YOUR PRIVACY FIRST

At FirstBank of Nigeria Limited (FirstBank) and/or its Subsidiaries, we put you first and are thus committed to protecting and respecting your privacy. We are committed to being transparent about how we collect, process, share and manage data about you (our customers and other natural persons where applicable).

1. FIRSTBANK AND YOU

This Privacy Policy stipulates the banks approach to handling your data and your rights with regards to our collection, use, storage and sharing of your personal data which may be collected by FirstBank and/or Subsidiaries in the course of providing you with exceptional products and services, collectively referred to herein as FirstBank’s “services”, across all our delivery channels to meet your needs.

The Subsidiaries of FirstBank covered by this Policy are:

• FirstBank DRC Limited
• FirstBank Gambia Limited
• FBN Bank Ghana Limited
• FirstBank Guinea Limited
• FBN Bank Senegal Limited
• FirstBank Sierra Leone Limited
• First Pension Custodian Nigeria Limited
• First Nominees Nigeria Limited

2. YOUR PERSONAL INFORMATION

In the course of consuming services provided to you by FirstBank and/or Subsidiaries to meet your needs, through this and other channels available, we collect information you provide us via forms, phone calls, and correspondence by mail or emails, service point interfaces, and any other channels we may make available to you from time to time.

2.1 INFORMATION WE HOLD ABOUT YOU

Information we hold about you will often come from you directly (for example, when you apply for a new product or services). The personal data we collect may include but not limited to the following:

Personal Data Type	Description of Personal Data
Identity Data	Your personal details (for example, your name, date of birth, passport information or other identification information)
Contact Data	Your contact details (for example, your postal address, phone number, email address or mobile number)
Financial Data	Data about your Financial profile
Transaction Data	Details of transactions (for example, payments you make and receive)
Technical Data	Internet protocol (IP) address, login data, details of browser and operating system, time zone setting and location, browser plug-in types and versions, platforms and other technology such as device id, geolocation, IP, model and user agent on the devices used to access the Bank’s website.
Profile Data	Data that help us identify you
Job Application Data	Any personal information you provide to FirstBank Plc as part of the recruitment process.
Usage Data	Includes information about how data subject uses our website, products and services
Marketing and Communications Data	Information about data subject communications with the Bank. Preferences in receiving marketing e-mails and consents given by data subject to the Bank.
Others	CCTV/Video footage whenever you come into our premises or use our ATMs and telephone conversations via calls made through any of our contact centre lines.

2.2 WHY DO WE NEED THE DATA?

FirstBank ensures that the personal data collected and processed is necessary for the purpose of collection, and FirstBank shall not collect or process more data than is reasonably required for a particular processing activity. In addition, every processing purpose has at least one lawful basis for processing to safeguard the rights of the data subjects, as listed below:

Purpose of Processing	Lawful Basis of Processing
Account Management: Managing customer accounts, transactions, and providing banking services.	Performance of a contract: Processing personal data is necessary for the performance of a contract to which the data subject is a party (e.g., opening and maintaining a bank account).
Fraud Prevention: Detecting, preventing, and investigating fraudulent activities to protect customers and the bank. Customer Support: Addressing inquiries, resolving complaints, and providing support services to customers. Internal Reporting and Analysis: Generating reports, conducting analysis, and making strategic decisions based on aggregated and anonymized data. Business Development: Identifying market trends, developing new products or services, and improving overall business operations.	Legitimate interests: Processing personal data is necessary for the legitimate interests pursued by the bank or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
Compliance with Legal Obligations: Fulfilling legal and regulatory requirements imposed on banks, such as anti-money laundering (AML) and know your customer (KYC) regulations.	Legal obligation: Processing personal data is necessary for compliance with a legal obligation to which the bank is subject (e.g., reporting suspicious transactions to regulatory authorities).
Marketing and Promotions: Providing information about products, services, and promotional offers to customers, subject to their consent and preferences.	Consent: Processing personal data is based on the data subject's consent, which must be freely given, specific, informed, and unambiguous. Data subjects have the right to withdraw consent at any time.

We may also use information about you collected by third parties and other service partners to better serve your needs. Third party sources are not controlled by FirstBank or Subsidiaries and as such we are not liable for how they use it.

3. CONSENT

We don't ask for your personal information unless we need it to provide or improve our products and services for you. We want to be sure we have your consent to collect, use and, where necessary, share your information with our partners and suppliers that help us serve you. Whenever we introduce new services and technologies, we'll ensure you understand and agree to any new ways in which your information is handled. You will be considered to have given your consent to FirstBank and/or Subsidiaries for the processing of your personal data when:

1. You complete any form, brochure or material issued by FirstBank and/or Subsidiaries at any of our service points (mobile, online, in-branch etc.) requesting for such personal information.
2. You register, check or tick the acceptance box on any of our electronic platforms (Online or Mobile) relating to terms and conditions of any service or product offered by FirstBank and/or Subsidiaries.
3. You send a request, complaint or other communication to FirstBank and/or Subsidiaries.
4. You use any service or product offered by FirstBank and/or Subsidiaries.

4. USE OF YOUR INFORMATION

FirstBank and/or Subsidiaries will process your personal information for the following purposes:

• To offer and provide our Products and Services tailored to meet your unique needs.
• To fulfil the terms of any service contract(s) you might have with us.
• To improve your service experience with us.
• To conduct our business.
• To manage our relationship with you.
• To comply with Laws and Regulations.
• To provide information to Credit Agencies.
• To update your records.
• To develop statistics as may be required
• To comply with our Internal Policies.
• To communicate with you when necessary.

FirstBank and/or Subsidiaries will limit the collection and use of your personal information for the stated purposes.

5. COOKIES

We use cookies to optimize your user experience when you browse our website. If you register a profile with us, we will use cookies to manage the signup process and general administration and manage your browser session while you are logged in. Further details can be found in our Cookies Policy.

6. INFORMATION SHARING AND DISCLOSURE

FirstBank and/or Subsidiaries will not sell or rent your personally identifiable information to anyone. FirstBank and/or Subsidiaries may share or disclose your personal information to third parties where:

1. We have your consent to share or disclose such personal information.
2. We are required by law to share or disclose such personal information.
3. We respond to subpoenas, court orders or other legal processes.
4. We find that your actions on our electronic platforms violate any of our Policies for the purpose of investigations, reporting and enforcing any of our rights.
5. Required for audit purposes.

FirstBank and/or Subsidiaries may use and share your personal information with its affiliates and members of FBN Holdings Plc for providing services and service-related activities such as collecting subscription fees for such services, notifying or contacting you regarding any problem with, or the expiration of such services. In this regard, the Affiliates and members of FBN Holdings Plc shall process the information as provided in this Privacy Policy.

FirstBank and/or Subsidiaries may also disclose or share your personal information where it is necessary to enforce the terms and conditions of any of our Products and Services or any of our rights as well as to protect our operations and customers.

7. CROSS-BORDER DATA TRANSFER

Given the scale of our banking operations, we process data both inside and outside of Nigeria, relying on legally mandated instruments for authorized data transmission across borders where necessary. Countries where we process data may have regulations that differ from and are possibly less protective than those in Nigeria and the EU. FirstBank and/or Subsidiaries will ensure that the third-party meets the core regulatory standards prior to processing.

8. INFORMATION PROTECTION

FirstBank and its Subsidiaries will always ensure that your personal information is adequately protected. We have put in place processes and technologies to ensure that your personal information is not modified, lost, damaged or destroyed. Our people are trained to ensure that your personal information is not disclosed and safe as stated in this policy.

Where access and use of our electronic platforms requires authentication of the user, you shall be responsible for the use and safety of your authentication credential(s) including but not limited to Username, Personal Identification Number (PIN), Password, One Time Passwords (OTP) and Tokens.

FirstBank and its Subsidiaries will ensure that the personal data in our custody is secure and kept confidential as expected. We implement generally accepted technical and organizational measures to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage, including encryption where appropriate.

9. RETENTION

We will retain your personal information for such length of time as may be required by law, regulation, the internal policies of FirstBank and/or Subsidiaries. This retention period has been established to enable us to use the personal data for the necessary legitimate purposes identified, in full compliance with the legal and regulatory requirements.

10. YOUR RIGHTS UNDER THIS POLICY

According to the provision of Nigerian Data Protection Act 2023 (NDPA), data subjects have certain rights. The following rights are available to you under this Policy:

1. You may at any time request for access to your personal information held by FirstBank and/or Subsidiaries or request that your personal information be made available to a third party.
2. You may request to update your personal information with FirstBank and/or Subsidiaries at any time.
3. You may elect to withdraw your consent at any time.
4. Your right to withdraw consent extends to objecting or restricting the processing of your personal data by FirstBank and/or Subsidiaries.
5. v. You may request that your personal information be deleted. We may continue to retain such personal information as may be required for compliance with legal, regulatory or policy requirements.

11. REMEDIES

Where you have concerns relating to the processing of your personal information by FirstBank and/or Subsidiaries, or require any clarification on this policy, please notify us through or contact details provided below:

• Email: firstcontact.complaints@firstbankgroup.com or dataprotectionoffice@firstbankgroup.com
• Phone: 0700 FIRSTCONTACT (0700 34778 2668228)

We will respond to your concerns within 30 days of receiving your notice.

You also have the right to lodge a compliant directly with the supervisory authority, Nigeria Data Protection Commission (NDPC) where you suspect any misconduct or violations of the above listed rights in section.

Email: Info@ndpc.gov.ng

UPDATES TO THIS PRIVACY POLICY

We may update this policy from time to time. Where there are changes in the way we use your personal information we will notify you by posting a prominent notice on our website.