1. Who we are

ZIRA is operated by AIICO Capital Limited (RC 335978) ("we", "us"), of AIICO Plaza, 2nd Floor, Churchgate Street, Victoria Island, Lagos State, Nigeria. We are the data controller for the personal data described in this policy.

We handle personal data under the Nigeria Data Protection Act 2023 (the NDPA). Our Data Protection Officer can be reached at contact@getzira.ng, or by post at the address above.

This policy covers ZIRA. AIICO Capital Limited's general privacy policy, at aiicocapital.com/privacy-policy, covers our other services.

2. What we collect

We collect the following when you use ZIRA.

• Account details: your name, email address, phone number and date of birth.
• Identity details: your Bank Verification Number (BVN), National Identification Number (NIN), images of a photo ID, a selfie and liveness image, proof of address with a structured address, next of kin, and employment and income details.
• Bank account details, including the account you use to withdraw.
• Your answers to the investor profile questionnaire.
• Transactions and wallet activity, including transfers, bill payments, savings, investments and loans.
• Device and log data, push notification tokens and how you use the app.

Some of this comes from third parties. When you give us your BVN or NIN, identity verification providers return the matching record so we can confirm who you are.

3. Why we use it

• To open and run your account and the apps you use.
• To check your identity and screen for financial crime, and to set your limits by verification tier.
• To process payments, transfers, savings, investments and loans.
• To prevent fraud and keep the service secure.
• To meet legal and regulatory duties.
• To answer your questions and give you support.
• To send service messages by email, SMS and push notification, such as one-time codes and receipts.
• To send marketing and product updates, but only where you have agreed. The app records separate consent choices for marketing email, marketing SMS, product updates, analytics, sharing with third parties, credit bureau lookups and biometric processing. You can change them at any time.

Depending on the purpose, our legal basis is your consent, performing our contract with you, complying with the law, our legitimate interests in running a secure service, protecting someone's vital interests, or carrying out a task in the public interest.

4. Who we share it with

We share personal data only as far as each purpose needs.

• Identity verification providers, currently Prembly and Dojah, to check your BVN, NIN, ID and selfie.
• Paystack, for payments, transfers, direct debit and checkout.
• Bill payment providers, Moniepoint and VTpass, when you buy airtime, data or pay a bill.
• Termii, to deliver SMS messages.
• Google Firebase, to deliver push notifications.
• Amazon Web Services, which hosts our systems and stores documents you upload.
• AIICO's core investment system (IBS), which holds the record of your investment accounts and holdings.
• The partner bank that provides virtual account numbers for funding, currently UBA.
• Other companies in the AIICO Group, where they help provide or support your products.
• Regulators, courts and law enforcement, when the law requires it or we suspect fraud.

We do not sell, give or trade your personal data for marketing or data mining.

5. Transfers outside Nigeria

Some of our providers process data outside Nigeria. Our cloud hosting is with Amazon Web Services in London, United Kingdom, so your data is stored and processed there. Where we transfer personal data abroad, we do so as the NDPA permits and require the recipient to protect it to an adequate standard.

6. How long we keep it

We keep your data while your account is open. After that we keep what the law requires. Anti-money-laundering records are generally kept for at least five years after the relationship ends, under the Money Laundering (Prevention and Prohibition) Act 2022.

When we no longer need data, we delete it or anonymise it.

7. How we protect it

• Transfers, withdrawals and purchases require your transaction PIN.
• Data is encrypted in transit between your device and our servers.
• Access to customer data inside our systems is limited by role, and staff actions are logged.
• Verified identity details cannot be edited from the app, and your withdrawal account can be changed only by our support team.

No system is perfectly secure. Keep your password, PIN and one-time codes to yourself, and tell us at once if you suspect misuse.

If a breach is likely to put your rights at risk, we will report it to the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as the NDPA requires. Where it is likely to put your rights at high risk, we will tell you straight away, in plain language, what happened and what you can do to protect yourself.

8. Your rights

Under the NDPA you may:

• ask for access to the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to delete data, where the law allows (we must keep some records);
• ask us to restrict how we use your data while a concern is resolved;
• object to certain processing, including direct marketing;
• ask for a person to review any decision made solely by automated means that significantly affects you;
• withdraw consent you gave, without affecting what was done before;
• ask for your data in a portable format.

To use these rights, email contact@getzira.ng. We may need to confirm who you are first. If you are unhappy with our answer, you can complain to the Nigeria Data Protection Commission.

9. Cookies and similar storage

The ZIRA website uses a small session cookie that tells the site whether you are signed in, and it keeps sign-in information in your browser's storage so you stay signed in. It also stores your light or dark theme choice in your browser. We use browser storage for the active account you have selected and for short-lived steps such as sign-up.

These are needed to run the site. We do not use advertising or analytics cookies.

10. Children

ZIRA accounts are for adults. A parent or guardian can open and run a minor account on a child's behalf, and the guardian is responsible for it. We collect a minor's data only for that purpose.

11. Changes to this policy

We may update this policy. We will post the new version here with a new date, and tell you in the app or by email if the change is significant. This policy takes effect on 21 October 2026.

12. Contact us

AIICO Capital Limited, AIICO Plaza, 2nd Floor, Churchgate Street, Victoria Island, Lagos State, Nigeria.

Email: contact@getzira.ng. Phone: +234 91 6742 9986. For help with your account, see Help and support. Our Terms and conditions also apply to your use of ZIRA.