TENTE DATA PROTECTION & PRIVACY POLICY

Tente Technologies Limited (“Tente”, “we”, “our”, “us” or the “Company”) respects the privacy and security of individuals whose personal data is collected, processed, stored, transmitted or otherwise handled through our services.

Tente provides payment collection technology, merchant infrastructure, transaction-management systems, APIs, virtual account integrations, payment notifications, reconciliation systems, merchant dashboards and related financial technology services.

This Privacy Policy explains how Tente collects, uses, stores, shares, protects and otherwise processes personal data relating to users, merchants, customers, payers, business representatives, website visitors and other individuals who interact with Tente.

Tente is committed to processing personal data lawfully, fairly, transparently and securely.

This Privacy Policy is intended to operate in accordance with applicable Nigerian laws and regulations, including:

• The Nigeria Data Protection Act 2023 (“NDP Act”);
• Applicable directives, regulations, guidance and codes issued by the Nigeria Data Protection Commission (“NDPC”);
• The NDP Act General Application and Implementation Directive 2025 (“GAID”);
• Applicable provisions of the Constitution of the Federal Republic of Nigeria relating to privacy;
• Applicable Central Bank of Nigeria regulations and consumer-protection requirements where relevant to Tente's services; and
• Other applicable Nigerian laws governing electronic transactions, cybersecurity, financial services and lawful disclosure of information.

Where another applicable law provides a higher mandatory standard of protection, Tente shall comply with that requirement to the extent applicable.

This Privacy Policy applies to personal data processed through or in connection with:

This Policy also applies where Tente receives personal data from merchants, payment partners, financial institutions, identity-verification providers or other authorised third parties.

Depending on the circumstances, Tente may act as:

Where Tente processes personal data solely on behalf of another organisation, the relevant organisation may maintain its own independent privacy policy governing its direct relationship with the data subject.

Tente shall endeavour to ensure that personal data under its control is:

1. Fairness & Transparency: Processed fairly, lawfully and transparently;
2. Purpose Limitation: Collected for specified, explicit and legitimate purposes;
3. Compatibility: Not further processed in a manner incompatible with the original lawful purposes;
4. Data Minimisation: Adequate, relevant and limited to what is reasonably necessary;
5. Accuracy: Accurate and, where necessary, kept reasonably up to date;
6. Storage Limitation: Retained only for as long as reasonably necessary for the relevant lawful purpose, subject to legal and regulatory retention obligations;
7. Security & Integrity: Protected using appropriate technical and organisational security measures; and
8. Accountability: Processed in a manner demonstrating accountability and appropriate duty of care.

Depending on the service used, Tente may collect and process the following categories of information:

5.1 Identity Information

This may include:

• Full legal name, trade name, and alias;
• Date of birth and verification age records;
• Gender where legitimately required for statutory reporting;
• Photograph, facial verification image, or government ID card snapshot;
• Nationality and legal residency status;
• Identification documentation;
• National Identification Number (NIN) information where lawfully required;
• Bank Verification Number (BVN) related information where lawfully required and accessible through authorised channels;
• International Passport information, Driver's licence information, and Voter's identification credentials; and
• Other government-issued identification information.

We may collect:

• Primary and secondary telephone numbers (including SMS OTP dispatch endpoints);
• Corporate and personal email addresses;
• Residential address and utility bill proof-of-address documents;
• Registered business address;
• Correspondence address and billing endpoints; and
• Other contact information supplied by the user.

For merchants and business users, we may process:

• Company name and registered corporate trading designation;
• Business name;
• CAC registration details and certificate of incorporation;
• Company registration number (RC / BN number);
• Business address and verified physical store/office locations;
• Directors' personal information and government identity credentials;
• Beneficial ownership information (UBO documentation);
• Authorised representatives and system administrators;
• Business category, operational sector, and merchant risk profile;
• Business website URL and digital storefront endpoints;
• Business documentation, tax clearance certificates, and status reports;
• Tax-related information (TIN) where required;
• Merchant identifiers, API tokens, and public keys; and
• Information concerning the nature of the merchant's business and trade flow.

Depending on the services used, we may process:

• Settlement bank name;
• Bank account number (NUBAN);
• Bank account name;
• Virtual account details (dynamic and static virtual NUBANs);
• Payment amount and denomination currency;
• Transaction reference and session tracking tokens;
• Transaction status (initiated, pending, successful, reversed, refunded);
• Settlement information and scheduled payout batch records;
• Payment method (Bank Transfer, Card, USSD, Direct Debit);
• Payment timestamp and clearing timestamps;
• Transaction history and financial ledger logs;
• Refund information;
• Chargeback information and dispute cases;
• Payment-provider responses and switch approval codes;
• Reconciliation information; and
• Related transaction metadata.

Where card payment services are available, card transactions may be processed through authorised third-party payment processors.

Tente should avoid storing sensitive authentication information such as:

• Full CVV/CVC values;
• PINs; or
• Other sensitive authentication credentials

except where storage or processing is expressly permitted and appropriately secured under applicable payment-security standards and law.

Where practical, tokenisation and regulated payment processors should be used to minimise Tente's exposure to sensitive card information.

We may collect information concerning transactions including:

• Payer information (account name, sending bank, origin);
• Merchant information;
• Amount and applicable fee deductions;
• Currency denomination;
• Transaction reference and cryptographic hashes;
• Payment channel;
• Payment status;
• Originating institution;
• Destination information;
• Timestamps;
• Reversal information;
• Refunds;
• Settlement status (T+1);
• Dispute status;
• Fraud indicators; and
• Related payment metadata.

When users interact with Tente's systems, we may automatically collect:

• IP address and subnet classification;
• Device identifiers and hardware fingerprints;
• Browser type and version;
• Operating system and kernel version;
• Login timestamps;
• Session information;
• Application version and build number;
• Server logs and access trails;
• API request information and response latencies;
• Approximate location derived from network information where legitimately required;
• Security logs;
• Authentication events;
• Failed-login attempts;
• Webhook activity; and
• Other technical information reasonably necessary for operation and security.

We may process information relating to:

• Suspected fraud and irregular velocity spikes;
• Unusual transactions;
• Device changes and browser fingerprint shifts;
• Login patterns;
• IP-address changes and proxy/VPN detections;
• Account-access attempts;
• Sanctions or compliance screening where applicable;
• Transaction-risk indicators;
• Abuse reports;
• Compromised credentials; and
• Other security events.

Such processing may be necessary to protect Tente, our users, payment partners and the integrity of the payment system.

Where users contact Tente, we may retain:

• Support messages and ticket logs;
• Emails;
• Complaint information and dispute dossiers;
• Dispute documentation;
• Screenshots voluntarily provided;
• Transaction references;
• Telephone-support records where lawfully recorded; and
• Information reasonably required to investigate and resolve the request.

Tente may obtain personal data:

1. Directly from the individual;
2. From merchants using Tente;
3. Through Tente websites or applications;
4. Through APIs and webhooks;
5. From financial institutions;
6. From payment processors and switching gateways;
7. From identity-verification providers;
8. From authorised KYC/KYB providers;
9. From government or regulatory databases where access is lawful and authorised;
10. From fraud-prevention providers;
11. From service providers;
12. Through cookies and similar technologies;
13. From publicly available lawful sources; or
14. From another source where collection is permitted by applicable law.

Tente may process personal data for legitimate purposes including:

Tente shall rely upon an appropriate lawful basis for processing personal data. Depending on the processing activity, this may include:

16.1 Consent

Where the individual has freely provided valid consent for a specified processing purpose. Where consent is relied upon, the individual may withdraw that consent, subject to applicable law. Withdrawal of consent shall not automatically invalidate processing lawfully carried out before withdrawal.

16.2 Performance of a Contract

Processing may be necessary to: provide a requested Tente service; establish an account; process payment-related instructions; provide merchant infrastructure; perform an agreement with a user; or take steps requested before entering into a contract.

16.3 Compliance With Legal Obligations

Tente may process personal data where reasonably necessary to comply with applicable legal, regulatory, judicial or other binding obligations.

16.4 Legitimate Interests

Where permitted by applicable law, Tente may process personal data where necessary for legitimate interests that are not overridden by the rights and interests of affected individuals. Such interests may include: preventing fraud; protecting information systems; maintaining platform security; protecting users; investigating abuse; improving service reliability; defending legal claims; and preventing unauthorised transactions. Where appropriate, Tente shall assess and document reliance on legitimate interests.

16.5 Vital Interests

Processing may occur where necessary to protect the vital interests of an individual or another person, as permitted by law.

16.6 Public Interest or Legal Authority

Processing may occur where necessary for a task carried out in the public interest or pursuant to lawful authority, where applicable.

Tente recognises that certain categories of personal data may require enhanced protection.

Where Tente processes sensitive personal data, such processing shall occur only where there is an appropriate lawful basis and appropriate safeguards.

Tente shall endeavour to apply enhanced access controls and security measures appropriate to the sensitivity and risk of such information.

Tente may conduct Know Your Customer (“KYC”), Know Your Business (“KYB”), identity, business and risk verification directly or through authorised third-party providers.

Information may be compared against information held by appropriately authorised third parties where legally permitted.

Tente may refuse, suspend or restrict services where required verification cannot reasonably be completed or where continuing the relationship would violate applicable law or create unacceptable fraud or security risk.

Tente may use automated systems to detect:

• Suspicious transactions;
• Unusual account activity;
• Unauthorised login attempts;
• Abnormal transaction patterns;
• Possible account takeover;
• Compromised credentials;
• Prohibited activity; and
• Other security risks.

Automated indicators may result in additional verification, transaction review or temporary security restrictions.

Where applicable law grants an individual rights concerning a decision based solely on automated processing that produces legal or similarly significant effects, Tente shall respect those rights.

Personal data may, however, be disclosed where reasonably necessary to:

• Banks;
• Payment service providers;
• Payment processors;
• Switching companies;
• Settlement institutions;
• KYC/KYB providers;
• Identity-verification providers;
• Fraud-prevention providers;
• Cloud and hosting providers;
• Cybersecurity providers;
• Professional advisers;
• Auditors;
• Insurers where applicable;
• Telecommunications providers;
• Customer-support providers;
• Regulatory authorities;
• Law-enforcement authorities;
• Courts;
• Government agencies; or
• Other authorised service providers.

Any sharing shall be subject to applicable law and appropriate contractual, organisational or technical safeguards where required.

Some Tente services depend upon banks, payment companies and other third-party financial-service providers.

Such providers may independently process personal data in accordance with:

• Applicable law;
• Their regulatory obligations;
• Contractual arrangements; and
• Their respective privacy notices.

Tente shall not represent that it controls an independent third-party financial institution's processing where it does not legally or practically exercise such control.

Tente may engage third parties to process personal data on our behalf. Where required, Tente shall establish appropriate contractual protections requiring processors to:

• Process information only for authorised purposes;
• Maintain confidentiality;
• Implement appropriate security measures;
• Cooperate with applicable data-subject rights;
• Notify Tente of relevant security incidents;
• Appropriately manage sub-processors;
• Return or securely delete personal data when required; and
• Comply with applicable data-protection obligations.

Certain service providers used by Tente may process or store information outside Nigeria.

Where personal data is transferred internationally, Tente shall take steps required under applicable Nigerian data-protection law to ensure that the transfer has an appropriate lawful basis and safeguards. Depending upon the circumstances, this may include:

• Transfer to a jurisdiction recognised as providing adequate protection;
• An approved cross-border transfer mechanism;
• Appropriate contractual safeguards;
• Explicit consent where legally sufficient;
• Necessity for contractual performance;
• Protection of vital interests;
• Public-interest grounds;
• Establishment, exercise or defence of legal claims; or
• Another transfer mechanism permitted by applicable law.

Tente shall assess cross-border transfers as required by applicable law.

Where applicable Nigerian law, regulation, regulatory directive or contractual obligation requires particular information to be stored or processed within Nigeria, Tente shall endeavour to configure the relevant service accordingly.

Tente recognises that security is particularly important for payment infrastructure. Tente shall implement technical and organisational measures appropriate to the nature and risk of processing. Such measures may include, where appropriate:

No electronic system can be guaranteed to be completely immune from attack, failure or unauthorised access. Accordingly, Tente does not represent that any information system is absolutely secure. Tente shall nevertheless take reasonable and appropriate measures required by applicable law to protect personal data.

Users are responsible for maintaining the confidentiality of their passwords and account credentials. Users must not:

• Share passwords;
• Disclose OTPs;
• Disclose secret API keys;
• Disclose private tokens;
• Permit unauthorised account access; or
• Knowingly store credentials insecurely.

Users should notify Tente promptly where they reasonably suspect their credentials have been compromised.

Merchants using Tente APIs are responsible for appropriately securing their own implementation. Users should:

• Keep secret keys confidential;
• Implement server-side authentication;
• Validate webhook signatures;
• Use HTTPS;
• Restrict API access;
• Use IP whitelisting where available and appropriate;
• Rotate compromised credentials; and
• Follow Tente's security documentation.

Tente may disable or rotate credentials where necessary to protect the Platform or affected users.

Tente shall maintain procedures for identifying, investigating, containing and responding to personal-data breaches. Where Tente becomes aware of a personal-data breach, Tente shall:

1. Investigate the incident;
2. Take reasonable measures to contain it;
3. Assess the affected information;
4. Assess the potential consequences to affected individuals;
5. Document the incident;
6. Take reasonable remedial action; and
7. Make regulatory and data-subject notifications where required by applicable law.

Tente shall retain personal data only for as long as reasonably necessary for the purpose for which it was collected or as otherwise required by law.

Retention periods may depend upon:

• The nature of the information;
• Transaction requirements;
• Contractual obligations;
• Financial-record obligations (CBN 6-10 years);
• Regulatory requirements;
• Anti-fraud requirements;
• Dispute limitation periods;
• Legal proceedings;
• Security requirements; and
• Applicable statutory obligations.

Some information may therefore remain securely archived after account closure where retention is legally or reasonably necessary.

A request to close an account does not necessarily require immediate deletion of every record. Tente may retain information where reasonably necessary for:

• Compliance with law;
• Financial reporting;
• Transaction records;
• Fraud prevention;
• Regulatory obligations;
• Unresolved disputes;
• Chargebacks;
• Enforcement of agreements;
• Security investigations; or
• Establishment, exercise or defence of legal claims.

Where no lawful basis remains for continued retention, personal data shall be deleted, anonymised or otherwise handled in accordance with applicable law and Tente's retention procedures.

Subject to applicable law and relevant exemptions, individuals may have rights concerning their personal data, including rights to:

Tente shall establish procedures for receiving and responding to valid requests.

To protect personal information from unauthorised disclosure, Tente may reasonably verify the identity and authority of a person submitting a privacy request.

Additional information may be requested where reasonably necessary to confirm identity.

Tente shall not disclose another person's information merely because a requester claims entitlement to it.

Tente shall respond to valid data-subject requests within the period required under applicable Nigerian data-protection law.

Where additional time is legally permitted because of complexity or volume, Tente may extend the response period and inform the requester where required.

Tente's payment infrastructure is principally intended for persons and businesses legally capable of entering the applicable contractual relationship.

Tente does not knowingly solicit personal data directly from children for services that legally require adult contractual capacity.

Where processing involving a child is necessary, Tente shall apply applicable requirements concerning parental or guardian consent, age verification and heightened protection.

Tente may use cookies and similar technologies for:

• Authentication;
• Security;
• Session management;
• User preferences (e.g. Light/Dark theme);
• Fraud prevention;
• Functionality;
• Performance monitoring; and
• Analytics.

Where legally required, consent shall be obtained before non-essential cookies are activated. Users may manage certain cookies through browser settings or available consent-management tools. Blocking essential cookies may prevent certain Platform functions from operating correctly.

Where Tente sends direct marketing communications, such communications shall be conducted on an appropriate lawful basis. Where consent is required, Tente shall obtain consent.

Users may unsubscribe from applicable promotional communications.

Tente's Platform may contain links to third-party websites or services.

Unless expressly stated otherwise, Tente does not control those third-party websites and is not responsible for their independent privacy practices.

Users should review the privacy policies of third-party services before providing personal information to them.

Merchants using Tente to collect payments are independently responsible for complying with data-protection obligations applicable to their own businesses.

A merchant must not use Tente to:

• Unlawfully collect personal information;
• Process information without an appropriate lawful basis;
• Obtain information through deception;
• Conduct unlawful surveillance;
• Send unlawful marketing communications;
• Misuse payer information; or
• Violate applicable privacy rights.

Merchants shall provide appropriate privacy information to their own customers where required.

To the fullest extent permitted by applicable law, a merchant shall be responsible for claims, losses, penalties, damages and reasonable costs arising directly from the merchant's own unlawful collection, disclosure or processing of personal data through Tente.

This provision does not exclude Tente's responsibility for Tente's own breach of applicable law or other liability that cannot legally be excluded.

Nothing in this Privacy Policy excludes or limits liability where such exclusion or limitation is prohibited by applicable law.

Subject to applicable law and any applicable contractual limitation, Tente shall not be responsible for a privacy incident caused solely by:

• A user's intentional disclosure of credentials;
• An independent merchant's unlawful processing;
• An independent third party acting outside Tente's reasonable control;
• Malware installed on the user's own device;
• Compromise of the user's email or telephone account;
• User impersonation caused by information voluntarily disclosed by the user; or
• Another circumstance for which Tente is not legally responsible.

Tente remains responsible for obligations imposed upon it by applicable law.

Tente implements measures intended to protect personal data, but the User acknowledges that no internet-based service, telecommunications network, banking network, computer system or electronic-storage mechanism can reasonably be represented as completely immune from every possible attack or failure.

Nothing in this provision reduces Tente's statutory security obligations.

Tente may disclose personal data where Tente reasonably believes disclosure is required or permitted by applicable law, including:

• Pursuant to a valid court order;
• Regulatory request;
• Lawful law-enforcement request;
• Statutory obligation;
• Investigation of suspected crime;
• Fraud investigation;
• Protection of Tente's legal rights;
• Protection of users;
• Enforcement of agreements; or
• Establishment, exercise or defence of legal claims.

Tente shall endeavour to ensure that disclosures are limited to information reasonably required for the relevant lawful purpose.

If Tente undergoes:

• Merger;
• Acquisition;
• Investment;
• Restructuring;
• Reorganisation;
• Sale of assets; or
• Transfer of a business unit,

personal data may be disclosed to appropriate advisers and transaction participants where lawfully necessary and subject to appropriate confidentiality and data-protection safeguards.

Any successor responsible for personal data shall be expected to process that data consistently with applicable law.

Access to personal data within Tente should be restricted to personnel who reasonably require access to perform authorised duties. Personnel with access to sensitive information should be subject to:

• Confidentiality obligations;
• Access controls;
• Security policies;
• Appropriate training; and
• Disciplinary procedures for unauthorised access or misuse.

Tente shall endeavour to incorporate privacy and data-protection considerations into the design and operation of new systems, products and processing activities. This may include:

• Data minimisation;
• Access restriction;
• Encryption;
• Pseudonymisation where appropriate;
• Secure defaults;
• Retention controls;
• Logging;
• Segregation of information;
• Risk assessment; and
• Appropriate user controls.

Where a processing activity is likely to create a high risk to the rights and freedoms of individuals or where otherwise required under applicable law, Tente shall conduct an appropriate Data Protection Impact Assessment (“DPIA”) before or in connection with such processing.

The assessment may consider:

• Processing purposes;
• Categories of information;
• Necessity;
• Proportionality;
• Potential threats;
• Impact on individuals;
• Security controls;
• Mitigation measures; and
• Residual risk.

Tente shall maintain appropriate records relating to its processing activities where required. Such records may include:

• Categories of personal data;
• Processing purposes;
• Lawful bases;
• Recipients;
• Processors;
• International transfers;
• Retention periods;
• Security controls; and
• Other information required for accountability.

Where required by applicable law or determined appropriate considering Tente's processing activities, Tente shall designate a Data Protection Officer (“DPO”) or responsible privacy contact.

The DPO or privacy contact may be responsible for:

• Monitoring compliance;
• Advising management;
• Coordinating privacy requests;
• Assisting with DPIAs;
• Overseeing privacy training;
• Coordinating breach response;
• Liaising with the NDPC; and
• Maintaining relevant compliance documentation.

Where Tente falls within a category requiring registration with the Nigeria Data Protection Commission, Tente shall maintain the applicable registration.

Where applicable, Tente shall undertake required compliance assessments, filings, audits or Compliance Audit Returns in accordance with the NDP Act, GAID and applicable NDPC directives.

Individuals who believe Tente has improperly processed their personal data should first contact:

Tente shall investigate legitimate complaints and endeavour to resolve them appropriately.

Individuals also retain the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) where permitted by applicable law.

Tente shall cooperate with the Nigeria Data Protection Commission and other competent Nigerian regulatory or judicial authorities where legally required.

Nothing in this Policy requires Tente to disclose information where disclosure would itself violate applicable law.

Tente may update this Privacy Policy to reflect:

• Legal changes;
• Regulatory requirements;
• New services;
• Security improvements;
• Technology changes;
• Business changes; or
• Changes to processing activities.

Where a change materially affects individuals' rights or the manner in which personal data is processed, Tente shall provide appropriate notice where required.

The effective date and version should be displayed at the beginning of this Policy.

If any provision of this Privacy Policy is found to be invalid or unenforceable, the affected provision shall be interpreted, modified or severed only to the extent necessary.

The remaining provisions shall continue to apply to the fullest extent permitted by applicable law.

Nothing in this Privacy Policy is intended to waive, restrict or eliminate a data subject's rights where those rights cannot lawfully be waived.

Nothing in this Policy shall be interpreted as relieving Tente of an obligation imposed upon it by applicable law.

This Privacy Policy and Tente's processing of personal data in Nigeria shall be governed by applicable laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act 2023 and applicable subsidiary legislation, directives and regulatory requirements.

Questions, requests or complaints concerning privacy or personal data may be directed to:

By using Tente's services, users acknowledge that they have been provided with access to this Privacy Policy.

Where Tente relies specifically upon consent as the lawful basis for a particular processing activity, Tente shall obtain consent in an appropriate manner rather than relying solely upon general acceptance of this Privacy Policy.

Tente is committed to maintaining appropriate standards of confidentiality, integrity, availability and accountability in the processing of personal data.

Our objective is to operate payment infrastructure that protects: our users, their customers, transaction information, personal information and the integrity of the Tente Platform while complying with applicable Nigerian data-protection requirements.