Privacy notice.

1. Who this notice covers

OPIFER Limited provides conversational banking infrastructure to banks. When a bank offers OPIFER to its customers, that bank ordinarily decides why customer data is processed and acts as the data controller. OPIFER ordinarily processes that data for the bank and under its instructions. The bank's own privacy notice also applies.

OPIFER is the controller for information you give us directly, including website enquiries, partnership communications and security or privacy reports. This notice is written with the Nigeria Data Protection Act 2023 in mind.

2. Information we process

Depending on how you use OPIFER, we may process:

• your name, WhatsApp number, bank customer identifier and consent choices;
• masked account information, balances, beneficiaries, transaction instructions, amounts and transaction status;
• messages, voice transcriptions and banking details extracted from images you choose to send;
• support requests, operator replies and evidence needed to investigate a problem;
• device, request, delivery, security and audit information; and
• your work email, organisation and enquiry when you contact us through this website.

We aim to minimise information before it reaches an AI service. Full account numbers, PINs, access tokens and other authentication secrets must not be placed in conversational AI context.

3. How and why we use it

We process information to:

• identify the correct bank customer and keep customers separated;
• understand a banking request and collect missing details;
• display, confirm, authorize and reconcile a transaction;
• answer support questions and transfer uncertain cases to a human;
• prevent fraud, replay, unauthorized access and service abuse;
• maintain operational and audit evidence; and
• respond to enquiries and meet contractual or legal obligations.

Depending on the relationship and activity, the lawful basis may be performance of a contract, consent, compliance with a legal obligation, or legitimate interests such as protecting customers and maintaining service security. A bank may identify additional lawful bases in its own notice.

4. PIN and payment security

PINs are entered only through an encrypted WhatsApp Flow or an OPIFER secure authorization page. The plaintext value is used transiently for verification, cleared from application memory and replaced by a salted cryptographic hash. PIN attempts are bounded and repeated failures lock the credential.

AI interpretation alone cannot move money. OPIFER separates the conversational layer from deterministic banking controls. A transfer requires verified customer binding, explicit confirmation, a transaction-bound authorization, policy checks and idempotent execution. Customers may request human assistance where appropriate.

5. Who may receive information

We disclose only what is necessary to authorised recipients, which may include:

• the bank providing your account and its authorised operators;
• Meta, to deliver and secure the WhatsApp interaction and native Flows;
• approved AI providers, for bounded text, voice or image interpretation;
• payment and account-verification providers used by the bank pilot;
• hosting, database, security and monitoring providers; and
• regulators, courts or authorities where disclosure is lawfully required.

We do not sell customer personal data or use banking conversations for third-party advertising. Service providers are expected to process information only for the relevant service and under contractual and security controls.

6. International processing

Some technology providers and infrastructure used in a pilot may process information outside Nigeria, including in the United States or other locations where they operate. OPIFER and the bank will apply appropriate contractual, organisational and technical safeguards and will assess transfers as required by applicable law.

7. Retention and security

We keep personal data only for as long as needed for the stated purpose, the bank's approved retention schedule, transaction and dispute handling, security, audit, or applicable legal and regulatory requirements. Different records therefore have different retention periods. Information is deleted, anonymised or securely isolated when it is no longer required.

Safeguards include encryption in transit and at rest where applicable, tenant and customer separation, role-based access, signed and expiring authorizations, replay prevention, data minimisation, audit trails and transaction reconciliation. No system can guarantee absolute security; suspected incidents are investigated and handled under applicable notification duties.

Website data

This public website does not use advertising cookies. Its hosting provider may process essential request information needed to serve and protect the site. An enquiry sent by email is retained only as needed to respond and manage the resulting business relationship.

8. Your rights

Subject to the Nigeria Data Protection Act and any lawful limits, you may ask to be informed about processing, access your data, correct inaccurate data, object to or restrict certain processing, withdraw consent, request deletion, request portability, and seek human review of a decision based solely on automated processing.

For bank-service data, contacting your bank first will usually be fastest because the bank controls the customer relationship. You may also contact OPIFER and we will route or support the request. We may need to verify your identity before disclosing or changing data.

9. Contact and complaints

Privacy questions and rights requests can be sent to uthmangunu@opi-fer.com. Security concerns can be sent to uthmangunu@opi-fer.com.

If your concern is not resolved, you have the right to complain to the Nigeria Data Protection Commission.

Changes to this notice

We may update this notice as OPIFER, a bank pilot or applicable law changes. The effective date above identifies the current version. Material changes will be communicated through an appropriate service or bank channel where required.