Privacy Policy

Document Ref: PS-MS/DPCS/2026-V1 | Last Reviewed: August 5, 2026 | Effective Law: Nigeria Data Protection Act (NDPA) 2023

This page is maintained by MamaSave to answer common privacy questions about the MamaSave platform. It is an app-owned policy document and is not a certification or legal opinion issued by any third party.

This Privacy Policy (“Policy”) describes how MamaSave Eliozu Multipurpose Co-operative Society Limited (“MamaSave”, “the Cooperative”, “we”, “us”, or “our”) collects, uses, records, structures, stores, retrieves, discloses, and protects the personal and financial information of our members, field collection agents, and visitors (“you” or “Data Subject”). The MamaSave software platform is developed and maintained on our behalf by Pearl Systems Ltd, which processes data strictly under our instruction as a data processor.

This Policy is drafted in compliance with the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR), applicable cooperative societies legislation, and digital financial services guidelines issued by the Central Bank of Nigeria (CBN). The Cooperative acts as the Data Controller for the purposes of managing daily micro-savings, rotational contributions, community crowdfunding, member loans, and associated financial inclusion services deployed via our official web platform (mamasave.ng) and associated mobile applications.

In line with Section 24 of the NDPA 2023, we process your personal data adhering strictly to the following core tenets:

• Lawfulness, Fairness, and Transparency: Collected only with your explicit consent or via valid legal/contractual bases.
• Purpose Limitation: Processed solely for explicit, specific, and legitimate business operations under the MamaSave platform.
• Data Minimization: Limited only to the details necessary to run your membership and savings account.
• Accuracy: Maintained and kept up-to-date to ensure account integrity.
• Storage Limitation: Kept only for as long as necessary to fulfil financial regulatory requirements.
• Integrity and Confidentiality: Secured using modern technical encryption to protect against unauthorised access, leaks, or breaches.

To provide secure cooperative micro-savings and financial ledger services, we collect the following categories of personal information through MamaSave:

• Identity & Account Onboarding Data: Full Name, Date of Birth, Gender, Residential/Stall Address, Local Market Zone, Passwords, Access PINs, and Government-issued identification (NIN or Voter’s Card).
• Membership Data: Cooperative membership number, share and savings balances, next-of-kin details, and any group, circle or committee you belong to.
• Contact Data: Valid Mobile Phone Number and Email Address.
• Financial & Verification Data: Bank Verification Number (BVN), Bank Account Number, and Dedicated Virtual Account (DVA) numbers generated via our licensed partner Payment Service Providers (PSSPs) and bank partners.
• Transaction Data: Timestamps, deposit values, daily calendar grid history, missed contribution records, rotation payout positions, loan repayment records, and transaction logs generated through our platform rails.
• Technical & Device Telemetry: Device Unique Identifiers, IP addresses, and login audit trails collected to track device-to-account ratios and mitigate multi-account or bot fraud networks.

BVN verification is performed through secure, read-only API integrations with licensed Payment Service Providers (PSSPs) and bank partners. We do not store raw BVN values inside our production databases; we retain only a masked representation and a boolean verification-status flag for account integrity and regulatory audit purposes.

Under Section 25 of the NDPA 2023, we rely on the following legal grounds to process your information:

• Consent: Your explicit, unambiguous approval given when creating an account or funding a savings cycle on MamaSave.
• Performance of a Contract: Necessary to execute your membership agreement, daily savings rules, payout withdrawals, and cooperative distributions.
• Legal Obligation: Mandatory processing required to satisfy anti-money laundering (AML), combating the financing of terrorism (CFT), and KYC identity tracking laws binding our financial partners.
• Legitimate Interests: Necessary to prevent system fraud, enforce device spam caps, block security threats, and protect the financial integrity of the member community.

We use your personal records exclusively to:

• Validate your identity and prevent fraudulent account creation.
• Track daily contributions, compile market zone ledgers, and trigger automated agent daily briefing push messages and SMS alerts.
• Facilitate payouts, settle webhooks from partner banks, and clear financial processing queues.
• Administer cooperative membership records, rotation orders, loan eligibility and general meeting notices.
• Investigate security alerts, detect multi-account abuse rings via device telemetry, and enforce platform transaction limits.

We do not use your data for automated decisions that produce legal effects without human review. Loan eligibility scores generated from your savings history are always subject to review by the Cooperative’s credit committee.

Your personal information is stored securely within isolated cloud database instances featuring encryption. In accordance with Central Bank of Nigeria (CBN) anti-money laundering frameworks and financial bookkeeping laws, transactional logs and fundamental identity metadata are retained for a mandatory period of five (5) years following the formal closure of your membership account. After this statutory period, data is either expunged using secure database sanitization tools or transformed into fully anonymised numerical datasets for macro-analysis, permanently removed from active production servers.

We do not sell, rent, or lease your personal data to third parties. We share data only with authorised parties necessary to operate the Cooperative and complete your transactions:

• Licensed Banking Partners & PSSPs: Core settlement banks and payment switches processing your inbound DVAs and transfer payouts.
• Technology Provider: The developer of the MamaSave platform, acting as our data processor under a written agreement and permitted to process data only on our instruction.
• Field Collection Agents: Limited to the contribution and contact records needed to serve members in their assigned market zone.
• Regulatory Authorities: The Nigeria Data Protection Commission (NDPC), the Central Bank of Nigeria (CBN), cooperative regulators, or law enforcement agencies when compelled by an official legal order.

Field agents are critical to our last-mile financial inclusion model, and their data handling is governed by strict internal policies:

• Agents may not write down, photograph, screen-capture, or copy member records onto external devices, notebooks, or personal storage.
• All member data entry must be performed inside the sandboxed MamaSave app workspace, in the presence of the member, with the device screen visible to the member during capture.
• Collection devices are bound to agent profiles and market zones; any leakage, loss, or unauthorised sharing of member data caused by agent negligence or wilful misconduct will result in immediate deactivation, termination of engagement, and referral to national law enforcement authorities.

Member data is primarily stored on servers located in, or contractually bound to standards equivalent to, Nigeria. Where a service provider processes data outside Nigeria, we transfer it only under Section 41 of the NDPA 2023 — that is, where the destination offers an adequate level of protection or where binding contractual safeguards are in place.

MamaSave is not intended for persons under 18. We do not knowingly collect data from minors except where a parent or guardian opens a savings goal on their behalf and provides consent. If we learn that a minor’s data was submitted without such consent, we will delete it promptly, subject to statutory retention rules.

Under Part IV of the NDPA 2023, you possess the following explicit legal rights regarding your data on the platform:

• Right to Information & Access: The right to request an electronic copy of all data we hold about you.
• Right to Rectification: The right to update or correct inaccurate profile details via your agent or admin panel.
• Right to Erasure (“Right to be Forgotten”): The right to request account deletion, subject to the statutory 5-year financial retention laws.
• Right to Restrict Processing: The right to temporarily halt active data processing pending the resolution of an account dispute.
• Right to Data Portability: The right to download your account ledger records in a structured, machine-readable format.
• Right to Object: The right to object to processing based on our legitimate interests, including marketing messages.
• Right to Withdraw Consent: The right to revoke your processing permission at any time, without affecting processing already carried out.

To exercise any of these rights, please contact our designated Data Protection Officer using the details listed in Section 14. All legitimate requests will be resolved within thirty (30) days free of charge.

We deploy a defence-in-depth technical architecture to protect member data at rest, in transit, and during processing. Our controls include:

• Encryption in transit: All data moving between your device, our servers, and partner systems is protected using TLS 1.2/1.3 encryption.
• Encryption at rest: Sensitive databases and backups are encrypted using AES-256 standards.
• Credential protection: Passwords, transaction PINs, and other authentication secrets are stored using salted cryptographic hashing; plaintext credentials are never retained.
• Access controls: Role-Based Access Controls (RBAC) restrict what employees, agents, and administrators can view or modify based on their job function.
• Device and session controls: We map devices to accounts and monitor session behaviour to prevent session cloning, remote hijacking, and multi-account bot fraud.
• Network security: Server-side firewalls, intrusion detection, and secure API gateways limit exposure to external threats.

In the event of a validated security compromise or third-party data leak, we will deploy our Incident Response Playbook to contain the threat and will formally notify the Nigeria Data Protection Commission (NDPC) within 72 hours of discovery, in compliance with Section 40 of the NDPA 2023. Impacted members will be directly alerted via SMS or registered email channels immediately following containment.

Our portal uses small tracking identifiers known as cookies and device tokens to sustain encrypted login sessions, authenticate active dashboard states, and analyse navigation trends to improve app layout. You can disable cookies inside your web browser settings, though doing so may prevent certain automated screens from loading. See our Cookie Policy for detail.

If you believe your data has been mishandled, contact our Data Protection Officer first. If you are not satisfied with our response, you may lodge a complaint directly with the Nigeria Data Protection Commission (NDPC).

We reserve the right to periodically amend or update this Policy to match new NDPC administrative rules, CBN circulars, or software upgrades. The Cooperative performs regular data-mapping loops to remain compliant, auditable, and secure on a continuing basis. Whenever amendments are committed, we will revise the “Last Updated” timestamp at the top of this document and publish a prominent notice across the member and admin interfaces.

If you have questions, grievances, or wish to submit a data rectification request, please contact our internal compliance desk:

• Corporate Legal Entity: MamaSave Eliozu Multipurpose Co-operative Society Limited
• Proprietary Brand Platform: MamaSave
• Designated Data Protection Officer (DPO): The Cooperative retains a DPO to perform independent audits and file statutory Annual Compliance Returns with the NDPC on our behalf.
• Designated Data Protection Officer (DPO): Daniel Salathiel Ogolo
• Corporate Website Address: https://mamasave.ng
• Official Compliance Email Address: privacy@mamasave.ng
• Registered Physical Address: 74 G.U. Ake Road (Eliozu Road), Eliozu, Port Harcourt, Rivers State