Privacy notice.
What personal information we collect, why we collect it, and how we use and protect it.
1. Introduction
This Privacy Notice tells you, in plain language, what personal information BlocMFB collects about you, why we collect it, how we use and protect it, and what choices and rights you have over it. It applies whenever you visit our website, open or use an account with us, submit an enquiry, or otherwise interact with our services.
This Privacy Notice should be read together with our Cookie Policy, which sets out in more detail how we use cookies and similar technologies on our website. Where there is any conflict between this Notice and our internal Privacy Policy, this Notice (as the document presented to you, the data subject) governs how your information is described to you.
1.1 Who are we?
We are BlocMFB, a technology-led microfinance bank that provides digital trust and banking solutions. For the purposes of applicable data protection law, BlocMFB acts as the data controller of your personal information.
You can contact us by email at Banking.blocmfb@blocmfb.com or by telephone at 07081566776.
The contact details of our Data Protection Officer are: AbdulAzeez Adesanya, email address abdulazeez.adesanya@crayfinance.com.
1.2 Why we are giving you this notice
Before, or at the point we collect your personal data, we want you to understand what will happen to it. This Notice is provided in line with the Nigeria Data Protection Act (NDPA), regulations issued by the Central Bank of Nigeria (CBN), and other applicable data protection laws.
2. What personal information we collect
2.1 When you open an account or use our platform
When you create an account or use our product, we ask you for the personal information required to set up and run your account, such as your name, email address, business name, organisation type, and identity verification details (for example your National Identification Number (NIN) and Bank Verification Number (BVN)).
We use this information to create and manage your account, verify your identity, communicate with you, meet our regulatory obligations, and keep our platform working properly and securely for you.
2.2 When you submit an enquiry via our website
When you contact us with an enquiry, we ask for your full name, telephone number, and work email address.
We use this information to respond to your enquiry and follow up on your interest. We rely on our legitimate interest in providing you with accurate information before any sale. Your enquiry record may be shared with our partners and is kept for three years after our last contact with you.
2.3 When you sign up for newsletters or request a demo
When you sign up for our newsletter or request a demo, we collect your full name, telephone number, and work email address.
This information is stored securely and used only to send you the communications you asked for. You can unsubscribe or withdraw your consent at any time.
3. Why we use your personal data
The table below sets out the main purposes for which we use your personal data, and the lawful basis we rely on under applicable data protection legislation.
| Purpose / Activity | What this means for you | Lawful basis |
|---|---|---|
| Creating and managing your account | Setting up access, authenticating you, and keeping your account in good working order | Contractual obligation: to perform our agreement with you and provide access to our services |
| Verifying your identity (e.g. NIN, BVN, address) | Confirming you are who you say you are, as required of a regulated financial institution | Legal obligation: compliance with CBN and other banking regulations |
| Responding to enquiries or support requests | Answering your questions and following up before a sale | Legitimate interest |
| Sending newsletters or marketing communications | Keeping you updated on products, services, or offers you asked about | Consent: you may withdraw this at any time |
| Sharing data with trusted partners or service providers | Allowing partners who help us deliver our services to process your data under strict agreements | Contractual obligation / Legal obligation |
4. How we share your information
We do not sell or rent your personal information.
We may share your information with trusted partners who help us deliver our services. These partners only process your data under strict Data Processing Agreements (DPAs) and Service Level Agreements (SLAs), and must comply with applicable data protection laws, including the Nigeria Data Protection Act (NDPA), and recognised security frameworks such as ISO 27001.
5. How long we keep your information
We keep your personal data only for as long as necessary for the purpose it was collected, or to meet legal, regulatory, or contractual requirements.
- Enquiry records: kept for three years after our last contact with you.
- Account and customer data: kept for up to 60 days after your contract with us ends, after which it is securely deleted or anonymised, unless a longer period is required by CBN or other applicable regulation.
6. Your rights as a data subject
We take your privacy rights seriously. Depending on the lawful basis we rely on, you may have the right to:
- Access: request a copy of the personal information we hold about you.
- Rectification: ask us to correct inaccurate or incomplete data.
- Withdraw consent: withdraw your consent at any time, where consent is our lawful basis.
- Restrict processing: ask us to limit how your data is used.
- Object to processing: challenge how we process your data.
- Erasure: ask us to delete your data, subject to our legal and regulatory retention obligations.
- Complain: lodge a complaint with the appropriate supervisory authority.
6.1 Your right to complain
If you have any concerns about how we use your information, please contact us first using the details in Section 10 below, so we can try to resolve the issue. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or other relevant supervisory authority.
7. How we protect your information
We apply security measures aligned with international standards, including ISO 27001 and ISO 27701, as well as the requirements of the Nigeria Data Protection Act (NDPA). These measures include encryption, access controls, regular audits, and employee security training.
8. Cookies
We use cookies and similar technologies on our website to make it work properly, remember your preferences, and improve your experience. Full details, including the types of cookies we use and how you can manage them, are set out in our Cookie Policy and in the cookie banner displayed on our website.
9. Updates to this notice
We review and update this Notice from time to time. If we intend to use your personal data in a new way, we will notify you and obtain your consent where this is required by law.
10. Contact us
For questions, concerns, or requests regarding this Privacy Notice, or to exercise any of your data protection rights, please contact us at: Banking.blocmfb@blocmfb.com
Data Protection Officer: AbdulAzeez Adesanya, abdulazeez.adesanya@crayfinance.com
NDPC Contact: ndpc.gov.ng
Last updated: July 2026. This notice is governed by the laws of the Federal Republic of Nigeria.
