Privacy Policy

1.Who we are

SureStocks is operated by Finclusion Technologies Ltd, which decides how and why your personal data is used on this platform and is the data controller for it. Finclusion Technologies Ltd is registered with the Nigeria Data Protection Commission; the registration can be checked from the foot of our home page.

This policy explains what we collect, why, who sees it, how long we keep it, and what you can ask us to do about it. It applies to the SureStocks website and to everything you do while signed in.

2.What we collect

We collect only what we need to open your account, meet our legal duties and provide the services you use.

• Account details. Your name, email address, mobile number, date of birth and password. Your account is a Finclusion account: these details are held by the Finclusion sign-in service, and your password is never visible to or stored by SureStocks.
• Identity verification. When you verify your identity we send your BVN or NIN to an identity verification provider. SureStocks does not keep the number itself: we keep only the fact and date that each check passed, and whether a check returned a watch-list flag.
• Brokerage and holdings. The broker you link, your account and CSCS numbers, and the shares that account holds, read from your broker with your authorisation.
• What you do on the platform. Orders you place and their outcomes, loan applications and the shares you pledge, repayments, shares you offer to lend and the contracts that follow, price alerts and your watchlist.
• Messages we send you. The notifications we create for you, and whether an email or SMS to you was delivered.
• Technical records. A record of significant actions on your account (who did what, and when), and logs of requests to our systems, including IP address. These exist for security, to resolve disputes and to meet audit requirements.

We do not buy data about you from data brokers, and we do not collect your contacts, location or device files.

3.Why we use it, and our legal basis

• To provide the service you asked for (performance of our contract with you): opening your account, showing your portfolio, routing your orders, assessing and servicing a loan, lending your shares and paying you.
• To meet legal obligations: confirming your identity and age, keeping the records financial regulation requires, and responding to lawful requests from regulators and courts.
• For our legitimate interests, balanced against yours: keeping the platform secure, detecting fraud and misuse, reconciling records with brokers and payment providers, and understanding how the service performs.
• With your consent, where we ask for it: reading your holdings from your broker, and any marketing messages. You can withdraw consent at any time; doing so does not affect what was done before.

Decisions about loans are made by people. Our systems calculate figures such as collateral value and loan-to-value and raise margin warnings automatically, but a loan is approved or declined, and any sale of collateral is authorised, by our staff.

4.Who we share it with

We do not sell your personal data. We share it only where the service or the law requires:

• The Finclusion sign-in service, which holds your account.
• Identity verification providers, to check your BVN or NIN.
• Your broker and the securities depository, to read your holdings, place your orders, and lock, release or move shares.
• Our loan servicing and payment provider, to pay out a loan and collect repayments.
• Email and SMS delivery providers, to send you notices.
• Our AI provider, only when you ask the assistant a question: it receives your question and the figures needed to answer it (market prices and, where relevant, your holdings and their values) — never your name, contact details, account or CSCS numbers.
• Institutions that borrow shares through the platform — who are told the shares and terms, never who the lender is.
• Our scheduling provider (Calendly), only if you choose to book a demo: it receives the details you enter in its booking form.
• Regulators, law enforcement and courts, where the law requires it.
• Professional advisers and auditors, under a duty of confidence.

Each provider may use your data only to carry out the service it provides to us. If data is transferred outside Nigeria, we do so only with the safeguards the Nigeria Data Protection Act requires.

5.How long we keep it

We keep your data for as long as you have an account, and afterwards for as long as the law requires financial and identity records to be kept. Records of transactions, loans and significant account actions are kept as a permanent audit trail and cannot be edited or deleted, including by our own administrators; where the law allows, we restrict access to them rather than erase them.

Drafts of forms you have started are kept in your own browser, not on our servers, and expire after seven days.

6.How we protect it

• Data is encrypted in transit, and your session is held in cookies that scripts on the page cannot read.
• Staff see only what their role requires, and every significant action is recorded.
• An independent auditor role, which no administrator can grant or remove, can review all positions and privileged activity.
• Identity numbers are not stored, and secrets are never written to logs.

No system is perfectly secure. If a breach is likely to put your rights at risk, we will tell you and the Nigeria Data Protection Commission as the law requires.

7.Cookies and browser storage

We use only what the site needs to work. There are no advertising or cross-site tracking cookies.

• Session cookies keep you signed in. They are essential, and are removed when you sign out or they expire.
• Browser storage remembers your light or dark theme, whether the sidebar is collapsed, and drafts of forms you have started. This stays on your device.

8.Your rights

Under the Nigeria Data Protection Act 2023 you can ask us to:

• confirm whether we hold data about you and give you a copy;
• correct data that is wrong or incomplete;
• erase data we no longer have a lawful reason to keep;
• restrict or object to how we use your data;
• give you your data in a portable form;
• not be subject to a decision based solely on automated processing that significantly affects you;
• withdraw a consent you gave.

Some records must be kept by law even if you ask for erasure; we will tell you when that applies. To make a request, contact Finclusion Technologies Ltd (contact address to be published before these documents take effect). We will answer within the time the law allows. If you are not satisfied, you can complain to the Nigeria Data Protection Commission.

9.Children

SureStocks is for adults. We do not open accounts for anyone under 18 and do not knowingly collect their data.

10.Changes to this policy

If we change this policy in a way that matters, we will tell you in the app or by email before the change takes effect, and the version at the top of this page will change.

11.Contact

Questions about this policy or your data: Finclusion Technologies Ltd (contact address to be published before these documents take effect).