Privacy Policy

• Account details: your name, email address, phone number and password (stored only as a one-way hash).
• Business profile: business name, CAC registration number and type, sector, state, years in operation and revenue range.
• Directors: the names and Bank Verification Numbers (BVNs) of the business’s directors, provided by the business.
• Loan application: the amount, purpose, repayment period and whether collateral is available.
• Financial information and documents: the financial records and other documents you provide in support of an application, and the information in them.
• Lender information: for lender users, your name, work email, phone number, role, your organisation’s licence details and the offers you make.
• Records of use: a log of important actions (for example each time an application is opened or a status changes), the consent you gave and when, and technical data such as IP address and browser type.

We do not pull credit bureau reports, and the documents you provide are not sent to any outside service for processing.

• To provide the service you asked for (performance of a contract): creating your account, matching applications with lenders, showing offers, recording acceptance and disbursement.
• With your consent: sharing a business’s application with matched lenders. We ask for this consent separately for every application, and you can withdraw it.
• To meet legal obligations: keeping records the law requires and responding to lawful requests from regulators and authorities.
• For our legitimate interests, where these are not outweighed by your rights: keeping the platform secure, preventing fraud, keeping an audit trail, invoicing lenders, and understanding in aggregate how the platform performs.

No automated credit decisions. We do not approve or reject loans; every lending decision is made by a lender.

• Matched lenders, only after the business consents. Before an offer is accepted a lender sees the business name, sector, state, the application and its supporting information, with BVNs masked and without your contact details. A lender never sees which other lenders received the application.
• The lender whose offer the business accepts also receives the business’s contact details, CAC number and directors’ BVNs, to complete its own checks and the loan. Each lender is responsible for how it handles the data it receives.
• Service providers that help us run Credit Base, under contract and only for that purpose: our server hosting provider and our email delivery provider (which handles the email addresses and content of the messages we send you).
• Authorities and advisers, where the law requires it or to establish or defend legal claims.
• If the business behind Credit Base is sold or reorganised, data may pass to the new operator, who must honour this policy.

We do not sell personal data and do not share it for advertising.

Some of the service providers that help us run Credit Base store and process data outside Nigeria. We make such transfers in line with the NDPA, relying on appropriate safeguards with our providers and, where required, your consent. You can ask us for more information about these safeguards.

• Uploaded documents: deleted 24 months after an application closes (disbursed, cancelled or unmatched). We email you 30 days beforehand, and you can choose to keep them for a further 24 months.
• Application records and offers: kept for as long as your account is open and for up to 6 years afterwards, to meet legal and accounting requirements and deal with disputes.
• Audit log and consent records: kept for up to 6 years.
• Account details: kept until you ask us to close your account, then deleted or anonymised unless we must keep them by law.

• All connections use HTTPS.
• BVNs, CAC numbers and uploaded files are encrypted when stored. BVNs are shown masked except to the lender whose offer was accepted and to our authorised staff.
• Access is restricted by role; each lender can reach only the applications matched to it. Lender and staff logins need a one-time code as well as a password.
• Every time a lender opens an application or downloads a document, it is recorded.
• We take encrypted backups daily.

No system is perfectly secure. If a breach is likely to put your rights at risk, we will tell you and the Nigeria Data Protection Commission as the law requires.

Under the NDPA you can ask us to:

• confirm what personal data we hold about you and give you a copy;
• correct data that is inaccurate or incomplete (you can also edit your profile yourself);
• delete your data, where we have no lawful reason to keep it;
• restrict or stop a particular use of your data;
• give you your data in a portable format;
• withdraw a consent you gave. For an application, use “Withdraw consent and cancel” on the application page at any time before you accept an offer: the file is withdrawn from any lender that has not yet opened it.

To use any of these rights, email privacy@thecreditbase.com. We will reply within 30 days. If you are not satisfied, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

If a business gives us information about you as a director, it does so on the basis that it has told you and is entitled to. You have the same rights described above and can contact us directly.

We use one essential cookie to keep you logged in. We do not use advertising or tracking cookies.

We may update this policy. If a change is significant we will tell you by email or on the platform before it takes effect. The version and date are shown at the top of this page. See also our Terms of Service.

Horixong Innovations Limited, 8 Adebisi Oderinde, Berger, Lagos, Nigeria. Privacy questions: privacy@thecreditbase.com. General support: support@thecreditbase.com.