PrivacyPolicy

The school consents to our use of student’s personal information by signing the Data Processing Agreement Form and Parent/Guardians consent to their children’s participation in the Spot the Scam initiative by signing the Parent/Guardian Consent Form.

Safeguarding your personal information is our main concern. We maintain physical, electronic and procedural safeguards that comply with applicable laws to secure your information from unauthorized access and use, accidental or unlawful alteration and destruction; and other unlawful or unauthorized forms of processing. We engage in the continuous training of our employees in the proper management of personal information. When we use other companies to provide services, we require them to protect the confidentiality of the personal information they receive.

At Access Bank Plc, we take data protection very seriously and we provide our customers with all necessary data security to protect such personal information from unauthorized access. We require any third parties who carry out any work on our behalf to comply with appropriate compliance standards to protect your information. We are pleased to announce that we comply with global best practices and requirements of Nigeria Data Protection Act 2023 and other relevant legislation.

We collect your personal information necessary to identify registered schools and students taking part in the training and debate competition. They include:

• Schools: Name, email address, phone number, physical address, and state.
• Coordinators: Name and contact phone number.
• Students (Minors): Full name, age, avatar, signed parental consent form, team assignment, and leaderboard display name.
• Independent Learners: Name, age, email address, and state.

All these require that personal data are collected voluntarily and clearly when you access the spot the scam website.

We will use your information to meet our compliance obligations and identify participating students and schools. This information will be collected electronically through the competition website and stored securely.

• you seek clarifications or information about the Competition and Spot the Scam Initiative
• you seek information from our customer service provider, information concerning complaints and disputes
• you provide information concerning your school registration e.g. CAC registration certification and evidence of ministry of education registration
• you use your login credentials to access the spot the scam website
• we conduct necessary review and grading of the submitted debate videos for the purpose of the competition.

Note that we may collect information about your computer (or mobile device), including where available your IP address, operating system, and browser type, for system administration or for our own commercial purposes. This is statistical data about our users’ browsing actions and patterns and does not identify any individual.

We shall process your information on the following basis:

• To enter and perform our contractual obligations.
• To comply with our legal obligations
• For the performance of a statutory duty
• For the legitimate interest of Access Bank Plc and our Data Subjects.
• To satisfy a public interest
• Prior consent has been obtained from data subjects and/or their Parents / Guardian for the use and processing of personal data.

Access Bank will only use your information when you have provided your consent or when the Bank is required by law to do so or when our services (contract) require same.

We use the information we collect to provide to offer an enriched and enhanced user experience.

We make appropriate use of your data to manage the participation of schools and students in the Spot the Scam Initiative.

We may send you general announcements or important news about you’re the progress of your school and students in the competition and learning initiative.

Towards enhancing our service delivery, we may share data with our technical support and other service providers, partners, associates, and subsidiaries in the group. However, where applicable, we execute compliant data-sharing agreements or data-processing agreements to provide an extra layer of protection for personal information shared in the process.

The right to be informed To emphasize the need for transparency over the usage of personal data, we ensure fair processing and adequate provision of information typically through this privacy policy.

The right of access Individuals have the right to access information the Bank holds, access their personal data and other supplementary information and obtain information about how we process it.

The right to restrict processing Individuals have a right to ‘block’ or withdraw their consent to our processing of your information, which you can do at any time. When processing is restricted, we are permitted to store personal data, but not further process it.

The right to rectification Individuals are entitled to have personal data rectified if it is inaccurate, outdated, or incomplete. Your personal data will not be disclosed to third parties.

The right to erasure/deletion Individuals have the right to request the deletion or removal of personal data where there is no compelling legal or regulatory requirement for its continued processing. The Bank will make sure that this right is protected.

The right to data portability Where practicable, we will ensure that personal data is moved, copied or transferred easily from one IT environment to another in a safe and secure way, without hindrance to usability.

The right to object Individuals have the right to object to our processing of their information in some circumstances.

In the event of an infringement of data protection rights, we will ensure any damage is remedied within the shortest possible time. However, you are at liberty to report to the Nigeria Data Protection Commission (the NDPC) or seek other legal remedies.

At Access Bank Plc, we are committed to promptly addressing any violations of data subjects’ rights. Upon receiving a complaint or becoming aware of a breach, we will acknowledge the issue within 72 hours. We aim to fully resolve all issues within one (1) month. In cases where more time is required due to complexity, we will inform the data subject of the extension and the reasons for it within the initial one-month period.

A cookie is a small file that is placed on your computer’s hard drive. Its functions include storing your login and session statuses, recording your user preferences, and analyzing web traffic.

Cookies enable websites and applications to store your user preferences in order to enhance your overall website experience by better understanding your preferences, likes and dislikes. They also allow websites to identify when users are logged on their site and when they return to their site, test new content and analyse web traffic with data analytics. Apart from the data that you elect to disclose and share with us, we cannot access your computer or any other information about you with cookies.

Although most browsers automatically accept cookies, you can amend your browser settings to disable cookies. This may however prevent you from fully experiencing the website as it was intended.

Personal information collected in connection with the Initiative will be securely retained for 1 year from September 21st, 2026 and processed for purposes relating to registration, administration, communication, participation, certification, and publicity (see 7.3 for details on publicity and applicable media / channels) connected with the Initiative. All personal data will be deleted after 1 year.

Access Bank will handle personal information in accordance with applicable data protection laws and its relevant privacy policies. The Bank’s Data Protection Officer will be responsible for addressing any data privacy related concerns and can be contacted at privacy@accessbankplc.com

Access Bank Plc understands and acknowledges the importance of safeguarding children’s privacy, hence, our sites are not intentionally designed for or directed at children under the age of 18. It is our policy never to knowingly collect or maintain information about anyone under the age of 18, except as part of the scope of the Spot the Scam CSR Initiative outlined in this document.

As part of our global operations, we may transfer your personal data to third-party service providers located in countries outside Nigeria for isolated cloud hosting infractructure. We are committed to protecting your privacy and ensuring that your personal data is treated securely and in accordance with applicable data protection laws. When your personal data is transferred internationally, we take appropriate measures to ensure that it remains protected, including but not limited to:

1.Adequate Safeguards: We will implement standard contractual clauses, binding corporate rules, or other mechanisms to ensure that your personal data is protected to the same standard as it would be within Nigeria.

2.Security and Confidentiality: We ensure that your personal data is securely handled during cross-border transfers through encryption, pseudonymization, and other data protection measures.

3.Compliance with Applicable Laws: We will ensure that all cross-border transfers comply with applicable data protection and privacy laws, including the Nigeria Data Protection Act (NDPA) and any relevant international frameworks, such as the EU General Data Protection Regulation (GDPR), UK GDPR etc. By engaging with our services, you acknowledge that we have legitimate interest in the transfer of your personal data to other jurisdictions as described above. If you have concerns regarding these transfers, you may contact our Data Protection Officer for more information.

We have implemented reasonable and effective security policies and procedures to protect your personal information from unauthorized access, data loss and misuse, alteration, or destruction. To the best of our ability, access to your personal information is limited to those who have a need to know and are required to always maintain the confidentiality of such information. Despite our best efforts and intentions, we acknowledge that security cannot be absolutely guaranteed against all threat actors. Hence, we also make reasonable efforts to retain personal information only for so long;

• as the data subject asks that the information be deleted
• as necessary to comply with legal, regulatory, internal business or policy requirements, or
• the information is necessary to comply with an individual’s request.

The Nigeria Data Protection Act 2023 mandates us to provide a highlight of the principles of data processing which our Bank fulfills as follows:

• We ensure our processing of personal data is lawful, fair, and transparent.
• We only collect the required and relevant personal data for our services and activities.
• We retain personal data for only as long as necessary or permitted by law.
• We ensure the personal data kept are updated and accurate.
• For as long as practicable, we enable the transfer of data from our Bank to other entities when requested.
• We only use the data collected for the purpose disclosed or contemplated.
• We remain accountable for the personal data controlled by us.

We may use automated decision-making technologies (such as state of residence), to identify schools eligible to participate in the debate based on the information you have submitted.

Where such processing has a significant effect on you (e.g. a decision that affects your legal rights or access to services), you have the right to:

• Request human intervention
• Express your point of view
• Contest the decision made

We will only carry out automated decision-making where it is:

• Necessary for entering or performing a contract with you
• Authorized by law or
• Based on your explicit consent.

If we use such systems in a way that significantly affects your rights, we will provide you with meaningful information about the logic involved, as well as the potential consequences and safeguards in place.

As part of our commitment to protecting your privacy, we provide a Data Subject Access Request (DSAR) Form. This form allows you to exercise your rights under applicable data protection laws to access your personal data that we hold.

By clicking HERE, you will be directed to the DSAR Form. Please complete the form with the required information and submit it to our privacy team: privacy@accessbankplc.com for processing.

Your privacy is important to us, and we are dedicated to handling your personal data with care and transparency.

To withdraw your consent to share your information with third parties, please click HERE. Complete the consent withdrawal form with the required information and submit it to our privacy team: privacy@accessbankplc.com for processing.