Privacy Policy

For purposes of applicable data-protection law, the relevant data controller is: Buba Rumbus Tech & Investment Co. Ltd. Trading/Product Name: Kopa Xclusive CAC Registration Number: RC 7151779 Registered Office: No. 3 Kachia Road, Barnawa, Kaduna State, Nigeria. Website: www.kopaxclusive.com.ng Privacy Email: privacy@kopaxclusive.com.ng

Kopa Xclusive may work with authorised data processors, technology providers, payment providers, financial institutions, credit-reference providers, identity-verification providers and other service providers to deliver its services.

At Kopa Xclusive, service is at the heart of what we do. Our promise is: Serve… We’ve Got You Covered. This means we aim to provide our users with services that are useful, accessible, secure and responsible. It also means treating your personal information with care. We do not view your personal data simply as information. We recognise that it represents a part of your identity, financial life and interaction with our platform. Accordingly, we seek to:

• Collect information responsibly
• Explain why information is collected
• Use information for legitimate purposes
• Protect information against unauthorised access
• Give you appropriate control over your information
• Work with trusted service providers
• Respect your rights under applicable data-protection law.

This Privacy Policy applies to personal data processed through:

• The Kopa Xclusive mobile application
• www.kopaxclusive.com.ng
• Kopa Xclusive user accounts
• Merchant and vendor services
• Credit and payment services
• Airtime and data services
• Customer-support channels
• Kopa Xclusive programmes and services
• Other services operated by Kopa Xclusive that expressly refer to this Privacy Policy. By using Kopa Xclusive, you acknowledge that you have read and understood this Privacy Policy. Where a particular Kopa Xclusive service requires additional privacy information or consent, we may provide a separate privacy notice before collecting or processing the relevant information.

DATA? Personal data means information relating to an identified or identifiable individual. Depending on the services you use, this may include:

• Your name
• Telephone number
• Email address
• Identification information
• Financial information
• Transaction information
• Device information
• Location information where applicable
• Other information that can reasonably be associated with you.

We seek to collect information that is reasonably necessary for the relevant service, legal obligation, security purpose or other lawful purpose. 5.1 Registration and Profile Information We may collect:

• Full name
• Phone number
• Email address
• Date of birth
• Residential address
• State of residence
• State of origin
• Gender where required
• Nationality where required
• Employment or professional information
• NYSC-related information
• Place of primary assignment
• Other information necessary to establish and maintain your account.

Depending on the service you request, we may collect or verify:

• BVN
• NIN
• Government-issued identification
• NYSC identification information
• Identification documents
• Photograph
• Selfie or liveness information
• Verification information
• Other information required for lawful identity verification. We may use authorised third-party identity-verification providers to verify information supplied by you. We will not request information merely because it is technically available. Information should be collected only where reasonably necessary for the relevant purpose.

Where you use payment, credit, repayment or other financial services, we may process:

• Bank account information
• Payment information
• Transaction records
• Credit information
• Credit-limit information
• Repayment information
• Outstanding obligations
• Direct-debit mandate information
• Merchant payment information
• Payment status
• Financial-institution information
• Other information necessary to provide the relevant financial service. Kopa Xclusive does not request your banking password, ATM PIN or OTP for ordinary account operation. You should never disclose your banking password, PIN or OTP to another person claiming to represent Kopa Xclusive.

Where Kopa Xclusive provides or facilitates credit-related services, we may process information necessary to assess and manage credit risk. This may include:

• Identity information
• Financial information
• Transaction history
• Repayment history
• Credit information
• Employment information
• Income information where applicable
• Information obtained from authorised credit-reference agencies
• Information obtained from financial institutions or other lawful sources
• Fraud and risk indicators. This information may be used to:
• Assess eligibility
• Determine appropriate credit limits
• Assess affordability and repayment capacity
• Manage credit exposure
• Monitor repayment
• Prevent fraud
• Recover legitimate outstanding obligations
• Comply with legal and regulatory requirements. Where required by law, you will be informed where automated decision-making or profiling is used and of the relevant rights available to you.

When you conduct a transaction through Kopa Xclusive, we may process:

• Transaction amount
• Date and time
• Merchant/vendor information
• Transaction reference
• Payment status
• Service purchased
• Repayment information
• Relevant account information. This information helps us provide services, maintain accurate records, prevent fraud and resolve disputes.

When you use our website or mobile application, we may collect technical information such as:

• Device type
• Operating system
• Application version
• IP address
• Browser information
• Network information
• Device identifiers where lawfully necessary
• Crash and diagnostic information
• Login information
• Security logs. We do not use device information for purposes unrelated to the operation, security or improvement of our services unless separately disclosed and permitted by law.

Kopa Xclusive may request access to location information only where it is necessary for a specific service and permitted by law. If a feature requires location information, we will provide an appropriate permission request or notice. You may control location permissions through your device settings, subject to the effect that disabling the permission may have on particular services.

Certain features may require access to your camera, photographs or documents, including:

• Identity verification
• Uploading identification documents
• Profile verification
• Submitting supporting documents
• Other user-requested functionality. We will not access your camera, photos or files for unrelated purposes. Where your operating system provides a permission mechanism, we will request the relevant permission before accessing protected resources.

Kopa Xclusive will not request access to your contacts, SMS, call logs or other sensitive device information unless the relevant permission is necessary for a specific lawful functionality and the applicable platform permits that use. Where a permission is not necessary for a core feature, we will not request it merely to collect additional information.

We may collect personal data: 1. Directly from you; 2. When you create or use your account; 3. When you complete a transaction; 4. When you communicate with customer support; 5. From merchants or vendors involved in your transaction; 6. From authorised payment providers; 7. From financial institutions where lawfully permitted; 8. From authorised identity-verification providers; 9. From authorised credit-reference agencies; 10. From fraud-prevention and security providers; 11. From NYSC or other institutions where legally permitted and necessary; 12. Automatically from your device or browser where appropriate; 13. From other lawful sources.

We may process your personal data for the following purposes. Providing Services

To:

• Create and manage your account
• Process transactions
• Provide payment services
• Facilitate credit services
• Process repayments
• Provide airtime and data services
• Connect you with participating merchants
• Provide customer support
• Deliver other Kopa Xclusive services. Identity Verification To:
• Verify your identity
• Conduct KYC procedures
• Prevent identity theft
• Protect accounts
• Meet legal and regulatory requirements. Credit Assessment To:
• Assess credit applications
• Determine eligibility
• Establish credit limits
• Assess repayment capacity
• Monitor credit exposure
• Manage repayment. Fraud and Security To:
• Detect suspicious activity
• Prevent fraudulent transactions
• Protect users
• Protect merchants
• Detect account takeover
• Investigate security incidents
• Maintain platform security.

Legal and Regulatory Compliance To comply with applicable:

• Nigerian laws
• Data-protection requirements
• Financial regulations
• KYC requirements
• Anti-money-laundering requirements
• Court orders
• Regulatory requests
• Law-enforcement requirements. Service Improvement To:
• Understand platform usage
• Diagnose technical problems
• Improve performance
• Develop features
• Improve user experience
• Monitor reliability and security.

Depending on the circumstances, Kopa Xclusive may rely on one or more lawful bases recognised under applicable data-protection law, including:

• Consent
• Performance of a contract
• Steps taken at your request before entering into a contract
• Compliance with a legal obligation
• Protection of vital interests
• Legitimate interests where applicable
• Public interest where applicable
• Establishment, exercise or defence of legal claims
• Other lawful grounds recognised by applicable law. Where processing relies on consent, consent will be requested in an appropriate and understandable manner.

You may withdraw consent where the processing is based on consent, subject to applicable legal limitations. Withdrawal of consent does not affect processing that was lawful before withdrawal.

Kopa Xclusive seeks to collect information that is adequate, relevant and reasonably necessary for the purpose for which it is processed. We do not intend to collect personal information simply because it is available or potentially useful. Where information is optional, we will seek to distinguish it from information that is necessary for a particular service.

We may disclose personal data to third parties where necessary and lawful. These may include: Payment Providers For payment processing, settlements, direct debit and related services. Financial Institutions Where necessary to provide or facilitate financial services. Credit-Reference Agencies For credit assessment, credit reporting and responsible credit management where legally permitted. Identity-Verification Providers For KYC and identity verification.

Merchants and Vendors Where necessary to complete or support a transaction or service requested by you. Technology Providers Including providers of:

• Cloud infrastructure
• Hosting
• Database services
• Security
• Analytics
• Communications
• Customer support
• Software infrastructure. Professional Advisers Such as lawyers, accountants, auditors and other professional advisers. Regulators and Government Authorities Where required or permitted by law. Fraud-Prevention Providers Where necessary to detect, prevent or investigate fraud or financial crime. We do not sell personal or sensitive user data for monetary consideration.

Some service providers process personal data on our behalf. Where we appoint a third-party processor, we seek to require appropriate confidentiality, security and data-protection obligations. Third-party providers may only process personal data for authorised purposes and in accordance with applicable contractual and legal requirements.

Some of our technology or service providers may operate outside Nigeria. Where personal data is transferred across borders, Kopa Xclusive will take steps required by applicable Nigerian data-protection law to ensure that the transfer is lawful and that appropriate safeguards are implemented.

We use reasonable technical and organisational safeguards designed to protect personal data against:

• Unauthorised access
• Unauthorised disclosure
• Loss
• Theft
• Alteration
• Destruction
• Misuse
• Unlawful processing. Security measures may include:
• Encryption
• Secure communications
• Access controls
• Authentication
• Monitoring
• Logging
• Secure infrastructure
• Role-based access
• Security testing
• Incident-response procedures. No online system can guarantee absolute security. You are responsible for protecting your account credentials and authentication information.

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected or as required by applicable law. The retention period may depend on:

• The nature of the information
• The purpose for which it was collected
• Whether you maintain an active account
• Financial and transaction-record requirements
• Legal and regulatory requirements
• Fraud-prevention requirements
• Dispute-resolution requirements. Where personal data is no longer required, we will take appropriate steps to delete, anonymise or securely dispose of it, subject to lawful retention requirements.

You may request deletion of your Kopa Xclusive account and personal data through the account-deletion mechanism provided in the application or through our website/contact channel. Account deletion does not necessarily mean immediate deletion of every record. Certain information may need to be retained where required by law, regulation, financial-record obligations, fraud-prevention requirements, dispute resolution, legal claims or other lawful obligations. Where information is not required to be retained, it will be deleted or anonymised in accordance with our data-retention procedures.

Subject to applicable law, you may have the right to: 1. Be informed about how your personal data is processed; 2. Request access to your personal data;

1. Request correction of inaccurate or incomplete information; 4. Object to certain processing; 5. Request restriction of processing; 6. Request deletion or erasure where applicable; 7. Request portability of your data where applicable; 8. Withdraw consent where processing is based on consent; 9. Object to certain automated decision-making; 10. Request human intervention where applicable; 11. Lodge a complaint with the Nigeria Data Protection Commission.

To exercise your rights, contact: Privacy Team Kopa Xclusive Buba Rumbus Tech & Investment Co. Ltd. Email: privacy@kopaxclusive.com.ng Website: www.kopaxclusive.com.ng We may request reasonable information to verify your identity before processing a request involving your personal data. This is necessary to prevent unauthorised persons from obtaining or changing personal information.

Certain Kopa Xclusive services may use automated systems to assist with:

• Identity verification
• Fraud detection
• Transaction monitoring
• Risk assessment
• Credit assessment
• Account security. Where automated decision-making has a legal or similarly significant effect on you, applicable law may provide rights to information, objection, human intervention or challenge. Where applicable, we will provide information about the nature and significance of such processing.

Where permitted by applicable law, Kopa Xclusive may send promotional communications about:

• Products
• Services
• Offers
• Programmes
• Events
• Educational content. You may opt out of marketing communications. However, you may continue to receive essential service communications, including:
• Transaction notifications
• Security alerts
• Repayment notifications
• Account notices
• Legal or regulatory notices.

Our website may use cookies and similar technologies for purposes such as:

• Website functionality
• Security
• Session management
• Preferences
• Analytics
• Performance monitoring. Where required, we will provide appropriate cookie controls and consent mechanisms.

Kopa Xclusive services are not intended for children below the minimum age legally permitted to use the relevant service. We do not knowingly collect children's personal data in violation of applicable law. If we become aware that personal data has been collected from a child unlawfully, we will take appropriate steps to address the situation.

Kopa Xclusive may integrate with or provide links to third-party services. These third parties may have separate privacy policies. Kopa Xclusive is not responsible for privacy practices of third-party services that it does not control. You should review the relevant third party's privacy policy before providing information directly to that third party.

If Kopa Xclusive becomes aware of a personal-data breach, we will assess and respond to the incident in accordance with applicable law and our internal incident-response procedures.

Where notification to affected individuals or a regulatory authority is required, we will make the required notification in accordance with applicable legal requirements.

You are responsible for providing accurate, complete and current information. You should update your information when it changes. Providing inaccurate, fraudulent or misleading information may result in:

• Account restrictions
• Service suspension
• Credit restrictions
• Transaction cancellation
• Account termination
• Reporting to appropriate authorities where legally required.

Where you voluntarily authorise a direct-debit or recurring-payment mandate, Kopa Xclusive and/or its authorised payment partners may process information required to establish, manage and execute the mandate. You will be provided with relevant information and required authorisation before a mandate is established. Payment processing may depend on third-party financial institutions and payment providers.

Where you have a valid outstanding obligation to Kopa Xclusive or a relevant financial partner, we may process and use information necessary to:

• Notify you of outstanding obligations
• Process authorised repayments
• Manage payment mandates
• Communicate with you regarding repayment
• Maintain accurate financial records
• Take lawful recovery measures
• Meet regulatory requirements. We will handle repayment and collection activities in accordance with applicable law and applicable contractual terms.

If Kopa Xclusive or its relevant business assets are involved in a merger, acquisition, investment, restructuring, financing, sale or similar corporate transaction, personal data may be transferred as part of the transaction where legally permitted. Appropriate privacy protections will continue to apply.

We may update this Privacy Policy from time to time. Changes may occur because of:

• New services
• Changes to our technology
• Changes to applicable laws
• Regulatory requirements
• Changes to our data-processing practices. Where material changes occur, we may notify users through the application, website, email or another appropriate channel. The latest version will always display the applicable Last Updated date.

If you believe Kopa Xclusive has processed your personal data improperly, we encourage you to contact us first. We will review reasonable complaints and take appropriate steps to address them. You may also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

This Privacy Policy is governed by applicable laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act 2023 and other applicable data-protection requirements. Where mandatory privacy laws of another jurisdiction apply to a particular user or transaction, Kopa Xclusive will take appropriate steps to comply with those requirements where applicable.

Powered by: Buba Rumbus Tech & Investment Co. Ltd. CAC Registration Number: RC 7151779 Registered Office: No. 3 Kachia Road, Barnawa, Kaduna State, Nigeria Website: www.kopaxclusive.com.ng

Privacy Email: privacy@kopaxclusive.com.ng Effective Date: 2 October 2026 Last Updated: 2 October 2026 SERVE… WE'VE GOT YOU COVERED. At Kopa Xclusive, our commitment goes beyond providing a platform. We are building a service ecosystem designed to support people through their journey — from NYSC to the next level. Your trust matters to us. Your information matters to us. Your security matters to us. Serve… We’ve Got You Covered. Kopa Xclusive From NYSC to Next Level. © 2026 Buba Rumbus Tech & Investment Co. Ltd. All rights reserved.