1.0 Introduction

Sterling Bank Limited is a bank licensed in Nigeria by the Central Bank of Nigeria. We provide banking services to a wide variety of customers, including individuals, small and medium enterprises, large corporations and multinationals, governmental institutions, and non-governmental institutions. Our banking services are provided at our branches and through e-channels, including the Internet.

Customers and potential customers can access our services through these channels, including our website, www.sterling.ng.

By accessing the Bank's services through account opening at the branch and/or e-channels and/or subscribing to any of our various products, such as online banking, instant banking, and ATM card services, customers provide certain personally identifiable information.

This document details the policies of the Bank guiding the collection, use, storage, transmission, destruction, and disclosure of this personally identifiable information.

This policy document is available on our website at www.sterling.ng and in our branches. Please read it thoroughly before accessing our service. By opening an account or accessing or subscribing to any of the Bank's services, you give consent to the processing of your personal data in accordance with this policy.

Unless otherwise defined in this Privacy Policy, terms used in this Privacy Policy have the same meanings as in our Terms and Conditions on www.sterling.ng.

2.0 Privacy Policy

Sterling Bank values and respects the privacy of the people we deal with. Sterling Bank is committed to protecting your privacy and complying with the Data Protection Act (2023) of Nigeria and other applicable data privacy laws and regulations.

This Privacy Policy ("Policy") describes how we collect, hold, use and disclose your personal information, and how we maintain the quality and security of your personal information. Throughout this document, “Sterling”, “Bank”, “we”, “us”, “our” and/or “ours” refer to Sterling Bank Plc incorporated under the laws of the Federal Republic of Nigeria with its registered office at Sterling Towers, 20 Marina, Lagos. The reference to 'you' or 'your', means you, any authorised person on your account, anyone who Internal Use a Public conducts your banking services for you or other related people (including authorised signatories, partners or any authorised third party).

3.0 The information we collect about you

We collect several different types of information for various purposes to provide and improve our services to you.

We may also collect your information at events hosted or organised by or for the bank, regardless of whether such an event is a physical or virtual one. The Personal Data we collect, fall into various categories, such as:

4.0 How we use your personal Information

To the extent permissible under applicable law, we may use your information for the following legitimate actions:

• Determine your eligibility for our products and services.
• Verify your identity when you access your account information.
• Administer your accounts or other products and services that we or our partners/affiliates may provide to you.
• Respond to your requests and communicate with you.
• For understanding your financial needs
• Prevention of crime, fraud, money laundering or terrorism financing activities
• Managing our risks
• Reviewing credit or loan eligibility
• For marketing the products and services of Sterling, related entities and affiliates. We may send you marketing and promotional messages by post, email, telephone, text, secure messaging, Mobile app, or through our social media channels. You can change your mind on how you wish to receive marketing messages from us, or opt out of receiving such messages at anytime. However, we will continue to use your contact details to send you important information regarding your dealings with us.
• Process transactions, design products and profile customers
• Notify you about changes to our Services.
• Allow you to participate in interactive features of our Services when you choose to do so.
• Provide customer care and support and for internal operations, including troubleshooting, data analysis, testing, security, fraud-detection, and account management
• Process your information for audit, statistical or research purposes in order to help us understand trends in our customer behaviour and to understand our risks better and curate products and services that are suitable to our customer's needs.
• Monitor our conversation with you when we speak on the telephone for example, to check your instructions to us, to analyse, to assess and improve customer service; for training and quality assurance purposes; for verification, fraud analysis and prevention purposes
• Recover any debts that you may owe the Bank
• Carry out analysis to evaluate and improve our business.
• Monitor the usage of our Services
• Detect, prevent and address technical issues
• Prevent fraud and enhance security of your account or our service platform
• Comply with and enforcing applicable legal and regulatory requirements, relevant industry standards, contractual obligations and our policies.
• Provide you with tailored content and marketing messages such as recommending other products or services we believe you may be interested in
• For other purposes required by law or regulation

5.0 How do we share your information?

We may share the information about you and your dealings with us, to the extent permitted by law, with the following:

• Sterling Branches and subsidiaries
• Legal/Regulatory Authorities - It may be necessary by law, legal process, litigation, and/or requests from public and governmental authorities for FITC to disclose your personal information. We may also disclose information about you if we determine that for purposes of national security, law enforcement, or other issues of public importance, disclosure is necessary or appropriate.
• Professional Advisers: Auditors/Legal Advisers
• Credit Agencies.
• Correspondent Banks.
• External Auditors.
• Strategic partners/service providers - for the purpose of providing our services to you. Your Personal information will not be shared with third parties for their marketing purposes.

We may also disclose your Personal Information in good faith and belief that such action is necessary in any of the following circumstances:

• We have your consent to share the information.
• To comply with a legal obligation.
• To bring you improved service across our array of products and services, when permissible under relevant laws and regulations, by disclosing your personal information with Sterling Bank's affiliated websites and businesses.
• Credit Agencies.
• To protect and defend the rights or property of the Bank.
• To prevent or investigate possible wrongdoing in connection with our Service.
• To protect the personal safety of users of our Service or the public.
• To protect against legal liability.
• in the event of a reorganisation, merger, or sale we may transfer any and all personal information we collect to the relevant third party or
• We find that your actions on our web sites or banking applications violate any part of our Privacy Policy.

Save as related to the provision of banking services and meeting legal, regulatory, contractual, and other uses tangential or incidental to these, Sterling Bank will not share your personal data with a third party.
Where it becomes necessary to do so, adequate security measures will be taken to protect the data from access by recipients other than those for which it is intended. All data we collect will reside in Sterling's computer systems in Nigeria. Where cloud services are used, adequate governance measures that apply to such cloud services will be complied with.
Sterling Bank Plc will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy. No transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of your data and other personal information.

6.0 How we secure your Information

We have implemented appropriate organizational and technical measures to keep your Personal Information/Data confidential and secure. This includes the use of encryption, access controls and other forms of security to ensure that your data is protected. We require all parties including our staff and third-parties processing data on our behalf to comply with relevant policies and guidelines. Where you have a password which grants you access to specific areas on our site or to any of our services, you are responsible for keeping this password confidential. We request that you do not share your password or other authentication details (e.g., token generated codes) with anyone.

Although we have taken measures to secure and keep your information confidential, because the security of your data is important to us, please be aware that no method of transmission over the Internet, or method of electronic storage can guarantee 100% security at all times. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security, you are responsible for securing and maintaining the privacy of your password and Account/profile registration information and verifying that the Personal Data we maintain about you is valid, accurate and up to date. If we receive instructions using your account login information, we will consider that you have authorised the instructions and process your instruction accordingly and without incurring any liability for doing so.

7.0 How long we keep your information

We retain your Information for as long as the purpose for which the information was collected continues. The information is then securely destroyed unless its retention is required to satisfy legal, regulatory, internal compliance or accounting requirements or to protect Sterling's interest.

Please note that regulations may require Sterling to retain your personal data for a specified period even after the end of your banking relationship with us.

8.0 Information from locations outside Nigeria

If you are located outside Nigeria and choose to provide information to us, please note that the data, including Personal Data, will be processed in Nigeria. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

9.0 Accuracy and update of your Information

You are responsible for making sure the information provided to the Bank is accurate and should inform the Bank on any changes as it occurs, this will enable us to update your information with us.

Any changes will affect only future uses of your Personal Information. Subject to applicable law, which might, from time to time, oblige us to store your Personal Information for a certain period of time, we will respect your wishes to correct inaccurate information. Otherwise, we will hold your Personal Information for as long as we believe it will help us achieve our objectives as detailed in this Privacy Policy.

10.0 Your Rights

You have certain rights in relation to the personal data we collect as provided by the enacted Data Protection Act (DPA 2023) of Nigeria, these rights include:

• A right to access your personal data.
• A right to rectify/update your information in our possession.
• A right to request the erasure of personal data.
• A right to withdraw your consent to processing of personal data. This will however not affect the legality of processing carried out prior to any such withdrawal.
• Right to object to processing of personal data. This will only be applicable where there are no legal or operational reasons
• Request that your personal data be made available to you in a common electronic format and/or request that such data be sent to a third party.
• Request that your information be erased. We might continue to retain such data if there are valid legal, regulatory or operational reasons.
• Right to opt-out of marketing communications.

11.0 Privacy of minors

The Bank has a children's account called the I-Can-Save Kiddies account. This account is opened and run by a child's parent or guardian until the child reaches the age of majority. All personal information pertaining to such account is provided by the guardian. A parent or guardian should therefore read this policy thoroughly to understand how the data provided is handled.
Students of tertiary institutions with valid identification, an admission letter to a tertiary institution, and passport photographs can open the TrybeOne (Campus Hype Account). Such customer's personal data will be processed as adult's data as long as the individual is above the age of thirteen (13), as contained in the NDPR Implementation Framework 2019.
Sterling Bank information meant for public use Other than as related to the operation of the aforementioned children's account and student's account, the Bank does not enter into banking relationships with minors (persons under the age of 16). We do not knowingly collect personally identifiable information from anyone under the age of 16, except under the conditions stated above. If you are a parent or guardian and you are aware that your children have provided us with Personal data; please contact us. If we become aware that we have collected Personal Data from children without verification of parental consent, we will take steps to remove that information from our servers.

12.0 Social Media Platforms

We operate and communicate through our designated pages and accounts on some social media platforms to communicate and engage with our customers. We monitor and record comments and posts made about us on these channels so that we can improve our Services. The general public can access and read any information posted on these sites. Please note that any content you post to such 15 Internal Use aPublic social media platforms is subject to the applicable social media platform's terms of use and privacy policies. We recommend that you review the information carefully in order to better understand your rights and obligations regarding such content.

Our Services may allow you to connect and share your actions, comments, content, and information publicly or with friends. We are not responsible for maintaining the confidentiality of any information you share publicly or with friends.

Our Services may also allow you to connect with us on, share on, and use third-party websites, applications, and services. Please be mindful of your personal privacy needs and the privacy needs of others, as you choose whom to connect with and what to share and make public. We cannot control the privacy or security of information you choose to make public or share with others. We also do not control the privacy practices of third parties. Please contact those sites and services directly if you want to learn about their privacy practices.

13.0 Career Platforms

As part of our recruitment process and as an applicant, you explicitly consent to the collection, use, transfer, and storage or in any other form of your personal data contained in application forms/letters, curriculum vitae (CV)/resumes obtained from your identity document(s) or collected through interviews/other forms assessment by Sterling Bank Plc or its affiliates. This information is for the exclusive purpose of assessing and evaluating applicants suitability for employment in any current or prospective position within our organisation, verifying applicants identity and the accuracy of your details provided to us or for other related purposes. We shall, in line with our internal policies, controls and relevant Data Protection Regulations ensure that this data is not disclosed or assessed by unauthorised persons. By providing any information on Sterling's career page, you confirm that you have read the terms and privacy statement and accept it. As an applicant, you consent to Sterling Bank using the data provided in accordance with terms described above.

14.0 Third Party Websites

Our website, related websites and mobile applications may have links to or from other websites that are not operated by us. We have no control over and assume no responsibility for the security, privacy practices or content of third-party websites or services. We recommend that you always read the privacy and security statements on these websites.

15.0 Service Providers

We may employ third party companies and individuals to facilitate our Service (“Service Providers”), to provide the Service on our behalf, to perform specific Service-related roles or to assist us in analysing how our Service is used. These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose outside of the service-specific need for which the data is required.

16.0 Changes to this Policy

This Privacy Policy is effective as of the date stated above and will remain in effect except with respect to any changes in its provisions in the future, which will be in effect immediately after being posted on our website.

Based on the changing nature of privacy laws, user needs and our business, we may modify this Privacy Policy from time to time. Any change to our privacy policy will be communicated on our website, via email or by placing a notice on our Platform and this will be effective as soon as published. Accordingly, we encourage periodic reviews of this Privacy Policy for awareness of any changes that may have occurred. Your continued use of the Services after we post any modifications to the Privacy Policy on our website will constitute your acknowledgment of the modifications and your consent to abide and be bound by the modified Privacy Policy.

17.0 Contact Us

If you have any questions, comments or requests in relation to this Privacy Policy or objections, complaints or requirements in relation to the use of your personal data, please contact us by sending an email to Data Protection Officer customercare@sterling.ng or, write a letter addressed as follows: