THE ANAKIN NETWORK SERVICES LTD — Privacy Policy

Effective Date: 30 May 2026 • Last Updated: 1 October 2026 • Version: 1.2
Governing Law: Federal Republic of Nigeria • NDPA 2023 Compliant

Our Commitment to Your Privacy

The Anakin Network Services Ltd (RC: 9266503) (“Anakin”, “we”, “us”, or “our”) is committed to protecting the personal information of every person who interacts with our platform. This Privacy Policy explains what data we collect, why we collect it, how we use and protect it, and what rights you have in relation to it.

This Policy applies to all products and services within the Anakin ecosystem, including AnakinPay, Anakin Network, AnakinID, Anakin Teams, and the Anakin Credits system. It applies whether you access our services through the Anakin mobile application, website, or any other interface we operate.

This Policy is issued in compliance with the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023. By using any Anakin service, you acknowledge that you have read and understood this Policy.

1. Who Controls Your Data

The data controller responsible for your personal information is:

The Anakin Network Services Ltd (RC: 9266503)
Abuja, Nigeria
privacy@theanakin.com
theanakin.com

As data controller, we determine the purposes and means by which your personal data is processed. Where we engage third-party service providers to process data on our behalf, they do so as data processors acting under our instruction and are bound by confidentiality and data protection obligations consistent with this Policy.

2. Data We Collect

We collect personal data across three categories: data you provide directly, data generated by your use of our services, and data obtained from authorised third parties to verify your identity.

2.1 Data You Provide

Full legal name
Date of birth
Phone number and email address
Bank Verification Number (BVN) — collected solely for identity verification purposes via AnakinID
Government-issued identification document details
Residential address
Profile photograph or selfie image, where required for verification
Business information, where you register as a merchant on Anakin Network

2.2 Data Generated by Your Use of Our Services

Transaction records, including amounts, timestamps, merchant details, and Credits applied
Wallet funding history and internal ledger activity
Membership tier status and progression history
Credits balance, purchase growth activity, Portfolio Positions, and Portfolio Advance utilisation
Device information, including device type, operating system, and unique device identifiers
App usage data, including features accessed, session duration, and interaction patterns
IP address and approximate location data derived from network access

2.3 Data from Authorised Third Parties

Identity verification data returned from BVN validation services
Fraud risk signals or sanctions screening results from licensed verification providers

2.4 Google User Data

Some Anakin services let you connect your Google Account. We only receive data from Google when you choose to do this, and only the data covered by the permissions you approve on Google’s consent screen.

Sign in with Google. If you sign in with Google, we receive your name, email address, and a unique Google account identifier. We use these only to create and sign you in to your Anakin account.

Google Calendar (Anakin Teams video calls). If you connect Google Calendar in Anakin Teams, you grant us the calendar.events.owned permission (create and manage events on calendars you own). We use it only to:

create a Google Calendar event with a Google Meet link on your own calendar when you start or schedule a video call in Anakin Teams, with the participants of that conversation added as attendees;
read or update that same event when you invite another person to a call you are hosting.

We do not read, list, copy, or analyse any other events on your calendar. When you connect, we store your Google email address and the access and refresh tokens Google issues to us. The tokens are encrypted at rest and never sent to the Anakin app or to any other party.

What we don’t do with Google user data. We do not sell it, use it for advertising, use it to build user profiles, or use it to develop, improve, or train generalised artificial intelligence or machine learning models. We do not transfer it to anyone except where necessary to provide the features described above, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you. No Anakin staff read your Google data unless you ask us to for support and give your consent, it is needed for security purposes, or the law requires it.

Limited Use. Anakin’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and deletion. You can disconnect Google Calendar at any time in Anakin Teams settings, or remove Anakin’s access from your Google Account at myaccount.google.com/permissions. When you disconnect in Anakin Teams, or when your Anakin account is deleted, we revoke our access with Google and permanently delete the stored tokens. Calendar events already created stay on your Google Calendar, where you control them.

We do not collect sensitive personal data beyond what is strictly necessary for identity verification and regulatory compliance. We do not collect biometric data in the form of fingerprints or facial geometry; any selfie images collected are used for liveness verification during onboarding and are not stored as biometric templates.

3. Why We Collect Your Data

We process your personal data only where we have a lawful basis to do so under the NDPR and NDPA. The purposes for which we process data, and the corresponding lawful basis for each, are set out below.

3.1 To Provide Our Services — Contractual Necessity

Creating and managing your Anakin account
Processing wallet funding, internal ledger transactions, and Credits redemptions
Administering Portfolio Advance, including limit calculation and settlement
Enabling merchants on Anakin Network to receive settlement
Communicating with you about your account, transactions, and service updates

3.2 To Verify Your Identity — Legal Obligation

Conducting Know Your Customer (KYC) checks as required under Nigerian financial regulations
Validating your BVN through authorised channels
Complying with anti-money laundering (AML) and counter-terrorism financing (CTF) obligations

3.3 To Protect Our Services — Legitimate Interest

Detecting, preventing, and investigating fraud, abuse, and unauthorised access
Monitoring platform security and system integrity
Enforcing our Terms of Service and product-specific terms

3.4 To Improve Our Services — Legitimate Interest

Analysing aggregated, anonymised usage patterns to improve product features and performance
Understanding how users interact with the Anakin ecosystem to inform product development

Sending transactional notifications directly related to your account and activity
Sending promotional or marketing communications, where you have opted in to receive them

Where we rely on consent as our lawful basis, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

We do not sell your personal data. We do not share your data with advertising networks, data brokers, or marketing third parties. We share your personal data only in the following limited circumstances:

4.1 Technical Service Providers

We engage a small number of trusted technology vendors who provide infrastructure services essential to operating the Anakin platform. These include cloud hosting providers, SMS and OTP delivery services, and identity verification API providers. These vendors process your data solely on our instruction, are contractually bound to protect it, and may not use it for any purpose of their own.

4.2 Regulatory and Legal Disclosure

We may disclose your data to regulators, law enforcement agencies, courts, or other public authorities where we are legally required to do so, or where disclosure is necessary to comply with a binding legal obligation, court order, or regulatory directive under Nigerian law.

4.3 Fraud Prevention and Security

We may share data with fraud prevention services or financial intelligence bodies where we have reasonable grounds to suspect fraudulent, criminal, or abusive activity, and where such sharing is required or permitted by law.

4.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of The Anakin Network Services Ltd (RC: 9266503), your personal data may be transferred to the successor entity. We will notify you in advance of any such transfer and ensure the receiving party is bound by obligations at least as protective as those in this Policy.

5. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulation.

Account and transaction data is retained for a minimum of five (5) years following account closure, in accordance with Nigerian financial record-keeping requirements.
Identity verification data, including BVN validation records, is retained for the duration of your account and for five (5) years thereafter.
App usage and behavioural data used for service improvement is retained for up to two (2) years, after which it is anonymised or deleted.
Marketing preference data is retained until you withdraw your consent or close your account.

When data is no longer required, we delete or anonymise it in a manner that prevents reconstruction of the original personal information.

6. Data Security

We take the security of your personal data seriously. We implement technical and organisational measures designed to protect your data against unauthorised access, loss, alteration, or disclosure. These measures include:

Encryption of data in transit and at rest using industry-standard protocols
Access controls that limit data access to authorised personnel with a documented need
Regular security assessments and monitoring of our systems and infrastructure
Incident response procedures to detect, contain, and notify in the event of a data breach

No system is completely immune to security risks. While we take every reasonable precaution, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by the NDPA.

7. Your Rights as a Data Subject

Under the NDPR and NDPA, you have the following rights in relation to your personal data. You may exercise any of these rights by contacting us at privacy@theanakin.com.

7.1 Right of Access

You have the right to request a copy of the personal data we hold about you and information about how it is being processed.

7.2 Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.

7.3 Right to Erasure

You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing was unlawful. This right is subject to our legal obligations to retain certain data under Nigerian financial regulation.

7.4 Right to Restrict Processing

You have the right to request that we restrict the processing of your data in certain circumstances, for example while a dispute about the accuracy of your data is being resolved.

7.5 Right to Data Portability

Where processing is based on your consent or a contract with you, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.

7.6 Right to Object

You have the right to object to processing carried out on the basis of our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.

Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

7.8 Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

We will respond to all data subject requests within thirty (30) days. In complex cases, we may extend this by a further thirty (30) days with notice to you.

8. Children’s Privacy

Anakin services are designed for individuals who are 18 years of age or older. Users under the age of 18 may access the platform only with the verifiable consent of a parent or legal guardian, who accepts full responsibility for the minor’s use of the service and compliance with these Terms and this Policy.

By permitting a minor to use Anakin, the parent or guardian consents to the collection and processing of the minor’s personal data as described in this Policy. We do not knowingly permit minors to create independent accounts or access products restricted to adult users, including Credits Advance.

If we become aware that a minor has accessed the platform without parental consent, we will suspend that account and delete the associated personal data promptly. If you believe a minor is using Anakin without appropriate consent, please contact us at privacy@theanakin.com.

9. Cross-Border Data Transfers

The Anakin Network Services Ltd (RC: 9266503) is based in Nigeria and processes most of your data within Nigeria. Where we engage third-party service providers whose infrastructure is located outside Nigeria, we ensure that appropriate safeguards are in place for any transfer of personal data, in accordance with the requirements of the NDPA.

Such safeguards may include standard contractual clauses approved by the NDPC, or transfers to jurisdictions that have been determined to provide an adequate level of data protection. We will not transfer your data to a country without adequate safeguards in place.

10. Cookies and Tracking

The Anakin mobile application does not use browser cookies. We do collect certain device and usage data through the application as described in Section 2 of this Policy. This data is used solely for service delivery, security monitoring, and product improvement.

If we launch a web-based interface in the future, we will update this Policy to include a full cookies and tracking disclosure before that interface is made available.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will notify you through the app or via your registered contact details before the changes take effect.

The version number and effective date at the top of this document will always reflect the most current version. We encourage you to review this Policy periodically.

12. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact our Data Protection Officer:

Data Protection Officer
The Anakin Network Services Ltd (RC: 9266503)
Abuja, Nigeria
privacy@theanakin.com
theanakin.com

We take all privacy enquiries seriously and will respond within thirty (30) days.

Privacy Policy