1. Who we are
Yana Finance (Pennee Technologies, Inc, 651 N Broad St, Middletown, Delaware, United States) provides lending infrastructure software to lenders in Nigeria through three products: Vector, Originations and Collections.
This Privacy Policy explains how we collect, use, share and protect personal data, in line with the Nigeria Data Protection Act 2023 and related regulations.
2. Who this policy covers
- Clients and prospects: staff and representatives of lenders and businesses that use, or consider using, our Services.
- End Users: loan applicants, borrowers, guarantors and referees whose data our Clients process through our Services.
- Website visitors: people who visit our website or contact us.
3. Our role
Our role depends on whose data it is.
| Data | Our role | Who decides how it is used |
|---|---|---|
| Client staff, prospects and website visitors | Data controller | Yana Finance |
| End User (borrower) data processed for a Client | Data processor | The Client (the lender) |
| Anonymised, aggregated data | Not personal data | Yana Finance |
If you are a borrower or applicant, your lender is responsible for your data. Your lender decides what data is collected, why, and whether you receive a loan. Please read your lender's privacy notice, and send requests about your data to your lender first. We will support your lender in responding.
4. Data we process
About Clients, prospects and visitors
Name, job title, work email and phone, company details, account login and activity, billing information, support messages, and website usage data such as IP address, device and browser type, and cookies.
About End Users, on our Clients' behalf
Only the data a Client chooses to collect:
- Identity: name, date of birth, gender, photo, government-issued identification numbers and documents, and verification results.
- Contact: phone number, email address and home address.
- Employment and income: employer, job details, income and employment verification.
- Financial: bank account details, transaction history and statements the End User has authorised to be shared, and repayment mandates.
- Credit information: credit reports, existing loan obligations and repayment history.
- Application and loan data: loan requests, offers, decisions, scores, repayments, arrears and collections activity.
- Device and technical data: device identifiers, IP address and application timestamps, used for fraud prevention and security.
We do not collect End Users' phone contacts, photo galleries or social media contacts.
5. How we use data and our legal bases
| Purpose | Legal basis |
|---|---|
| Providing the Services to Clients (underwriting, originations, collections) | The Client's instructions; the Client's own lawful basis, such as contract or consent |
| Managing Client accounts, billing and support | Performance of our contract with the Client |
| Securing the Services and preventing fraud | Legitimate interests; legal obligation |
| Improving our Services and models using anonymised, aggregated data | Legitimate interests |
| Meeting legal, regulatory and tax requirements | Legal obligation |
| Marketing our Services to business contacts | Legitimate interests or consent; you can opt out at any time |
We do not sell personal data. We do not use End User data for our own marketing.
6. Automated decision-making
Vector uses automated credit scoring and decisioning to help our Clients assess loan applications. It considers factors such as identity verification, income, existing obligations, repayment history and affordability.
The final decision belongs to the lender. End Users have the right to be told that automated processing is used, to request human review of a decision, and to contest it. These requests should go to the lender, and we will support the lender in responding.
8. Transfers outside Nigeria
Some service providers, including hosting providers, may store or process data outside Nigeria. Where this happens, we rely on a lawful transfer mechanism under the Nigeria Data Protection Act 2023, such as an adequacy decision, contractual safeguards, or consent where appropriate.
9. Retention
- Client account data: for the life of the account and up to 3 months afterwards.
- End User data: for as long as the Client instructs, then deleted or returned within 30 days of the Client's contract ending, unless the law requires us to keep it.
- Records kept by law: for the period set by applicable financial, tax and anti-money laundering rules.
- Aggregated data: may be kept indefinitely, as it does not identify anyone.
10. Security
We protect personal data with measures that include encryption in transit and at rest, role-based access controls, multi-factor authentication for staff, activity logging, regular security testing, and staff confidentiality obligations.
If a personal data breach is likely to risk people's rights, we will notify affected Clients without undue delay and report it to the Nigeria Data Protection Commission within the time required by law.
11. Your rights
Under Nigerian data protection law, you may have the right to:
- be informed about how your data is used;
- access your data and receive a copy;
- correct inaccurate or incomplete data;
- have your data deleted, where there is no legal reason to keep it;
- restrict or object to processing;
- withdraw consent, where processing is based on consent;
- receive your data in a portable format;
- not be subject to a decision based solely on automated processing, and request human review; and
- complain to the Nigeria Data Protection Commission.
Borrowers and applicants should contact their lender first. Clients, prospects and visitors can contact us directly. We respond to requests within the time required by law, and may need to verify your identity first.
13. Children
Our Services are not intended for anyone under 18. We do not knowingly process children's data, and Clients must not submit it.
14. Changes to this policy
We may update this policy from time to time. We will post the updated version on our website with a new effective date, and tell Clients about material changes.
15. Contact us
For any question or request about this policy or your personal data, including contacting our Data Protection Officer, please write to us:
- Email: hello@yana.finance
- Address: Pennee Technologies, Inc, 651 N Broad St, Middletown, Delaware, United States