Effective Date: October 2, 2026
Version: 1.1
Regius Asset Management Limited ("Regius", "we", "us" or "our") respects your privacy and is committed to protecting personal data processed through the App, website and related services.
This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, how we protect it and the rights available to you.
This Policy is intended to operate in accordance with the Nigeria Data Protection Act 2023, NDPC GAID 2025 and other applicable data-protection laws and regulations.
The NDPA requires privacy information to be clear, concise, transparent, intelligible and easily accessible.
Data Controller: Regius Asset Management Limited
Registered Address: 56, Awolowo Road, Ikoyi, Lagos State
Privacy/DPO Contact: ucheike@regiusassetmanagement.com
Email: privacy@regiusassetmanagement.com
Telephone: 0201-8771787
Data Protection Officer: UCHE IKE
Where Regius qualifies as a data controller of major importance, it should maintain an appropriately designated Data Protection Officer as required under the NDPA.
Where applicable, the App may process facial or biometric verification information for identity and fraud-prevention purposes.
Such processing shall be subject to the applicable legal basis and safeguards required by law.
We may collect:
The App's security design includes monitoring login attempts, access patterns and system usage.
We process personal data for purposes including:
The App is specifically designed to support AML/transaction monitoring, compliance approvals, audit trails and regulatory reporting.
Depending on the purpose, processing may rely on:
The NDPA expressly recognises consent, contract, legal obligation, vital interests, public interest and legitimate interests as lawful bases, subject to the statutory conditions.
Where consent is required, it shall be:
Silence or inactivity shall not constitute consent, and pre-ticked consent mechanisms should not be used where affirmative consent is required.
Withdrawal of consent will not affect processing lawfully conducted before withdrawal.
You acknowledge that certain processing cannot be withdrawn where Regius is required by law or regulation to retain or process the information.
For example, requests to delete KYC, transaction or regulatory records may be refused where retention is necessary for statutory, regulatory, audit, legal or AML purposes.
The App may use automated processes to:
Where a decision is based solely on automated processing and produces legally significant or similarly significant effects, Regius shall provide appropriate safeguards required by law, including applicable rights to human intervention, expression of views and challenge.
Personal data may be disclosed to:
Where a third party processes data on behalf of Regius, appropriate contractual and technical safeguards shall be implemented.
The NDPA requires controllers engaging processors to ensure appropriate compliance and security measures, including written arrangements.
Where personal data is transferred outside Nigeria, Regius shall comply with applicable requirements concerning international transfers.
Depending on the circumstances, transfers may rely on an adequacy decision, an approved cross-border transfer instrument, or another lawful basis permitted by the NDPA/GAID.
The NDPC's current GAID framework expressly addresses adequacy decisions, approved cross-border transfer instruments and specified legal bases for international transfers.
Regius shall implement appropriate technical and organisational measures designed to protect personal data against:
Measures may include encryption, access controls, authentication, monitoring, pseudonymisation/de-identification and security testing.
Where a personal-data breach occurs, Regius shall assess the nature and risk of the breach and take appropriate containment, remediation and notification measures.
Where required by law, the NDPA requires notification to the NDPC within 72 hours of becoming aware of a qualifying breach, and high-risk breaches must be communicated to affected data subjects in accordance with the Act.
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected or as required by:
The NDPA requires storage limitation and retention for no longer than necessary for the applicable lawful purpose.
Subject to applicable legal limitations, you may have rights to:
These rights are expressly recognised under the NDPA.
Regius may send investment education, product announcements, newsletters and promotional communications where legally permitted.
Where consent is required, marketing consent shall be obtained separately from acceptance of the Terms.
You may opt out of marketing communications at any time.
The NDPA expressly gives data subjects the right to object to processing for direct marketing, including related profiling.
Privacy complaints may be submitted to:
Data Protection Officer
Regius Asset Management Limited
Email: privacy@regiusassetmanagement.com
Address: 56, Awolowo Road, Ikoyi, Lagos State
You may also lodge a complaint with the Nigeria Data Protection Commission where applicable.
We may update this Privacy Policy to reflect changes in:
Material changes shall be communicated through appropriate channels.