direct marketing.
- Right to Data Portability: Obtain your data in a structured, standard electronic format.
- Right to Withdraw Consent: Withdraw consent at any time without affecting prior lawful processing.
10. Contacting Our Data Protection Officer (DPO)
For inquiries, exercising data subject rights, or submitting privacy complaints, please contact our Data Protection Office:
Data Protection Officer (DPO) Cooperative Mortgage Bank Plc — Head Office |
