Lifesquare Privacy and User Data Policy

1. Introduction

Lifesquare Partnering Insurtech Limited ("Lifesquare", "we", "our", "us") is committed to protecting the privacy and personal data of our customers, users, and website visitors ("you", "your"). This Privacy and User Policy ("Policy") explains how we collect, use, store, share, and protect your personal data when you use our website (getlifesquare.com), our mobile application, or any related services (collectively, the "Services").

This Policy is issued in accordance with the Nigeria Data Protection Act 2023 ("NDPA") and any subsidiary regulations, guidance notes, and directives issued by the Nigeria Data Protection Commission ("NDPC") from time to time. By accessing or using our Services, you confirm that you have read and understood this Policy.

2. Who We Are

Lifesquare Partnering Insurtech Limited is a company incorporated in Nigeria, with its registered office in Lagos, Nigeria. For any question, concern, or request relating to this Policy or the handling of your personal data, you may contact our Data Protection Officer using the details in Section 16 below.

3. Scope of This Policy

This Policy applies to personal data we collect through our website and mobile app, customer onboarding and KYC processes, policy administration, claims handling, customer support, and any other interaction you have with our Services.

4. Categories of Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

• Identity data - full name, date of birth, gender, National Identification Number (NIN), Bank Verification Number (BVN), and other government-issued identification details
• Contact data - phone number, email address, and residential address
• Financial data - bank account details, payment card information, and premium payment history
• Health data - medical history, health status, or other health-related information, where relevant to underwriting or claims; this is treated as sensitive personal data under the NDPA
• Verification documents - passport, driver's licence, utility bills, or other documents used for identity or Know-Your-Customer (KYC) verification
• Device and usage data - IP address, browser type, device identifiers, and log data
• Location data - where location services are enabled on our app
• Cookies and similar tracking data - see Section 12 below

We only collect the categories of personal data reasonably necessary for the purposes described in this Policy.

5. Children's Data

Our Services are not directed at, and are not intended for use by, individuals under the age of 18. We do not knowingly collect personal data directly from minors. Where a product or policy requires data relating to a minor (for example, a dependant under a family insurance policy), such data will only be collected and processed with the verifiable consent of the minor's parent or legal guardian, and solely for the purpose of administering the relevant policy or service.

6. How We Use Your Data

We use your personal data for the following purposes:

• To onboard you as a customer and verify your identity, including for Know-Your-Customer (KYC) and anti-money-laundering (AML) compliance
• To underwrite, issue, and administer insurance policies
• To assess and process claims
• To process premium payments and payouts
• To communicate with you about your policy, claims, or our Services
• To comply with applicable legal and regulatory obligations, including reporting to NAICOM, the NDPC, and other competent authorities
• To detect, investigate, and prevent fraud and other financial crime
• To maintain, improve, and personalise our Services
• For internal analytics, reporting, and audit purposes

7. Legal Basis for Processing

We process your personal data on one or more of the following legal bases recognised under the NDPA:

• Your consent
• Performance of a contract to which you are a party, such as your insurance policy
• Compliance with a legal or regulatory obligation to which we are subject
• Our legitimate interests, provided these do not override your fundamental rights and freedoms
• Where necessary, to protect your vital interests or those of another person

8. Sharing Your Data

We may share your personal data with the following categories of recipients, for the purpose of providing insurance and ancillary services:

• Insurance partners, including underwriters and reinsurers
• Service providers, including payment processors, cloud hosting and IT service providers, identity verification providers, and other professional advisers, who process data on our behalf under appropriate data processing arrangements
• Regulators, including the National Insurance Industry Reform Authority / NAICOM, the NDPC, and other government or law enforcement agencies, where required by law

We do not sell your personal data to third parties.

9. Cross-Border Data Transfers

Some of our service providers or partners may be located outside Nigeria, which means your personal data may be transferred outside the country. Where this occurs, we take steps intended to ensure the transfer complies with the NDPA - including verifying that the destination has an adequate level of data protection, putting in place appropriate safeguards such as standard contractual clauses, or relying on your informed consent to the transfer, as applicable.

10. Data Retention

We retain your personal data for as long as necessary to provide our Services, and for a period of 10 years thereafter, to meet legal, regulatory, accounting, and reporting obligations, and to allow us to establish, exercise, or defend legal claims. Where data is no longer required for these purposes, we take reasonable steps to securely delete or anonymise it.

11. Data Security

We seek to implement appropriate technical and organisational measures designed to protect your personal data against unauthorised access, alteration, disclosure, loss, or destruction. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee the absolute security of your data.

12. Cookies and Tracking Technologies

Our website and app use cookies and similar tracking technologies to support core functionality, remember your preferences, and gather analytics on how our Services are used. You can control or disable cookies through your browser or device settings at any time; doing so may, however, affect the functionality of certain features of our Services.

13. Your Rights

Under the NDPA, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request erasure of your data, subject to our legal, regulatory, and contractual retention requirements
• Restrict or object to certain processing of your data
• Request portability of your data, where applicable
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal
• Lodge a complaint with the Nigeria Data Protection Commission

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 16 below.

14. Data Breach Notification

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify the NDPC and, where required, notify affected individuals directly, in line with the timelines and requirements set out under the NDPA.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, our Services, or applicable law. Where changes are material, we will take reasonable steps to notify you through our website, app, or other appropriate means. Your continued use of our Services after such changes take effect constitutes acceptance of the updated Policy.

16. Contact Us

If you have any question, concern, or request relating to this Policy or your personal data, please contact:

Data Protection Officer, Lifesquare Partnering Insurtech Limited Lagos, Nigeria Email: [email protected].