Aoc Loan Privacy Policy

1. Introduction

MAXSERVE SUPPORT LTD ("we," "us," or "our") operates the Aoc Loan mobile application ("Aoc Loan" or the "App"), a digital lending platform that provides short-term loan services to eligible individuals in Nigeria. We are committed to protecting your privacy and ensuring the security of your personal information.

This Privacy Policy explains in detail how we collect, use, disclose, transfer, and safeguard your information when you download, install, and use our App and the services offered through it. By installing, accessing, or using Aoc Loan, you acknowledge that you have read and understood this Privacy Policy and that you agree to be bound by its terms. If you do not agree with any part of this Privacy Policy, please do not use our App or services.

This Privacy Policy has been prepared in full compliance with:

• The Nigeria Data Protection Act 2023 ("NDPA 2023")
• The Nigeria Data Protection Regulation 2019 ("NDPR")
• Google's Privacy Policy requirements for apps distributed on Google Play Store
• Other applicable Nigerian data protection laws and regulations

We encourage you to review this Privacy Policy carefully and to contact us if you have any questions or concerns.

2. Who We Are

Aoc Loan is operated by MAXSERVE SUPPORT LTD, a company duly registered and incorporated under the laws of the Federal Republic of Nigeria.

Product Name: Aoc Loan
Company Name: MAXSERVE SUPPORT LTD
Registered Address: NO. 33, HUMANI STREET, AGEGE, LAGOS STATE, NIGERIA
Contact Email: maxserves576@gmail.com

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at the email address listed above.

3. Information We Collect

3.1 Personal Identifiers Provided by You

When you register for an Aoc Loan account and apply for a loan, you will be asked to voluntarily provide the following personal information:

• Full legal name (as it appears on your government-issued ID)
• Phone number (used for account creation, verification, and loan disbursement)
• Email address
• Date of birth (to verify eligibility and calculate age)
• Gender
• Residential address (for KYC compliance and loan-related communications)
• Bank account number and bank name (for loan disbursement and repayment)
• BVN (Bank Verification Number) — used for identity verification in compliance with CBN regulations
• Selfie/photograph — used for facial recognition-based identity verification

3.2 Device Information Collected Automatically

When you use Aoc Loan, our servers and integrated third-party SDKs automatically collect certain technical and usage information from your device, including:

• Device model and manufacturer
• Operating system version and build number
• Unique device identifiers (such as IMEI, Android ID, or device serial number)
• Google Advertising ID (GAID) / Android Advertising ID (AAID)
• IP address
• Network information, including your mobile carrier name and network type
• Screen resolution and display density
• Device language and timezone settings

3.3 Location Information (Coarse / Approximate Location)

With your explicit prior permission, we may collect your approximate (coarse) location information. This location data is used to:

• Verify the residential address you have provided during registration
• Detect and prevent fraudulent activities, including address mismatches
• Tailor our loan products and services to your geographic region
• Comply with regulatory requirements applicable to specific geographic areas

Please note: We only collect coarse (approximate) location data — not precise GPS location. We do not track your real-time or precise physical location.

3.4 SMS Data

We request access to your SMS with your explicit prior consent. This permission is used solely to:

• Automatically read and extract one-time passwords (OTPs) and verification codes sent by banks and financial institutions for identity verification and loan disbursement
• Access financial SMS messages (such as bank transaction alerts and loan-related notifications) to assess your financial behavior and creditworthiness as part of our credit-scoring process
• Detect and prevent fraudulent activities

Please note: We do not access, read, collect, or store personal non-financial SMS messages such as personal conversations, social media notifications, or promotional messages. We only access SMS content that is relevant to financial transactions and loan processing.

3.5 Advertising ID

We collect your Google Advertising ID (AAID) with your explicit consent. This identifier is used for:

• Analytics and performance measurement of our marketing campaigns
• Delivering relevant in-app notifications about loan products and promotions
• Fraud detection and prevention

You can reset your Advertising ID or opt out of interest-based advertising at any time through your device's advertising settings.

3.6 App List and App Usage Information

With your explicit prior consent, we may collect information about the list of applications installed on your device and your usage patterns within Aoc Loan. This information is used to:

• Assess your creditworthiness and financial behavior as part of our credit-scoring model
• Detect and prevent fraudulent activities, including ghosting and identity fraud
• Evaluate your device's compatibility with Aoc Loan
• Improve our credit assessment algorithms

This data is collected in a manner that does not compromise your privacy beyond what is necessary for the purposes described above.

3.7 Device Phone Number

With your explicit prior consent, Aoc Loan may access your device's phone number. This is used to:

• Pre-fill your phone number during registration for convenience
• Verify your account through SMS-based OTP
• Associate your device with your Aoc Loan account for security purposes

3.8 Camera and Photo Gallery Access

We request access to your device's camera and photo gallery with your explicit prior consent. This permission is used to:

• Capture your live selfie for facial recognition-based identity verification (KYC process)
• Upload and submit photos of identification documents (such as national ID, driver's license, or passport) as part of your KYC documentation
• Submit additional photographic evidence as required by our verification process

3.9 Contact List (Emergency Contacts / Referees)

With your explicit prior consent, Aoc Loan may access your device's contact list to:

• Retrieve contact information for referees or emergency contacts that you voluntarily provide during the loan application process
• Facilitate loan referral programs where applicable

Please note: We only access contact information that you specifically select and authorize for submission. We do not silently scan or harvest your entire contact list.

3.10 Loan and Transaction Data

We collect information about your loan applications, borrowing history, loan amounts, interest rates, repayment schedules, repayment behavior, and any defaults or disputes. This information is used to:

• Process your loan applications and disbursements
• Manage your loan account
• Build and maintain your credit history with Aoc Loan
• Make lending decisions and improve our credit assessment models

4. How We Use Your Information

4.1 To Provide Loan Services (Contractual Necessity)

• Creating and managing your Aoc Loan account
• Processing and evaluating your loan application
• Disbursing approved loan funds to your designated bank account
• Processing loan repayments
• Sending loan-related notifications and reminders (via in-app notifications, SMS, or email)

4.2 For Identity Verification and KYC Compliance (Legal Obligation)

• Verifying your identity using the personal information and documents you provide
• Conducting facial recognition checks through Dyna.Ai SDK
• Cross-checking your identity with credit bureaus and financial institutions
• Complying with CBN KYC/AML requirements

4.3 To Prevent Fraud and Manage Risk (Legitimate Interest)

• Developing and deploying fraud detection and prevention measures
• Monitoring account activity for suspicious behavior
• Using device information, location data, and app usage data to detect identity fraud, multiple account fraud, and other prohibited activities
• Building and maintaining risk scoring models

4.4 To Improve Our Services (Legitimate Interest)

• Analyzing app usage patterns and user behavior to enhance user experience
• Testing and deploying new features and product improvements
• Conducting data analytics and research to improve our credit assessment algorithms

4.5 For Marketing Communications (With Your Consent)

• Sending promotional notifications and information about new loan products
• Delivering personalized in-app messages about offers relevant to your profile

4.6 To Comply with Legal Obligations

• Maintaining records as required by applicable Nigerian laws and regulations
• Responding to lawful requests from regulatory and law enforcement authorities

5. Legal Basis for Processing

In accordance with the NDPA 2023, the legal bases for our processing of your personal data include:

• Your explicit consent — for processing activities such as SMS access, camera access, location data, contact list access, and marketing communications. You may withdraw your consent at any time.
• Performance of a contract — for processing necessary to provide our loan services to you.
• Compliance with a legal obligation — for processing required by CBN regulations, KYC/AML laws, and other applicable Nigerian laws.
• Legitimate interests — for fraud prevention, security, service improvement, and risk management, where these interests are not overridden by your rights.

6. Data Sharing and Disclosure

6.1 Third-Party SDK Service Providers

We share relevant data with our integrated third-party SDKs (described in detail in Section 7 below) to enable them to provide their respective services. Each SDK processes your data under its own privacy policy and data protection terms.

6.2 Financial Institutions and Payment Partners

We share your bank account number, BVN, and transaction data with partnering banks and payment service providers to facilitate loan disbursement and repayment collection.

6.3 Credit Bureaus and Reference Agencies

With your consent, we may share your credit-related data with licensed credit bureaus and reference agencies in Nigeria for credit reporting and anti-fraud purposes.

6.4 Legal and Regulatory Authorities

We may disclose your personal data if required to do so by applicable law, court order, regulatory directive, or governmental authority, including the Central Bank of Nigeria (CBN), the National Data Protection Commission (NDPC), and law enforcement agencies.

6.5 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our assets, your personal data may be transferred as part of that transaction. We will notify you through the App or other reasonable means of any such change.

6.6 With Your Consent

We will share your information with other third parties when you have given us explicit consent to do so.

7. Third-Party SDKs and Services

7.1 Dyna.Ai (Identity Verification SDK)

Dyna.Ai provides facial recognition and identity verification technology used during our KYC (Know Your Customer) process. When you submit a selfie for identity verification, Dyna.Ai processes your facial image data to perform liveness detection and facial matching against your submitted identification documents.

Data processed: Facial image / selfie, device information
Purpose: Identity verification and KYC compliance

7.2 Firebase SDK (Google Firebase)

Firebase is a Google-developed platform that provides Firebase Cloud Messaging (FCM) for push notifications and Firebase Analytics for usage analytics.

Data processed: Device identifiers (including Advertising ID), app usage data, crash logs, notification delivery status
Purpose: Push notifications (including loan reminders and promotional messages), app analytics, performance monitoring

7.3 AppsFlyer

AppsFlyer is a mobile analytics and attribution SDK that helps us measure the performance of our marketing campaigns and understand how users discover and use Aoc Loan.

Data processed: Device identifiers (including Advertising ID and IMEI), installation source, app usage data, in-app events
Purpose: Marketing attribution, campaign performance analytics, fraud detection

7.4 OSS (Alibaba Cloud Object Storage Service)

OSS is a cloud-based storage service used by Aoc Loan to securely store data files, including uploaded KYC documents, selfie images, and application records.

Data processed: Uploaded files and documents (such as ID images, selfies, utility bills)
Purpose: Secure cloud storage and data backup

8. Data Transmission Security

We take the security of your data seriously. All personal data transmitted between your device and our servers is encrypted using industry-standard Transport Layer Security (TLS) / Secure Sockets Layer (SSL) encryption protocols. This means that your data is protected from interception, eavesdropping, or tampering during transmission over the internet.

In addition to TLS encryption for data in transit:

• Sensitive personal data stored on our servers is encrypted at rest using AES-256 encryption
• Our cloud storage (OSS) uses server-side encryption to protect uploaded files
• We implement strict access control policies, ensuring that only authorized personnel can access your personal data, and only for legitimate purposes
• We regularly conduct security assessments and penetration testing to identify and address potential vulnerabilities

While we strive to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to maintaining appropriate organizational and technical safeguards.

9. Data Retention Periods

We retain your personal information only for as long as is necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law. The specific retention periods for different categories of data are as follows:

After the applicable retention period, your personal data will be securely deleted, anonymized, or archived in accordance with our data retention policy and applicable laws. If you request account deletion, we will delete your personal data within a reasonable timeframe, subject to any legal retention requirements.

10. Your Rights Under the NDPA 2023

10.1 Right of Access

You have the right to request access to the personal data we hold about you, and to receive a copy of that data in a structured, commonly used, and machine-readable format.

10.2 Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal data we hold about you, without undue delay.

10.3 Right to Erasure (Right to be Forgotten)

You have the right to request that we delete your personal data if:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw your consent (where consent is the sole legal basis for processing)
• You object to the processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

10.4 Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or when processing is unlawful but you do not want us to erase it.

10.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another data controller without hindrance from us.

10.6 Right to Withdraw Consent

Where our processing of your data is based on your consent, you have the right to withdraw that consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

10.7 Right to Object to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects or significantly affects you. You may request human intervention in such decisions.

10.8 Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the National Data Protection Commission (NDPC) of Nigeria.

11. Age Restriction

AOC LOAN IS NOT INTENDED FOR USE BY INDIVIDUALS UNDER THE AGE OF 18 YEARS.

In compliance with Google's Policy for Families (Google Play) and applicable Nigerian laws, Aoc Loan does not permit persons under the age of 18 to create an account, apply for a loan, or use our services. We do not knowingly collect personal information from individuals under 18 years of age.

If we become aware that we have inadvertently collected personal information from a person under 18, we will take immediate steps to delete such information from our records and systems. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at maxserves576@gmail.com.

12. International Data Transfers

Aoc Loan is operated from Nigeria, and the data we collect is primarily processed and stored on servers located in Nigeria and other countries where our third-party service providers operate. By using Aoc Loan, you acknowledge and agree that your personal data may be transferred to and processed in countries outside Nigeria.

Where we transfer personal data internationally, we ensure that appropriate safeguards are in place, such as data processing agreements incorporating standard contractual clauses approved by relevant data protection authorities, to ensure that your data is protected to the same standard required under the NDPA 2023.

13. Changes to This Privacy Policy

We reserve the right to update, modify, or revise this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other operational needs. Any material changes to this Privacy Policy will be communicated to you through:

• A notification within the Aoc Loan App
• An updated "Last Updated" date at the top of this Privacy Policy
• Posting the revised Privacy Policy on our official website or within the App

Your continued use of Aoc Loan after any such changes constitutes your acceptance of the revised Privacy Policy. We encourage you to review this Privacy Policy periodically for any updates.

14. Account Deletion

You may request the deletion of your Aoc Loan account and all associated personal data at any time by contacting us at maxserves576@gmail.com with the subject line "Account Deletion Request."

Upon receiving your request, we will:

• Verify your identity to ensure the request is legitimate
• Initiate the deletion of your personal data from our active systems within a reasonable timeframe
• Retain certain data as required by applicable laws and regulations (see Section 9 — Data Retention Periods)
• Notify you via email once the deletion is complete

Please note that deletion of your account may affect your eligibility for future loans and credit services through Aoc Loan.

15. Contact Us

If you have any questions, concerns, requests, or complaints about this Privacy Policy, our data practices, or your personal data, please do not hesitate to contact us:

Company: MAXSERVE SUPPORT LTD
Address: NO. 33, HUMANI STREET, AGEGE, LAGOS STATE, NIGERIA
Email: maxserves576@gmail.com

We are committed to resolving any concerns you may have about our data practices. If you have any questions, please do not hesitate to contact us.

By using Aoc Loan, you confirm that you have read, understood, and agree to be bound by this Privacy Policy.