Onward C.I.C.U.
Draft. This page is awaiting details and review by Onward C.I.C.U. Highlighted text marks information still to be completed.
About this policy
This Privacy Policy explains how Onward Cooperative Investments and Credit Union ("Onward C.I.C.U.", "the cooperative", "we", "us") collects, uses, shares and protects personal data about members who use the Onward C.I.C.U. member app (on iOS and Android) and this website, https://onwardcooperative.com.ng.
We follow the Nigeria Data Protection Act 2023 (the "NDPA") and the General Application and Implementation Directive 2025 (the "GAID") issued by the Nigeria Data Protection Commission.
Who we are
The data controller for your personal data is:
- Legal name: [To be completed: full legal name of the cooperative]
- Registration number: [To be completed: cooperative registration number and registering authority]
- Registered address: [To be completed: registered address]
- Contact email: [To be completed: contact email]
- Data Protection Officer: [To be completed: name or title, email and phone number of the Data Protection Officer]
The app and platform are built by First Pavilion Technologies, acting for the cooperative.
Who this policy applies to
The app is for members of cooperative societies that take part in Onward C.I.C.U. ("participating societies"). You cannot sign yourself up. Your society's administrator creates your member record, and you then sign in with your email address (or OG Number) and a password.
A separate web portal is used only by cooperative staff. This policy covers the personal data about members that is held in the platform, whether it is seen through the app or by staff.
The app is for adults aged 18 and over. It is not meant for children, and we do not knowingly hold data about children in it.
The personal data we hold
Membership details
- the society you belong to, your membership number and the date your membership started
- your full name, email address and phone number
- your employee or OG (government payroll) number
- your membership status (active, suspended or removed), your service status (in service or retired) and, where it applies, your retirement date
Bank details
- your current and past bank accounts (bank name and account number)
- the history of changes made to them
Financial records
- your shares, savings and special savings
- Kasolayo, if you have joined it (an optional fixed monthly retirement contribution)
- loan applications and their outcomes, active loans, loan disbursements and repayments
- payroll and bank deduction schedules and deduction reports that relate to you
- the reconciliation of deductions, which checks what was deducted against what was expected
What you write and receive in the app
- posts and replies you write in the member forum
- notifications shown to you inside the app
Technical and security data
- a push-notification installation identifier for your device and its platform (iOS or Android)
- password reset requests
- an audit trail of actions taken in the system, which records the IP address and the browser or app "user agent" (a short text that names the app or browser and its version)
What we do not collect
We do not collect your date of birth, home address, BVN or NIN. The app does not access your location, contacts, photos, camera, microphone or biometrics, and it does not use advertising identifiers.
The app contains no analytics or advertising software and does not track you across other apps or websites.
This website sets no cookies, runs no scripts and uses no analytics. Like any web server, it records the technical details of each request (IP address, the page asked for and the browser's user agent) in its logs, to keep the site running and secure.
Where the data comes from
Most of this data is not collected from you through the app. It comes from:
- your society and the cooperative, which create and keep your member record
- the payroll or bank deduction reports that confirm what was deducted from your pay or account
- the records the cooperative keeps of your savings, shares, Kasolayo and loans
Some data comes from you directly: your forum posts and replies, password reset requests, and the technical data your device sends when you use the app.
Why we use your data and our legal basis
The NDPA (section 25) allows personal data to be processed only on a lawful basis. We use the bases below. We do not rely on your consent for the processing in this policy, and simply using the app or website is not treated as consent.
| What we do | Data used | Legal basis under the NDPA |
|---|---|---|
| Keep your membership record and let you sign in to the app | membership details, email, OG Number, password | Performing our agreement with you as a member (section 25(1)(b)(i)) |
| Keep the cooperative's books: shares, savings, special savings, Kasolayo, loans, deductions and reconciliation, and show them to you in the app | membership details, bank details, financial records, employee/OG number | Performing our agreement with you (section 25(1)(b)(i)) and complying with our legal obligations to keep accurate records and accounts (section 25(1)(b)(ii)) |
| Match payroll and bank deductions to the right member | employee/OG number, bank details, name | Performing our agreement with you (section 25(1)(b)(i)) |
| Send account activation and password reset emails | name, email, password reset requests | Performing our agreement with you (section 25(1)(b)(i)) |
| Send push notifications that tell you to open the app | push-notification installation identifier, platform | Our legitimate interest in letting you know that something has changed in your records (section 25(1)(b)(v)) |
| Run the member forum and keep it orderly | forum posts and replies, name | Performing our agreement with you (section 25(1)(b)(i)) and our legitimate interest in a safe, respectful forum (section 25(1)(b)(v)) |
| Keep the system secure, investigate misuse and keep an audit trail | audit trail, IP address, user agent | Our legitimate interest in security and fraud prevention, and our duty to keep proper records (sections 25(1)(b)(v) and 25(1)(b)(ii)) |
| Find and fix technical errors | error reports, which are set up not to contain personal data | Our legitimate interest in a working service (section 25(1)(b)(v)) |
We rely on legitimate interests only for processing that members would reasonably expect and that does not override your rights and freedoms. You can object to it (see "Your rights"). You can also turn off push notifications at any time in your device settings.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. Deductions are allocated by fixed rules set by the cooperative, and loan applications are reviewed by cooperative staff.
We do not sell your personal data and we do not use it for advertising.
Who can see your data
- You, through the app.
- Authorised cooperative staff and your society's administrators, through the staff web portal, limited to the society or societies they are responsible for.
- Other members can see the posts and replies you write in the forum, with your name.
- Our service providers (processors), who handle data only on our instructions:
| Provider | What it does | What it receives |
|---|---|---|
| Google Firebase Cloud Messaging | Delivers push notifications to your device | Your device's push-notification identifier. The notification text is always "Open Onward to view your updates" and contains no personal data. |
| Sentry | Error monitoring | Technical error reports, set up not to send personal data and with automatic scrubbing |
| A cloud object storage provider (S3-compatible) | Stores deduction files and reports | Deduction files and reports, which contain financial records |
| An email (SMTP) provider | Sends account activation and password reset emails | Your name and email address and the email content |
| A cloud hosting provider | Runs the servers and database | All the data described in this policy, stored on its servers |
[To be completed: names of the cloud hosting provider, object storage provider and email provider, and the countries where they store data]
[To be completed: confirm whether First Pavilion Technologies can access member data to operate or support the platform; if so, list it here as a processor]
We require our service providers, by written agreement, to protect your data to the same standard as this policy and the NDPA require. [To be completed: confirm a written data processing agreement is in place with each provider listed above]
We may also disclose personal data where the law requires it, for example to a court or regulator, or to establish or defend a legal claim.
Transfers outside Nigeria
Some of our service providers may process data outside Nigeria. Where personal data is transferred outside Nigeria, we do so only where the NDPA allows it (sections 41 to 43), for example where the recipient is bound by contractual clauses or another mechanism that gives an adequate level of protection.
[To be completed: list which providers process data outside Nigeria, the countries, and the transfer mechanism relied on for each]
How we protect your data
- Your phone number, employee number and bank account numbers are encrypted when stored.
- Uploaded files are stored privately and can be opened only through short-lived signed links.
- Access by staff is limited by role and by society, and actions are recorded in an audit trail.
- Your financial records and the audit trail cannot be edited or deleted once written.
No system is completely secure. If a personal data breach is likely to put your rights and freedoms at risk, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and where the risk to you is high we will tell you directly, as section 40 of the NDPA requires.
Please keep your password secret. We will never ask you for your password by email or phone.
How long we keep your data
- While you are a member, we keep your data for as long as your account and membership are active.
- Financial records and the audit trail are the cooperative's books. Once written they are never edited or deleted, so that the books stay complete. We keep them for [To be completed: retention period for financial records and the audit trail] to meet our legal and accounting obligations.
- After your account is deactivated, we keep your remaining personal data for [To be completed: retention period after an account is deactivated], and then remove or de-identify the personal contact details that we no longer need, as far as the law and our record-keeping duties allow.
- Password reset requests are kept for [To be completed: retention period for password reset requests].
Your rights
Under the NDPA (sections 34 to 38) you have the right to:
- ask whether we hold personal data about you, and receive a copy of it
- ask us to correct data that is inaccurate, out of date, incomplete or misleading
- ask us to erase your data, where we no longer need it or have no other lawful basis to keep it
- ask us to restrict processing while a request or objection is being resolved
- object to processing based on our legitimate interests
- receive your data in a structured, commonly used and machine-readable format, where the right of data portability applies
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you
Some rights are limited. In particular, we cannot erase or change financial records and audit records that we must keep as the cooperative's books; we can correct a mistake only by recording a correcting entry.
To use any of these rights, email [To be completed: contact email] from the email address registered to your account, or ask your society administrator. We will confirm your identity before acting and will reply within [To be completed: period for responding to data protection requests].
To request deletion of your account, see our Account deletion page.
Complaints
If you are unhappy with how we handle your data, please contact us or our Data Protection Officer first, at [To be completed: Data Protection Officer contact].
You also have the right to complain to the Nigeria Data Protection Commission (NDPC) under section 46 of the NDPA.
Changes to this policy
We may update this policy when the app, the law or our practices change. We will publish the new version on this page and, if the change is significant, tell you in the app or by email.
Contact us
- Email: [To be completed: contact email]
- Data Protection Officer: [To be completed: Data Protection Officer contact]
- Post: [To be completed: registered address]