Privacy Policy

Last updated October 6, 2026

1. INTRODUCTION

This Privacy Policy explains how Nine collects, uses, discloses, and protects personal data of users ("User," "you") who access our mobile and web-based financial services platform (the "Platform"). Nine is operated by Victoria Bros. Global Limited ("Company," "we," "us," or "our"), a company duly incorporated under the Companies and Allied Matters Act 2020 with its registered address at 1A, Hughes Avenue, Alagomeji-Yaba, Lagos.

We are committed to protecting your personal data in accordance with the Nigeria Data Protection Act (NDPA) 2023 and applicable regulations.

2. DATA WE COLLECT

We collect the following categories of personal data:

  • Identity Information

    • Full name
    • Date of birth
    • Gender
    • Bank Verification Number (BVN)
    • Government-issued ID (International Passport, Driver's License, Voter's Card)

  • Contact Information

    • Phone number (verified via OTP)
    • Email address (if applicable)

  • Biometric Data, including Facial Depth Data

    • We use facial recognition for identity verification via our third-party KYC provider, Smile ID. During verification, Smile ID's SDK performs liveness detection - confirming that a real, live person (not a photo, video, or mask) is present during onboarding. The method used depends on your device's operating system:

      • On supported iOS devices: Smile ID's SDK uses Apple's TrueDepth camera API and ARKit to capture a live facial image plus facial depth and geometry data, used only to detect liveness signals (e.g., natural facial movement and depth contours).
      • On Android devices: Smile ID's SDK uses the standard device camera together with on-device machine learning (e.g., face landmark tracking and motion/spoof detection) to confirm liveness from a live facial image.

Important: Biometric data is sensitive personal data under Section 30 of the Nigeria Data Protection Act 2023. We will only collect and process your facial recognition data after obtaining your explicit, separate, and informed consent. Your biometric data is processed by Smile Identity acting as a data processor under a Data Processing Agreement with us. We do not retain raw biometric templates. Smile Identity's retention of your biometric data is governed by their own data retention policy. Your biometric data collected during verification will be deleted within 30 days of account closure.

  • Financial Information

    • Wallet addresses
    • Transaction history
    • Deposit and withdrawal records

  • Automatically Collected Data

    • Device information
    • IP address
    • Usage logs

3. HOW WE COLLECT DATA

We collect data through:

  • User registration forms
  • BVN verification systems
  • Third-party KYC providers (e.g., Smile ID), including TrueDepth/ARKit-based liveness checks on supported iOS devices
  • OTP verification via SMS or WhatsApp (e.g., Twilio, SendChamp, etc)
  • Platform usage tracking

4. PURPOSE OF PROCESSING

We process your data to:

  • Verify your identity (KYC/AML compliance), including liveness verification
  • Facilitate deposits, staking, and withdrawals
  • Prevent fraud and financial crimes
  • Comply with legal and regulatory obligations
  • Improve our services

5. LEGAL BASIS FOR PROCESSING

We rely on:

  • Consent (including explicit consent for biometric/facial depth data)
  • Contractual necessity
  • Legal obligations (AML/CFT regulations)
  • Legitimate business interests

6. DATA SHARING

We may share your data with:

  • Identity verification providers (e.g., Smile ID), including data captured via TrueDepth/ARKit for liveness detection
  • Communication providers (e.g., Twilio, SendChamp, etc)
  • Financial service providers and liquidity partners
  • Regulatory authorities when required by law

We do not sell personal data.

7. INTERNATIONAL DATA TRANSFERS

Your personal data may be transferred to, stored, and processed in countries outside Nigeria where our service providers or partners operate.

Where such transfers occur, we take appropriate steps to ensure that your personal data is afforded a level of protection consistent with applicable data protection laws. These safeguards may include entering into data transfer agreements, ensuring that recipients are subject to adequate data protection obligations, and implementing appropriate technical and organisational measures.

In particular, personal data, including facial depth data captured via TrueDepth/ARKit during identification verification, may be transferred to third-party service providers, including identity verification and communication service providers such as Smile ID and Twilio, who may process data in jurisdictions outside Nigeria.

By using our Platform, you consent to the transfer of your personal data to such jurisdictions where necessary for the provision of our services.

We ensure that all international data transfers are carried out in compliance with the requirements of the Nigeria Data Protection Act 2023 and any applicable regulatory guidelines.

8. DATA RETENTION

We retain personal data:

  • As long as your account is active
  • As required by law (e.g., AML retention periods)
  • Until deletion is requested and legally permissible

9. USER RIGHTS

You have the right to:

  • Access your data
  • Correct inaccurate data
  • Request deletion
  • Withdraw consent (including consent to biometric/facial depth data collection - note that withdrawing this consent may prevent completion of identity verification required to use the Platform)
  • Object to processing

Requests can be made via: Account Deletion Request or email: support-nine@victoriabros.com

10. DATA SECURITY

We implement industry-standard safeguards including:

  • Encryption
  • Secure APIs
  • Access controls
  • Regular audits

11. COOKIES & TRACKING

We may use cookies and analytics tools to enhance user experience.

12. CHILDREN'S PRIVACY

Our Platform is not intended for use by individuals under the age of 18. We do not knowingly collect, process, or store personal data of minors.

Where we become aware that personal data has been collected from a person under the age of 18 without valid parental or legal guardian consent, we will take steps to delete such data promptly.

If you believe that a minor has provided personal data to us, please contact us at support-nine@victoriabros.com, and we will take appropriate action in accordance with applicable laws, including the Nigeria Data Protection Act 2023

13. CHANGES TO POLICY

We may update this policy periodically. Continued use constitutes acceptance.

14. DATA BREACH NOTIFICATION

In the event of a data breach likely to result in risk to your rights, we will notify you and the relevant authority as required by law

15. CONTACT

For privacy inquiries, email: support-nine@victoriabros.com