1Who controls your data
Shard Technologies Ltd, a Nigerian company registered with number RC 9618776, is the data controller for the information described here. Contact us about privacy at support@shard.ng.
We process personal data under the Nigeria Data Protection Act 2023 and other applicable laws. If another privacy law applies to you, we will also honour the rights it gives you.
2What we collect
The data we collect depends on how you use Shard. It may come from you, your device, identity and payment providers, banks, public records, professional advisers, or regulators.
- Account and contact details: your name, date of birth, email address, phone number, country of residence, password hash and communication preferences.
- Identity and compliance data: identification details, photographs or liveness checks, verification outcomes and references, sanctions or politically exposed person screening, source-of-funds information, and records required for fraud prevention or anti-money-laundering checks. A verification provider may process the underlying images on our behalf; we may retain copies where law or our approved process requires it.
- Financial and investment activity: wallet entries and balances, deposits, withdrawals, bank or wallet details, holdings, orders, distributions and transaction records.
- Technical and usage data: IP address, device and browser information, security events, cookie identifiers and records of how you use the platform.
- Communications: messages, support requests, complaints, survey responses and marketing preferences.
3Why we use it
We use personal data to create and secure accounts, verify identity and eligibility, provide the platform, process and reconcile transactions, maintain ownership and financial records, pay distributions, provide support, prevent fraud and money laundering, and meet legal or regulatory duties.
Depending on the activity, our lawful basis is performance of our contract with you, compliance with a legal obligation, our legitimate interests in operating and protecting the platform, consent, or the establishment and defence of legal claims. Where processing depends on consent, you may withdraw it at any time without affecting earlier processing.
We do not sell personal data or share it so another company can market its products to you.
4Who receives it
We disclose only what is reasonably necessary for the relevant purpose and require service providers to protect the information they process for us.
- Identity, fraud-prevention and compliance providers.
- Banks, payment processors, payout providers and transaction counterparties.
- Property companies, nominees, administrators, registrars and professional advisers involved in an investment you make.
- Hosting, security, analytics, communications and customer-support providers.
- Regulators, courts, law-enforcement bodies, tax authorities or other recipients where disclosure is required or permitted by law.
- A buyer, investor or adviser involved in a proposed corporate transaction, subject to appropriate confidentiality and data-protection safeguards.
5International transfers
Some providers may process personal data outside Nigeria. Before making a restricted transfer, we use a lawful transfer mechanism and assess whether the destination and recipient provide an adequate level of protection. Safeguards may include an adequacy decision, contractual protections, your explicit consent where appropriate, or another basis permitted by law.
6How long we keep it
We retain personal data only for as long as needed for the purpose collected and to meet legal, regulatory, tax, accounting, fraud-prevention and dispute requirements. Account, identity and transaction records are generally kept while your account is open and for at least five years afterwards where anti-money-laundering or financial-record rules apply. A longer period may apply where law, an investigation or a legal claim requires it.
Financial records are not silently overwritten. Corrections are recorded alongside the original so that the history remains auditable.
7How we protect it
We use organisational and technical measures designed for the sensitivity of the data, including access controls, security monitoring and checks before acting on a request concerning your information.
No service can guarantee absolute security. If a personal-data breach occurs, we will investigate it and notify affected people and the Nigeria Data Protection Commission where the law requires.
8Automated checks
We may use automated tools to flag identity, fraud, sanctions or transaction risk. A flag may delay a transaction or send it for review. Where a decision based solely on automated processing produces a legal or similarly significant effect, you may ask for human review, explain your position and contest the decision, subject to lawful exceptions.
9Your rights
Subject to applicable limits, you may ask to access, correct or delete personal data; restrict or object to processing; receive portable data; withdraw consent; and challenge qualifying automated decisions. Email support@shard.ng. We may ask for information needed to verify your identity before acting.
We aim to respond within 30 days. The law may allow an extension for a complex request, in which case we will explain the delay. Some rights are limited: for example, we cannot erase records that law requires us to keep or data needed to establish or defend a claim.
If you are dissatisfied, you may complain to the Nigeria Data Protection Commission through ndpc.gov.ng. You may also seek a judicial remedy.
10Children
Shard is not intended for anyone under 18, and an under-18 person may not open an investment account. If you believe a child has provided personal data, contact us so we can investigate and take appropriate action.
12Changes to this policy
We may update this policy as the service, providers or law changes. We will change the date above and give appropriate notice of a material change before it takes effect where practicable.