Privacy Policy

Items in square brackets are to be confirmed by CEMCS before publication.

Contents

Part 1: About this Privacy Policy 1. Purpose and scope 2. Definitions 3. Who we are 4. Our commitments

Part 2: What we collect 5. Personal data we collect, by activity 6. Sensitive personal data 7. Personal data about other people 8. Personal data we receive from others 9. Personal data collected automatically 10. Personal data we do not collect

Part 3: How we use it 11. Purposes and lawful bases 12. Loan eligibility checks and automated processing 13. The CEMCS Hub assistant 14. Communications

Part 4: Who sees it 15. What other Members and the public can see 16. CEMCS staff and officers 17. Service providers acting for CEMCS 18. Organisations that receive data for their own purposes 19. Public authorities 20. International transfers

Part 5: How we look after it 21. Security 22. Retention 23. Personal data breaches

Part 6: Your rights 24. Your rights under the NDPA 25. How to exercise your rights 26. Deleting your CEMCS Hub account 27. Complaints

Part 7: Other matters 28. Eligibility and minors 29. Deceased Members and representatives 30. Device permissions 31. Cookies and device storage 32. Links to other services 33. Changes to this Privacy Policy 34. Contact details

Schedule 1: Processing register (purpose, data, lawful basis, recipients, retention) Schedule 2: Legitimate interest assessments Schedule 3: Service providers and recipients Schedule 4: Retention schedule

Part 1: About this Privacy Policy

1. Purpose and scope

1.1 This Privacy Policy explains how Chevron Employees Multipurpose Cooperative Society (“CEMCS”, “we”, “us”) collects, uses, shares, stores, protects and deletes personal data when you use CEMCS Hub. It is issued to meet section 27 of the NDPA and the transparency requirements of the GAID.

1.2 CEMCS Hub is CEMCS’s digital member service. It is available as:

1. the CEMCS Hub mobile app for iPhone and Android, distributed through the Apple App Store and Google Play;
2. the CEMCS Hub member portal, a website at hub.cemcs.com; and
3. related services, including emails, push notifications, the in-app assistant, the public membership verification page and the guarantor response page.

1.3 Through CEMCS Hub, Members can manage savings, special deposits and share capital; apply for and manage loans; act as guarantors; subscribe to investments and fixed deposits; take part in CEMCS real estate projects; use the CEMCS marketplace (Shop, Trade It, Insurance, Travel, Care for Community, vouchers and CPay); register interest in life planning products; manage cash in lieu requests and obligations; plan retirement and exit; maintain beneficiaries and bank accounts; request letters; and get help.

1.4 This Privacy Policy applies to everyone whose personal data is processed through CEMCS Hub, including:

1. Members of every membership type (Regular Member, Retiree, Expatriate and any other type CEMCS creates);
2. people applying to become Members, including retirees registering through the retiree registration form;
3. beneficiaries, next of kin and travel passengers named by a Member;
4. Members who act as guarantors, including when they respond through an emailed link;
5. anyone who scans a Member’s membership card QR code;
6. people named in documents a Member uploads; and
7. CEMCS officers and staff, to the limited extent described in Section 16.

1.5 This Privacy Policy does not cover CEMCS’s processing outside CEMCS Hub (for example paper forms held at the Secretariat, which are covered by CEMCS’s general privacy notice), or the privacy practices of Apple, Google, banks or other organisations that have their own privacy policies.

1.6 Where the CEMCS Bye-laws require CEMCS to keep or use records, this Privacy Policy explains how that is done in line with the NDPA. The Bye-laws, the CEMCS Hub Terms of Service and the product terms you accept for individual loans, projects and services should be read together with this Privacy Policy.

2. Definitions

3. Who we are

3.1 Data controller

3.2 Data Protection Officer

3.2.1 CEMCS has appointed a Data Protection Officer under section 32 of the NDPA. The DPO advises CEMCS on data protection, monitors compliance, handles your rights requests and complaints, and is CEMCS’s point of contact with the Commission.

3.3 Our data processor

3.3.1 Flexcom Systems Limited designs, builds, hosts, maintains and supports CEMCS Hub for CEMCS, under a written data processing agreement that meets section 29 of the NDPA. Flexcom acts only on CEMCS’s instructions and may not use Member data for its own purposes.

3.4 App store publisher

3.4.1 The CEMCS Hub mobile app is published on the Apple App Store and Google Play through Flexcom’s organisation developer accounts on behalf of CEMCS, because CEMCS does not yet hold eligible developer accounts. The store listings therefore show Flexcom Systems Limited as the developer. This is a publishing arrangement only. CEMCS is the data controller and this Privacy Policy applies. The listings will move to CEMCS’s own accounts when they are available.

4. Our commitments

4.1 CEMCS processes personal data in line with the principles in section 24 of the NDPA. In practice this means:

1. we only collect what each service needs, and we tell you why at the point of collection;
2. we use personal data only for the purposes in this Privacy Policy, or compatible purposes we tell you about;
3. we keep personal data accurate and let you correct it;
4. we keep personal data no longer than necessary;
5. we protect personal data with appropriate security; and
6. we keep records that show how we comply.

4.2 CEMCS also commits that:

1. we do not sell personal data;
2. we do not show advertising in CEMCS Hub, and we do not use advertising identifiers or tracking technologies;
3. we do not use analytics tools that profile you;
4. we do not use pre-ticked boxes or silence as consent;
5. we do not take decisions with legal or similarly significant effects on you solely by automated means; and
6. we do not use your personal data to train artificial intelligence models, and we require our providers not to do so.

Part 2: What we collect

5. Personal data we collect, by activity

This Section lists, for each thing you can do in CEMCS Hub, the personal data involved. Section 11 and Schedule 1 explain why and on what lawful basis.

5.1 Registering for CEMCS Hub

5.1.1 Members registering through the sign-up screen provide:

5.1.2 New registrations are created in “Pending Approval” status. CEMCS staff check the details against CEMCS’s membership register and, where relevant, employment records before approving.

5.1.3 Retirees registering through the retiree registration form provide name, email, mobile number, date of birth, CAI, membership type, gender, pension number, existing membership number and address. When a Regular Member retires, the membership number is given an “R” suffix and the login switches to a personal email address the Member provides.

5.2 Your profile and membership record

5.2.1 CEMCS Hub displays and maintains your membership record, which includes: name, membership number, membership type, email, mobile number, date of birth, gender, employer, staff ID, CAI, pension number (Retirees), date you joined CEMCS, date you joined Chevron Nigeria Limited, employment date, expected retirement date, membership status, guarantee limit and profile photo.

5.2.2 You can change your email address and mobile number directly. Changes to date of birth, employer or staff ID are submitted as requests for CEMCS staff to approve, and a change of date of birth requires a supporting document.

5.2.3 Profile photo. If you upload a profile photo, it is shown in CEMCS Hub and on your digital membership card. [See the Data Handling Policy and gap register: profile photos are currently stored as non-private files.]

5.3 Signing in and account security

5.4 Savings, special deposits and share capital

5.4.1 CEMCS Hub processes your savings, special deposit and share capital balances and transaction history; your monthly contribution amount and changes to it; deposits by bank transfer to a CEMCS collection account with an uploaded proof of payment; withdrawal requests; transfers between your accounts; share capital purchases; and statements.

5.5 Loans

5.5.1 When you apply for or manage a loan, CEMCS processes:

1. the loan product, amount, tenure and purpose;
2. your eligibility, savings and existing loan position, and your guarantee capacity;
3. for Regular Members, the result of an affordability check with Chevron Nigeria Limited’s net-pay service (see Section 18.3);
4. the guarantors you choose, or the investment you pledge as security;
5. your payout account, or instruction to pay to your special deposit;
6. supporting documents you upload, which may include your e-benefits page, a flexible benefits support document, entitlement or expected-value evidence, a vehicle invoice, a pension slip or a gratuity statement, depending on the product;
7. your acceptance of the loan terms and your typed-name signature, which is checked against the name on your record;
8. the decision and conditions;
9. disbursement, repayment schedule, repayments, early repayment or offset, top-ups, tenor extensions and guarantor replacements; and
10. recovery action under the Bye-laws where a loan is in default.

5.6 Guarantees

5.6.1 When you act as a guarantor, CEMCS processes the loans you are asked to guarantee or have guaranteed, the amount of each guarantee, your acceptance or decline and its date, and your remaining guarantee capacity. Guarantor requests are sent by email with a secure link, and can also be answered in CEMCS Hub.

5.7 Investments and fixed deposits

5.7.1 CEMCS processes your investment subscriptions, top-ups, early withdrawal requests, maturity instructions, cancellations and statements. For US dollar investments, CEMCS processes the bank and intermediary bank details you provide for payment.

5.8 Real estate projects

5.8.1 When you take part in a CEMCS real estate project, CEMCS processes:

1. site visit bookings;
2. your Expression of Interest, including your name, CAI, phone, email, alternative email, employee number, the beneficiaries you nominate for the subscription, your acknowledgement of the project terms, your attestation and your typed-name signature;
3. saved EOI drafts and waiting-list entries;
4. stage payments, your project ledger, penalties, stage extensions, unit allocation and progress updates;
5. documents you upload (for example proof of address) and documents CEMCS issues to you;
6. comments you post on project documents, which are sent to CEMCS Internal Control; and
7. property transfer requests to or from another Member, including the other Member’s membership number, the property’s location, size and title document number, and both parties’ typed signatures.

5.9 Marketplace

5.9.1 Shop. Your basket, orders, delivery and billing addresses (label, address lines, city, state, country, postcode, phone), payment method and order history.

5.9.2 Trade It. If you register as a seller: your seller registration and acceptance of seller terms, your listings and listing photos, bids you place, and settlement of bids.

5.9.3 Vouchers. Vouchers issued to you, including holder phone number, value, use and expiry. For SureGift gift cards, the card code and PIN you enter.

5.9.4 CPay. Your CPay limit, instalments and repayment position.

5.9.5 Care for Community. Your donations and the payment method.

5.9.6 Transactions. A record of each marketplace sale, which is shared with CEMCS’s accounting system (see Section 18.4).

5.10 Insurance

5.10.1 When you apply for insurance through CEMCS Hub, CEMCS processes:

1. applicant details: full name, email, phone, address, country, state and city;
2. for health insurance: your chosen hospital, marital status, occupation, number of persons covered (up to six), and health and religion information described in Section 6;
3. Bank Verification Number (BVN) and bank name, account number and account name, for the health insurance application;
4. identity and passport attachments where the plan requires them;
5. for car insurance: vehicle make, model, year, plate number and up to two proof-of-ownership documents;
6. for house insurance: property location, building and contents values (including generators, cash and jewellery) and a contents list;
7. for business insurance: business name, location, type and description;
8. renewals, premiums and payment method; and
9. claims: incident date, description, and supporting documents such as police reports and photographs, and the payout.

5.10.2 Draft insurance applications, including the information in paragraph 5.10.1, are saved on CEMCS’s servers so you can return to them.

5.10.3 Insurance applications are handled by the CEMCS Insurance Desk. [CEMCS to confirm how applications are passed to the underwriting insurer, which insurers are used, and what data each receives. See Schedule 3.]

5.11 Travel

5.11.1 When you make a travel enquiry or booking, CEMCS processes flight, hotel and tour details, travel dates and routes, and for each passenger: title, first, middle and last name (as on the passport), gender, email, phone, passenger type and the name of a next of kin. You may upload up to ten supporting documents per booking, such as passport data pages and visas. Bookings are handled by the CEMCS Travel Desk. [CEMCS to confirm which travel agents or airlines receive booking data.]

5.12 Life planning

5.12.1 When you register interest in a life planning product (such as a living trust or an annuity), CEMCS processes your answers to the product questionnaire and the consents you give in it. After a CEMCS officer reviews your enquiry, CEMCS sends the product provider your full name, the product name, your email address and a reference number so the provider can contact you. Your questionnaire answers are not sent to the provider. See Section 18.5.

5.13 Cash in lieu and obligations

5.13.1 CEMCS processes your cash in lieu requests, the outcome, and your outstanding obligations to CEMCS.

5.14 Retirement, exit and account closure

5.14.1 When you retire or leave CEMCS, CEMCS processes your retirement or withdrawal date, reason, settlement summary, balances and obligations, your forwarding email address, your payout bank account, a snapshot of your beneficiaries or your waiver of beneficiaries, your pension number, and the amounts handed to Chevron Nigeria Limited for recovery where applicable.

5.15 Beneficiaries and bank accounts

5.15.1 Beneficiaries: name, phone, email, address, percentage share, and bank, account name and account number.

5.15.2 Linked bank accounts: bank, account name, 10-digit account number and sort code. Bank accounts must be in your own name; CEMCS staff check the account details before paying funds to a new account.

5.16 Letters

5.16.1 When you request a letter (for example a letter of introduction for an embassy, or a loan confirmation letter), CEMCS processes the destination, purpose, travel dates where relevant, and whether you want your balances included. The letter states your identity, how long you have been a Member, your standing and only the balances you choose to include. You download the letter or receive it by email; CEMCS does not send it to the destination.

5.17 Membership card

5.17.1 Your digital membership card shows your name, photo, membership number and membership type, and a QR code. Section 15.3 explains what the QR code reveals.

5.18 Notifications and preferences

5.18.1 CEMCS processes your notification feed, your channel choices for each category (in-app, email, push), and, for push notifications, your device’s push token, platform and a random installation identifier.

5.19 Help, assistant and feedback

5.19.1 Assistant. The questions you ask, the conversation, the screen you were on, and the data the assistant retrieves to answer you. See Section 13.

5.19.2 Feedback. When you submit feedback: the module, your rating, your written observation, an optional screenshot, the platform (iOS, Android or web) and app version, together with your name, membership type, email and phone, which are filled in from your profile.

5.19.3 Support emails. Messages you send to helpdesk@cemcs.com, support@cemcs.com, insurance@cemcs.com or travel@cemcs.com and CEMCS’s replies.

5.20 Documents you upload

5.20.1 Across CEMCS Hub you may upload photos and documents. Images are reduced in size on your device before upload. Uploaded documents are stored as private files that only you and authorised CEMCS staff can open. Once a proof or supporting document has been submitted, you cannot delete it yourself, because it forms part of the record of the transaction.

5.20.2 Documents can contain more personal data than CEMCS needs. Please cover or blur information that is not relevant before uploading where you can.

6. Sensitive personal data

6.1 What sensitive personal data CEMCS Hub collects

6.1.1 CEMCS Hub collects sensitive personal data in one place: the health insurance application. The form asks for:

1. genotype;
2. blood group;
3. weight;
4. height; and
5. religion.

6.1.2 This information is requested because [CEMCS to state the reason, for example the underwriting insurer requires it to price and issue the health plan]. [CEMCS to confirm whether religion is genuinely required by the insurer. If it is not, it should be removed from the form; see the gap register.]

6.2 Lawful basis

6.2.1 Under section 30 of the NDPA, CEMCS may process sensitive personal data only on one of the grounds that section sets out. CEMCS relies on your explicit consent. Before you submit the health section, CEMCS Hub will:

1. explain what sensitive information is requested, why, and who will receive it;
2. ask you to tick a separate, unticked box to give explicit consent; and
3. record your consent with the date, time, app or portal version and Privacy Policy version.

6.2.2 You do not have to give this information. If you do not, CEMCS may not be able to process a health insurance application, but this will not affect any other CEMCS service.

6.2.3 You may withdraw consent at any time by contacting the DPO. Withdrawal does not affect processing already done, and may mean the health insurance cannot continue.

6.3 Safeguards

6.3.1 Health and religion data is visible only to CEMCS Insurance Desk staff and the DPO, is never used for any purpose other than the insurance application and claim, is never used in loan or membership decisions, and is not sent to the AI assistant.

6.4 Other data CEMCS treats as high-risk

6.4.1 Bank Verification Numbers, bank account numbers, pension numbers, passport and identity document images, and authentication secrets are not sensitive personal data under the NDPA, but CEMCS treats them as restricted data with additional protection, as described in the Data Handling Policy.

6.5 Data you volunteer

6.5.1 Please do not include health, religious, political or other sensitive information in feedback, assistant conversations, comments or uploads unless CEMCS has asked for it for a stated purpose.

7. Personal data about other people

7.1 You may give CEMCS personal data about other people: beneficiaries, a next of kin on a travel booking, travel passengers, persons covered under a health insurance plan, the Member you transfer a property to, or people named in documents.

7.2 When you do, you confirm that:

1. you are entitled to give CEMCS their details;
2. you have told them you are doing so and that they can read this Privacy Policy at https://hub.cemcs.com/legal/privacy-policy; and
3. for persons covered under a health insurance plan, you have their explicit consent, or the authority of a parent or guardian, to give CEMCS their health information.

7.3 CEMCS does not contact beneficiaries or next of kin who are not Members except where a benefit is to be paid, on a Member’s death or exit, or where the law requires.

8. Personal data we receive from others

9. Personal data collected automatically

9.1 Device and connection data

9.2 Error, crash and performance data (CEMCS Monitor)

9.2.1 When the mobile app or portal encounters an error or crash, it sends a report to CEMCS Monitor, CEMCS’s own error reporting service operated by Flexcom. Reports contain the error message and technical trace, the screen or page involved, the time, the operating system and version, and the app version and build. Before the report leaves your device, CEMCS Hub removes email addresses, sequences of four or more digits, identifier-like strings and quoted values. On the portal, reports are linked to a one-way, salted code derived from your account so that repeated errors can be grouped without revealing who you are. On the mobile app, reports carry no Member identifier.

9.2.2 CEMCS Monitor also receives an anonymous count of sessions and aggregated performance measurements, such as how long screens take to load.

9.2.3 CEMCS Hub does not use third-party analytics, crash reporting or advertising tools.

9.3 Approximate location from IP address

9.3.1 CEMCS Hub does not use your device’s location. To show you where your signed-in sessions are, and to help detect unusual sign-ins, CEMCS sends the IP address of each session to ipapi.co, a third-party service, which returns an approximate city and country. The result is kept for seven days. CEMCS also keeps a record of the country and network range you usually sign in from, for 90 days, to recognise unusual sign-ins.

10. Personal data we do not collect

10.1 CEMCS Hub does not collect:

1. your device’s location;
2. your contacts, calendar, call log or text messages;
3. microphone audio;
4. your fingerprint or face data;
5. advertising identifiers, or data for cross-app or cross-site tracking;
6. your National Identification Number, driver’s licence number or tax identification number; or
7. your card number, expiry date or security code. CEMCS Hub does not currently accept card payments.

10.2 CEMCS Hub does not collect your Bank Verification Number except on the health insurance application.

Part 3: How we use it

11. Purposes and lawful bases

11.1 Section 25 of the NDPA requires a lawful basis for each use of personal data. CEMCS relies on:

11.2 Schedule 1 sets out each purpose, the data used, the lawful basis, who receives the data and how long it is kept. In summary, CEMCS uses personal data to:

1. register you, verify your eligibility and maintain your membership record;
2. run your savings, special deposits, share capital and statements;
3. assess, approve, disburse, administer and recover loans;
4. record and enforce guarantees;
5. administer investments and fixed deposits;
6. administer real estate projects, including EOIs, allocations, payments and transfers;
7. operate the marketplace, insurance, travel, charity, vouchers and CPay;
8. refer life planning enquiries to providers;
9. administer cash in lieu, obligations, retirement, exit and benefit settlement;
10. pay dividends and interest;
11. produce letters and the membership card;
12. process payments and reconcile them with bank and payroll records;
13. send you notifications and statements;
14. keep CEMCS Hub and your account secure;
15. provide help, the assistant and support;
16. fix errors and improve CEMCS Hub;
17. produce management reports for CEMCS staff;
18. meet legal, audit and regulatory duties; and
19. establish, exercise or defend legal claims.

11.3 Consent. Where CEMCS relies on consent, it asks separately, with an unticked box, explains what you are agreeing to, and records your consent. You can withdraw it at any time without affecting your membership.

11.4 Legitimate interests. Where CEMCS relies on legitimate interests, it has assessed that its interests are not overridden by yours. Schedule 2 summarises these assessments. You may object (Section 24.8).

11.5 New purposes. If CEMCS wants to use personal data for a new purpose that is not compatible with the original one, it will tell you first and, where needed, ask for your consent.

12. Loan eligibility checks and automated processing

12.1 When you start a loan application, CEMCS Hub checks rules set under the Bye-laws, such as your membership type, how long you have been a Member, your contribution history, your savings, your existing loans and obligations, your guarantee cover and, for Regular Members, whether Chevron Nigeria Limited’s net-pay service confirms that your pay can accommodate the deduction. CEMCS Hub then tells you whether you appear eligible and, if not, why.

12.2 This is a preliminary check. Each application is reviewed and decided by authorised CEMCS staff, who may approve or decline in line with the Bye-laws. CEMCS does not make loan or membership decisions solely by automated means.

12.3 CEMCS Hub also runs automated security checks on requests, which assess risk from signals such as a new device, an unfamiliar location or network, and the sensitivity of the action. [At the date of this Privacy Policy these checks record decisions but do not block actions. When they are switched on, they may ask you for step-up verification or temporarily refuse a sensitive action until you verify.] A refused action can always be completed by verifying or by contacting support.

12.4 You can ask for an explanation of the rules applied to you, give your point of view, and ask for a person to review any outcome. Contact support or the DPO.

13. The CEMCS Hub assistant

13.1 CEMCS Hub includes an assistant that answers questions about CEMCS services and about your own account, using an artificial intelligence language model.

13.2 How it works. When you ask a question, CEMCS Hub sends your conversation and the name of the screen you are on to the assistant service. To answer questions about your account, the assistant can look up your own records, acting only as you, for example your savings, loans, statements, investments, project subscriptions, guarantees, beneficiaries, bank accounts (with account numbers reduced to the last four digits), dividends, cash in lieu requests and notifications. It cannot see other Members’ records, and it cannot carry out transactions.

13.3 The language model provider. The assistant uses [CEMCS to confirm before the assistant is switched on: a model hosted on CEMCS-controlled infrastructure / Anthropic PBC (United States) / Cloudflare Workers AI]. [If a third-party provider is used: The provider processes your conversation and the account data retrieved to answer it only to generate the reply, under terms that prohibit it from using your data to train its models and that limit how long it keeps the data.] See Section 20 on international transfers.

13.4 What is kept. Conversations are kept in the assistant server’s memory only, for up to 24 hours of inactivity, and are not written to CEMCS’s database. You can have up to six conversations at a time and send up to 20 messages a day.

13.5 Lawful basis. [CEMCS to choose: consent, asked the first time you open the assistant / legitimate interests in helping Members use CEMCS services, with the right to object.] The assistant is optional. You can always use CEMCS Hub without it and get help from the Help pages or by email.

13.6 Limitations. The assistant can make mistakes. Its answers are not financial, legal or tax advice and do not change your account. Your statements and the records in CEMCS Hub are the authoritative record.

13.7 What not to share. Do not give the assistant passwords, one-time codes, card details, health information or other people’s personal data.

14. Communications

14.1 How CEMCS contacts you

14.1.1 CEMCS Hub sends messages by in-app notification, email and push notification. CEMCS Hub does not currently send SMS.

14.2 Messages you always receive

14.2.1 Some messages are necessary to run your account and keep it secure, and cannot be switched off while you are a Member. These include sign-in and verification codes, password reset links, security alerts, guarantor requests, loan and transaction confirmations, statements required by the Bye-laws, notices of changes to the Terms of Service or this Privacy Policy, and account closure communications.

14.3 Messages you can control

14.3.1 For each notification category you can choose which channels to use in Settings. By default, account activity and loan reminders are on; project updates and statements are off.

14.3.2 Birthday greetings. CEMCS sends Members a birthday greeting by email. [CEMCS to decide whether this is offered as an opt-out preference.]

14.3.3 Marketing. CEMCS will send you general announcements or promotional messages only if you opt in. This preference is off by default.

14.4 Content of push notifications

14.4.1 Push notifications are delivered through Google Firebase Cloud Messaging and, for iPhones, Apple Push Notification service. A push notification can show a title and short message, which may include an amount or a name, on your lock screen. You can hide notification previews in your phone’s settings.

14.5 Emails with attachments

14.5.1 When you ask for a statement, loan schedule, dividend statement, beneficiary list, membership card, letter or insurance document by email, it is sent as an attachment to your registered email address only.

14.6 CEMCS will never ask for

14.6.1 CEMCS will never ask you for your password, a full one-time code, your authenticator code or your card details by email, phone, push notification, the assistant or social media.

Part 4: Who sees it

15. What other Members and the public can see

15.1 Member search for guarantors

15.1.1 When another Member searches for a guarantor, they can find you by name, membership number or email address. The search shows them your name, your membership number and your available guarantee capacity in naira. It does not show your email address, phone number, balances or any other details. [CEMCS to confirm that showing available guarantee capacity to other Members is approved under the Bye-laws, and whether Members may opt out of being found.]

15.2 Guarantees and transfers

15.2.1 When you ask another Member to guarantee your loan, they see your name, the loan product, the total loan amount, the repayment period, the number of guarantors and the amount they are asked to guarantee. When you transfer a property subscription, the receiving Member sees the details of the property and the transfer.

15.3 Membership card QR code

15.3.1 Anyone who scans the QR code on your membership card, or who has the link it contains, can see your name, membership number, membership type, the year you became a Member and whether your membership is active, retired or inactive. They cannot see anything else. Share your card only with people who need to verify your membership. [The QR link does not currently expire; see the gap register.]

15.4 Guarantor response page

15.4.1 A guarantor who follows the link in a guarantor request email can see the loan amount, their share and their remaining capacity, without signing in.

16. CEMCS staff and officers

16.1 Authorised CEMCS staff use CEMCS’s back-office system to administer membership and services. Access is limited by role. For example, the Insurance Desk sees insurance applications, the Travel Desk sees travel bookings, finance officers see payments, and approvers see the applications they approve. Roles include membership, finance, loan, project, document, evidence, transfer, insurance, travel and marketplace roles, Internal Control, Compliance, Legal, the Treasurer, the General Manager, the President and members of the Executive Committee, each limited to what the role needs.

16.2 CEMCS staff also use internal management reporting tools to run the cooperative. These tools read CEMCS data with the same role-based permissions as the back office, so staff see only what their role allows.

16.3 Staff comments marked as internal are not shown to you. Other comments and the change history of your own records are visible to you in CEMCS Hub.

17. Service providers acting for CEMCS

17.1 These organisations process personal data for CEMCS under written agreements requiring them to act only on CEMCS’s instructions, keep the data confidential and secure, and delete or return it when the service ends. Full details are in Schedule 3.

18. Organisations that receive data for their own purposes

18.1 Payments

18.1.1 CEMCS Hub does not currently accept online card or bank payments. You can pay CEMCS through payroll deduction, from your special deposit, with vouchers, with CPay, or by bank transfer to a CEMCS collection account shown in CEMCS Hub, uploading your proof of payment. Your bank processes bank transfers under its own terms.

18.1.2 If CEMCS introduces online payments through a licensed payment service provider, CEMCS will update this Privacy Policy before the service starts, naming the provider and describing the personal data shared with it.

18.2 Bank account details

18.2.1 CEMCS does not currently use an external service to verify bank account names. CEMCS staff check new bank account details before paying funds to them. If CEMCS introduces automated account name verification, it will update this Privacy Policy first.

18.3 Chevron Nigeria Limited

18.3.1 For Regular Members, CEMCS shares with Chevron Nigeria Limited’s net-pay service your employee number, your current loan exposure, the proposed monthly repayment, and the proposed start month and year, so that Chevron can confirm whether your pay can accommodate the deduction. Chevron returns a yes or no response.

18.3.2 Chevron Nigeria Limited also sends CEMCS your monthly payroll remittances (your membership number and the amount deducted), and receives from CEMCS the amounts to be recovered through payroll, under your deduction authority and the arrangement between CEMCS and Chevron.

18.3.3 When you retire or exit, CEMCS may notify Chevron Nigeria Limited of your exit and any amount to be recovered.

18.4 CEMCS’s accounting system

18.4.1 CEMCS’s accounting system reads marketplace sales from CEMCS Hub: your membership number, name, membership type, the sale type, date, items, amount, payment method and reference. This is processing by CEMCS itself, but is listed here for transparency.

18.5 Life planning providers

18.5.1 When you register interest in a life planning product and a CEMCS officer reviews your enquiry, CEMCS sends the provider of that product your full name, the product name, your email address and a reference number, so that the provider can contact you directly. Providers include Cardinal Stone (living trusts), AIICO Insurance Plc (annuities) and [Custodian, when enabled]. Once the provider contacts you, its own privacy policy applies to the relationship between you and the provider.

18.6 Insurers and travel providers

18.6.1 [CEMCS to confirm: When the Insurance Desk places your insurance, CEMCS shares the information needed to underwrite, issue and service the policy, and to handle claims, with the underwriting insurer [names], including, with your explicit consent, the health information in Section 6. When the Travel Desk books your travel, CEMCS shares passenger names, contact details and travel documents with [the travel agent / airline / hotel].]

18.7 SureGift

18.7.1 When you redeem a SureGift gift card, the card code and PIN are sent to SureGift through CEMCS’s connection to check the balance and redeem it. [Not yet active.]

18.8 ipapi.co

18.8.1 CEMCS sends the IP address of each signed-in session to ipapi.co to obtain an approximate city and country (Section 9.3).

18.9 Apple and Google

18.9.1 Apple and Google receive information when you download and use apps from their stores, under their own terms. CEMCS does not share your account data with them, other than push tokens and notification content as described in Section 17.

18.10 Professional advisers, auditors and insurers of CEMCS

18.10.1 CEMCS’s external auditors, legal advisers, licensed Data Protection Compliance Organisation and its own insurers receive records where needed for audit, advice, data protection audit or claims, under confidentiality obligations.

19. Public authorities

19.1 CEMCS discloses personal data to courts, law enforcement agencies, the Lagos State ministry responsible for cooperatives, tax authorities, the Commission and other public bodies only where the law requires or permits it. Each request is reviewed by the DPO, limited to what is necessary, and logged. Unless the law prevents it, CEMCS will tell you.

19.2 If CEMCS amalgamates with, transfers its business to, or is restructured into another body under the Cooperative Societies Law and the Bye-laws, personal data will pass to that body so your membership continues. CEMCS will tell you in advance.

20. International transfers

20.1 Personal data in CEMCS Hub may be transferred outside Nigeria in these cases:

20.2 CEMCS transfers personal data outside Nigeria only in accordance with sections 41 to 43 of the NDPA and the GAID: where the recipient is subject to a law, binding corporate rules, contractual clauses, code of conduct or certification that gives an adequate level of protection, or where a condition in section 43 applies, such as your informed consent to a specific transfer or the transfer being necessary to perform a contract with you.

20.3 You can ask the DPO for details of the safeguard used for any transfer.

Part 5: How we look after it

21. Security

21.1 What CEMCS does

21.1.1 CEMCS and Flexcom protect personal data with technical and organisational measures appropriate to the risk, as required by section 39 of the NDPA, including:

1. encrypted connections. All traffic to CEMCS Hub uses HTTPS with TLS 1.2 or higher. The mobile app checks that it is talking to CEMCS’s genuine servers (certificate pinning);
2. sign-in protection. Passwords are stored only in hashed form. Two-step verification with an authenticator app or email code is available [and will be mandatory from [date]]. Sensitive actions, such as adding a bank account, may require step-up verification;
3. sessions. On the mobile app, your session is held only in the app’s memory and is never written to your phone’s storage; it ends when the app is closed or after 30 minutes in the background. You can see and end your sessions and remove trusted devices in Settings. Changing your password signs out other devices and cancels biometric sign-in;
4. biometric sign-in. The sign-in credential is held in your phone’s secure hardware, can be used only on that phone, and is unlocked only by your biometric check;
5. private documents. Uploaded documents are stored as private files that only you and authorised staff can open;
6. role-based access for CEMCS staff, limited to what each role needs;
7. web protections, including a strict content security policy, protection against cross-site request forgery, and pages that are not cached by your browser;
8. no app backups. The Android app does not allow its data to be copied into device backups;
9. error reporting with redaction (Section 9.2);
10. monitoring and logging of security events; and
11. training and confidentiality obligations for staff and Flexcom personnel.

21.2 What you can do

21.2.1 Use a strong password you do not use elsewhere; turn on two-step verification; set a screen lock on your phone; keep CEMCS Hub and your phone updated; install CEMCS Hub only from the App Store or Google Play; never share passwords or codes; review your sessions and activity log; and report anything suspicious to helpdesk@cemcs.com or +234 809 236 2752 immediately.

21.3 No guarantee

21.3.1 No system is completely secure. If a breach occurs, CEMCS will act as described in Section 23.

22. Retention

22.1 CEMCS keeps personal data only as long as necessary for the purposes in this Privacy Policy, including to meet the Bye-laws and legal, accounting, audit and limitation requirements. Schedule 4 lists retention periods. When a period ends, CEMCS deletes the data or anonymises it so it can no longer identify you.

22.2 Where data is needed for an ongoing dispute, investigation, audit or legal proceeding, CEMCS may keep it until the matter is closed.

23. Personal data breaches

23.1 If a breach is likely to result in a risk to your rights and freedoms, CEMCS will notify the Commission within 72 hours of becoming aware, as required by section 40 of the NDPA. If the breach is likely to result in a high risk, CEMCS will also tell you without undue delay, in plain language, what happened, what data was involved, the likely consequences, what CEMCS is doing and what you can do to protect yourself.

Part 6: Your rights

24. Your rights under the NDPA

24.1 Right to be informed

This Privacy Policy and the notices in CEMCS Hub tell you how your data is used.

24.2 Right of access

You can ask whether CEMCS processes your personal data and receive a copy, with information about the purposes, categories, recipients (including outside Nigeria), retention, your rights, the source of data not collected from you, and any automated processing. Much of your data is visible in CEMCS Hub, and you can download or email yourself statements, loan schedules, investment statements, dividend statements, beneficiary lists, your membership card and letters. For a complete copy, contact the DPO.

24.3 Right to rectification

You can correct your email and phone directly in CEMCS Hub. You can request corrections to your date of birth, employer and staff ID through CEMCS Hub with supporting evidence. For other corrections, contact support or the DPO. Where you dispute a financial record, CEMCS will investigate against its ledger; if the record is correct, CEMCS will note your view.

24.4 Right to erasure

You can ask CEMCS to erase your personal data where it is no longer needed, you withdraw consent and no other basis applies, you successfully object, it was processed unlawfully, or the law requires erasure. CEMCS must keep membership, financial, loan, guarantee and project records for the periods in Schedule 4, so erasure of those records is not usually possible while you are a Member or within the retention period. CEMCS will tell you what it can erase and what it must keep, and why. See also Section 26.

24.5 Right to restriction

You can ask CEMCS to stop using your data, other than storing it, while accuracy is checked, where processing is unlawful but you do not want erasure, where you need the data for a legal claim, or while an objection is considered.

24.6 Right to data portability

You can ask for the personal data you provided, and data generated by your use of CEMCS Hub that is processed under contract or consent, in a structured, commonly used, machine-readable format, and ask CEMCS to send it to another organisation where technically feasible. Statements and loan schedules are available in Excel format in CEMCS Hub. For a complete portable copy, contact the DPO.

24.7 Right to withdraw consent

Where CEMCS relies on consent, you can withdraw it at any time. This does not affect processing before withdrawal.

24.8 Right to object

You can object to processing based on legitimate interests on grounds relating to your situation. CEMCS will stop unless it has compelling legitimate grounds or needs the data for legal claims. You can object to marketing at any time, and CEMCS will stop.

24.9 Rights about automated decisions

You have the right not to be subject to a decision based solely on automated processing that significantly affects you. See Section 12.

24.10 Right to complain and to compensation

You can complain to the Commission (Section 27), and may be entitled to compensation for damage caused by a breach of the NDPA.

25. How to exercise your rights

25.1 Contact the DPO at [dpo@cemcs.com], by post, or at the CEMCS office. Tell us your name, membership number, the right you are exercising and what it concerns.

25.2 CEMCS will verify your identity before acting, usually by a code sent to your registered email or through your signed-in CEMCS Hub account, and may ask for more where the request carries higher risk.

25.3 Another person may act for you with your written authority or legal authority, such as a power of attorney or court order.

25.4 CEMCS will acknowledge your request within 2 business days and respond within 30 days. Where a request is complex, CEMCS may extend by up to 30 days and will tell you why before the first 30 days end.

25.5 Requests are free unless manifestly unfounded or excessive, in which case CEMCS may charge a reasonable fee or refuse, and will explain why.

25.6 If CEMCS refuses a request, it will give reasons and tell you about your right to complain to the Commission.

26. Deleting your CEMCS Hub account

26.1 You can ask CEMCS to delete your CEMCS Hub account and personal data in the mobile app under Settings > Delete account, at https://hub.cemcs.com/profile/close-account, or by contacting the DPO.

26.2 Because you are a cooperative Member with savings, shares and possibly loans, guarantees, investments or project subscriptions, deletion follows these steps:

1. Request. You confirm the request and may give a reason. CEMCS acknowledges it.
2. Cooling-off. You may cancel the request within 30 days.
3. Wind-down. CEMCS Internal Control contacts you within 5 business days to settle your balances, loans, guarantees, investments and project obligations under the Bye-laws. This usually takes 30 to 90 days. Your CEMCS Hub access stays available during the wind-down so you can follow it.
4. Deletion. When the wind-down is complete, CEMCS deletes or anonymises your profile, contact details, beneficiaries, linked accounts, uploaded documents, device and session records and the personal details on your transactions.
5. Records CEMCS must keep. Accounting records that the law and the Bye-laws require CEMCS to keep are retained for the periods in Schedule 4 in anonymised form where possible, and otherwise restricted from any use except legal compliance and claims.
6. Confirmation. CEMCS confirms to you what was deleted and what was kept.

26.3 Requesting deletion of your CEMCS Hub account means ending your CEMCS membership, because CEMCS Hub is the means of administering it. If you only want to stop using the mobile app, uninstall it and sign out of the portal; your membership continues.

26.4 Account closure and exit from the cooperative can also be started from Profile > Close account, under the Bye-laws.

27. Complaints

27.1 Please raise any concern with the DPO first. CEMCS will acknowledge within 2 business days and respond within 30 days.

27.2 You may complain to the Nigeria Data Protection Commission at any time:

Part 7: Other matters

28. Eligibility and minors

28.1 CEMCS Hub is for CEMCS Members and applicants, who must be at least 18 years old. CEMCS does not knowingly allow anyone under 18 to register.

28.2 Where a Member names a person under 18 as a beneficiary, a covered person on a health plan or a travel passenger, CEMCS processes that person’s data only for the purpose given, applies the protections in section 31 of the NDPA, and relies on the Member’s authority as parent or guardian.

29. Deceased Members and representatives

29.1 When CEMCS is told of a Member’s death, it freezes the CEMCS Hub account and processes the Member’s records to settle benefits to beneficiaries or the estate under the Bye-laws, on production of appropriate evidence.

29.2 Where a Member lacks capacity, CEMCS deals with a person holding lawful authority.

30. Device permissions

30.1 The mobile app asks for these permissions only when a feature needs them:

30.2 On Android, the app uses your phone’s own camera and photo picker, so it does not need a separate camera or storage permission. Fingerprint sign-in uses the Android biometric system.

30.3 The app does not ask for location, contacts, microphone, calendar, Bluetooth or tracking permission.

31. Cookies and device storage

31.1 CEMCS Hub uses cookies on the portal and secure storage on your phone to keep you signed in, protect your account and remember settings. It does not use advertising or analytics cookies. See the CEMCS Hub Cookie and Device Storage Policy.

32. Links to other services

32.1 CEMCS Hub links to or opens other services, such as life planning providers’ websites, and images on the portal’s welcome page served by Unsplash. Their privacy policies apply to them.

33. Changes to this Privacy Policy

33.1 CEMCS reviews this Privacy Policy at least yearly and when the law, CEMCS Hub or CEMCS’s processing changes.

33.2 For material changes (a new purpose, a new kind of data, a new recipient or a new transfer outside Nigeria), CEMCS will notify you in CEMCS Hub and by email at least 14 days before the change takes effect, and may ask you to acknowledge the update when you next sign in. Where consent is needed, CEMCS will ask for it.

33.3 The current version is in CEMCS Hub under Settings > Legal and at https://hub.cemcs.com/legal/privacy-policy. Earlier versions are available from the DPO.

34. Contact details

Schedule 1: Processing register

Schedule 2: Legitimate interest assessments

Schedule 3: Service providers and recipients

Schedule 4: Retention schedule