Privacy Policy

Jonify Imports Limited operates the Jonify platform and acts as the primary Data Controller in respect of personal data processed through the Platform. Certain intellectual property rights relating to the Platform may be owned by Jonify Global IP Limited or other entities within the Jonify group.

At Jonify, we are committed to protecting the privacy, security and lawful use of personal data entrusted to us.

This Privacy Policy explains how Jonify Imports Limited (“Jonify”, “Company”, “we”, “us” or “our”) collects, uses, stores, discloses, transfers and otherwise processes personal data in connection with the Jonify platform, including its mobile applications, website, dashboards, backend services, sourcing marketplace, shipment and logistics services, communications functionality, payment infrastructure and related features (collectively, the “Platform”).

The Platform operates principally through two connected but distinct service journeys:

1.Logistics & Shipment Orders, through which customers who already have or have independently arranged their goods may request shipping, warehousing, customs clearance and delivery services; and

2.The P2P Sourcing Marketplace, through which customers may create Sourcing Requests and receive quotations from approved sourcing agents.

This Policy applies to personal data processed through both service journeys.

This Policy is issued having regard to the Nigeria Data Protection Act, 2023 (“NDPA”), applicable regulations, guidelines and directives issued by the Nigeria Data Protection Commission (“NDPC”), and other applicable data protection laws.

1Definitions

For the purposes of this Privacy Policy:

“AI Sourcing Assistant” means the artificial-intelligence-enabled functionality through which a customer may describe goods or sourcing requirements in natural language, upload reference materials and receive assistance in structuring a Sourcing Request.

“Controller” means the person or entity which determines, alone or jointly with others, the purposes and means of processing personal data. For the principal processing activities described in this Policy, the Controller is Jonify Imports Limited.

“Data Processor” means a person or entity that processes personal data on behalf of a Controller.

“Data Subject” means an identified or identifiable individual whose personal data is processed by Jonify.

“Personal Data” means any information relating to an identified or identifiable individual, as defined under applicable data protection law.

“Processing” means any operation or set of operations performed on personal data, including collection, recording, organisation, storage, retrieval, consultation, use, disclosure, transmission, restriction, deletion or destruction.

“Platform” means the Jonify website, mobile applications, dashboards, backend systems, APIs, sourcing marketplace, logistics and shipment functionality, communications systems, notifications and associated services.

“Sourcing Agent” means an independent sourcing agent approved or otherwise authorised by Jonify to participate in the Sourcing Marketplace and submit quotations in response to Sourcing Requests.

“Sourcing Request” means a structured request created by a customer through the Platform for the sourcing or procurement of specified goods.

“Quotation” means a commercial offer submitted by an approved Sourcing Agent in response to a Sourcing Request.

“Shipment Order” means a request submitted by a customer for logistics, warehousing, shipping, customs clearance or delivery services in respect of goods already sourced or independently arranged by that customer.

“Sensitive Personal Data” means personal data classified as sensitive or subject to enhanced protection under applicable data protection law.

“Third Party” means any person or entity other than the Data Subject, Jonify, or an authorised person acting under the direct authority of Jonify.

2Scope of This Policy

This Privacy Policy applies to personal data processed in connection with:

•registration and management of Jonify customer accounts;

•registration, verification and administration of Sourcing Agent accounts;

•creation and management of Sourcing Requests;

•AI-assisted creation and structuring of Sourcing Requests;

•manual creation and submission of Sourcing Requests;

•quotation submission and review;

•communications between customers, Sourcing Agents and Jonify personnel through authorised Platform functionality;

•payment initiation, processing and verification;

•supplier verification and procurement administration;

•warehouse receipt and shipment administration;

•customs clearance and delivery activities;

•customer support and dispute management;

•Platform security, fraud prevention and monitoring;

•notifications, alerts and transactional communications;

•analytics and Platform performance;

•marketing communications where applicable;

•interactions with the Jonify website and mobile applications; and

•other lawful activities reasonably necessary for the operation and protection of the Platform.

This Policy applies to customers, Sourcing Agents, warehouse-related users, administrative users and other persons whose personal data is lawfully provided to or collected by Jonify in connection with the Platform.

3Personal Data We Collect

3.1Information Provided by Users

(a)Depending on the nature of the user's interaction with the Platform, Jonify may collect:

•full name;

•email address;

•telephone number;

•residential, business or delivery address;

•account and login information;

•customer profile information;

•Sourcing Request information;

•product descriptions and specifications;

•Client Order Quantity / Order Quantity;

•product preferences and sourcing requirements;

•supplier or product links where voluntarily provided;

•budgets or purchasing parameters;

•product reference images;

•documents uploaded in connection with a Sourcing Request or transaction;

•information contained in communications with Jonify or other authorised Platform users;

•delivery and shipment information;

•warehouse and shipping information;

•customs or clearance information where required;

•information provided for supplier verification;

•information necessary to process refunds, complaints or disputes;

•information voluntarily supplied to customer support; and

•other information reasonably necessary to provide the requested Platform service.

(b)Where the customer uses the AI Sourcing Assistant, Jonify may process the natural-language description of the customer's sourcing requirements, uploaded reference images and the customer's responses to clarification questions in order to generate a structured draft Sourcing Request.

(c)The customer remains responsible for reviewing the AI-generated draft before submitting it to the marketplace.

(d)Where an individual provides personal data relating to another person, that individual represents that they are authorised to provide such information and that its use by Jonify for the relevant purpose is lawful.

(e)Failure to provide information that is necessary for the performance of a requested service may prevent Jonify from providing that service.

3.2Automatically Collected Data

(a)When you use the Platform, Jonify may automatically collect certain technical and usage information, including:

•device type;

•device identifiers;

•operating system;

•application version;

•browser type;

•IP address;

•approximate location information derived from technical data where applicable;

•session information;

•login and authentication events;

•timestamps;

•pages, screens and Platform features accessed;

•Sourcing Request interactions;

•quotation viewing and interaction history;

•order and shipment status interactions;

•notification delivery information;

•error logs;

•performance information;

•security and audit logs;

•information concerning how users interact with the Platform; and

•information concerning the operation of timers, notifications and other Platform functionality.

(b)Jonify may also collect information relating to how customers interact with Sourcing Requests, including whether quotations were viewed, accepted, rejected or sent for modification.

3.3Transaction & Payment Data

(a)Jonify may process information relating to transactions carried out through the Platform, including:

•payment confirmations;

•transaction references;

•payment status;

•amount paid;

•applicable sourcing fees;

•accepted goods/order value;

•refund information;

•settlement information;

•agent earning calculations;

•payment verification information; and

•records necessary for accounting, audit, fraud prevention and dispute resolution.

(b)Where payment services are provided by third-party payment processors, Jonify generally does not directly store full payment card credentials unless expressly stated otherwise.

(c)Payment processors may process payment information under their own privacy policies and applicable regulatory obligations.

3.4Sourcing Agent Information

(a)Where a user applies to participate as a Sourcing Agent, Jonify may collect additional information reasonably necessary for onboarding, verification, marketplace administration and payment of agent earnings.

This may include:

•legal name;

•business name;

•contact information;

•identification information;

•business registration information;

•bank or settlement account information;

•tax or regulatory information where applicable;

•verification information;

•sourcing experience and marketplace profile information;

•order performance information;

•quotation history;

•customer ratings and feedback;

•completion and response statistics; and

•other information reasonably necessary to determine eligibility and administer participation in the Sourcing Marketplace.

(b)Jonify may use this information to approve, verify, suspend or manage Sourcing Agent access.

3.5AI Sourcing Assistant Data

(a)Where the AI Sourcing Assistant is used, Jonify may process:

•the customer's natural-language request;

•product descriptions;

•reference photographs and attachments;

•responses to clarification questions;

•generated draft Sourcing Request information;

•corrections made by the customer to the generated draft; and

•technical information concerning use of the AI feature.

(b)The AI Sourcing Assistant is intended to assist with the creation and structuring of Sourcing Requests. It does not constitute a substitute for the customer's own review of the information before submission.

(c)Jonify may use authorised technology providers to provide or support AI functionality. Where third-party AI providers process personal data on Jonify's behalf, Jonify will take appropriate contractual, technical and organisational measures consistent with applicable data protection requirements.

3.6Communications and User-Generated Content

(a)Where the Platform provides communication functionality, Jonify may process:

•messages;

•attachments;

•images;

•documents;

•quotation-related communications;

•customer instructions;

•agent responses;

•support communications; and

•other content voluntarily submitted through the Platform.

(b)Such information may be retained where reasonably necessary for service delivery, transaction administration, security, fraud prevention, dispute resolution, audit or legal compliance.

3.7Sensitive Personal Data

(a)Jonify does not intentionally request Sensitive Personal Data unless such information is reasonably necessary for a lawful and specified purpose.

(b)Users should not upload or disclose Sensitive Personal Data through a Sourcing Request, quotation, communication channel or other Platform feature unless:

1.the information is genuinely necessary for the relevant transaction or service; and

2.the disclosure is lawful.

(c)Where Jonify becomes aware that Sensitive Personal Data has been inadvertently submitted, Jonify may take appropriate steps to restrict, secure or delete the information where legally permissible and operationally appropriate.

4Purposes of Processing

(a)Jonify processes personal data only for specified, explicit and legitimate purposes, including:

•creating and administering user accounts;

•verifying user identities and eligibility;

•approving and managing Sourcing Agents;

•creating and administering Sourcing Requests;

•operating the AI Sourcing Assistant;

•structuring customer sourcing requirements;

•publishing eligible Sourcing Requests to approved Sourcing Agents;

•administering agent claims and marketplace limits;

•administering the three-agent claim limit;

•administering the three-active-order limit applicable to Sourcing Agents;

•managing quotation submission and review;

•administering the 72-hour quotation period;

•administering the 24-hour customer decision timer;

•administering quotation modification requests;

•administering the 24-hour agent revision period;

•facilitating communications between customers, Sourcing Agents and Jonify;

•processing payments;

•calculating and administering applicable Jonify sourcing fees;

•calculating Sourcing Agent earnings;

•administering the Jonify 60/40 sourcing-fee allocation;

•verifying suppliers and procurement information;

•facilitating procurement and supplier payments;

•administering warehouse receipt and shipment activities;

•providing shipment tracking;

•arranging logistics and customs-related services;

•providing customer support;

•investigating complaints and disputes;

•preventing fraud and abuse;

•detecting security incidents;

•enforcing Platform rules;

•improving Platform functionality and user experience;

•conducting analytics and performance monitoring;

•maintaining records;

•complying with legal and regulatory obligations;

•responding to lawful requests from competent authorities; and

•sending marketing communications where permitted and where the necessary legal basis exists.

(b)Jonify will not process personal data for purposes that are incompatible with the purposes for which the information was collected unless permitted or required by applicable law or another lawful basis exists.

5Lawful Basis for Processing (NDPA Compliance)

Depending on the nature and circumstances of the processing, Jonify may rely on one or more lawful bases recognised under applicable data protection law, including:

5.1Contractual Necessity

Where processing is necessary to:

•create and administer an account;

•process a Sourcing Request;

•facilitate quotations;

•process a Shipment Order;

•process payments;

•provide logistics services;

•communicate transaction information; or

•otherwise perform a contract or take steps at the user's request before entering into a contract.

5.2Legal Obligation

Where processing is necessary to comply with applicable laws, regulations, court orders, regulatory requirements, tax obligations, customs requirements, accounting requirements, anti-fraud obligations or other lawful governmental requirements.

5.3Legitimate Interests

Where processing is necessary for legitimate interests pursued by Jonify or an appropriate third party, provided that such interests are not overridden by the rights and interests of the Data Subject.

These interests may include:

•Platform security;

•fraud prevention;

•abuse prevention;

•service improvement;

•internal administration;

•business continuity;

•network and information security;

•enforcement of Platform terms;

•protection of Jonify's legal rights; and

•management of commercial relationships.

5.4Consent

(a)Where applicable law requires consent, Jonify will seek consent in an appropriate manner.

(b)Consent may be relevant to certain marketing activities, optional communications, cookies or other processing activities where consent is the appropriate lawful basis.

(c)Where processing is based on consent, the Data Subject may withdraw consent, subject to applicable legal limitations and the consequences of withdrawal.

(d)Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

6Security

(a)Jonify implements reasonable and appropriate technical, organisational and administrative measures designed to protect personal data against:

•unauthorised access;

•unlawful processing;

•accidental loss;

•destruction;

•alteration;

•misuse;

•disclosure; and

•other security threats.

(b)Depending on the nature and sensitivity of the information, security measures may include:

•encryption in transit;

•appropriate encryption or protection at rest;

•access controls;

•authentication mechanisms;

•role-based access;

•secure cloud infrastructure;

•logging and monitoring;

•vulnerability management;

•backups;

•incident response procedures;

•personnel confidentiality obligations;

•access limitation on a need-to-know basis; and

•other safeguards appropriate to the nature and risk of the processing.

(c)Payment transactions may be processed through third-party payment service providers that maintain their own security and compliance frameworks.

(d)No electronic transmission, storage system or internet service can be guaranteed to be completely secure. Accordingly, while Jonify takes reasonable and appropriate measures to protect personal data, it cannot guarantee absolute security against every possible threat.

7Data Sharing and Disclosure

Jonify may disclose personal data where reasonably necessary for the purposes described in this Policy and where such disclosure is lawful.

7.1Service Providers

(a)Jonify may share relevant personal data with carefully selected service providers, including:

•cloud hosting providers;

•database and infrastructure providers;

•payment processors;

•payment verification providers;

•AI and technology service providers;

•notification and messaging providers;

•analytics providers;

•customer support providers;

•cybersecurity and fraud prevention providers;

•identity and verification providers;

•logistics and shipping providers;

•warehouse operators;

•customs clearing agents;

•procurement and supplier verification providers;

•professional advisers;

•accounting and audit service providers; and

•other service providers reasonably required to operate the Platform.

(b)Where a third party processes personal data on Jonify's behalf, Jonify will seek to ensure that appropriate contractual and organisational safeguards are in place.

7.2Sourcing Agents

(a)Where necessary to perform the sourcing service, relevant customer information may be made available to approved Sourcing Agents participating in the relevant Sourcing Request.

This may include information such as:

•product requirements;

•product descriptions;

•reference images;

•Order Quantity;

•specifications;

•delivery requirements; and

•other information reasonably necessary to prepare a quotation.

(b)Jonify will seek to limit the information disclosed to what is reasonably necessary for the relevant sourcing activity.

(c)Jonify does not generally disclose a customer's payment credentials to Sourcing Agents.

7.3Suppliers and Procurement Partners

(a)Where a customer accepts a quotation and procurement proceeds, relevant information may be shared with suppliers and procurement partners where necessary to:

•verify the supplier;

•place the order;

•process the procurement;

•arrange production;

•arrange delivery to the Jonify warehouse; or

•otherwise fulfil the transaction.

7.4Logistics, Warehouse and Customs Partners

(a)Where goods are being shipped through Jonify, relevant information may be shared with:

•warehouse operators;

•shipping providers;

•freight forwarders;

•customs agents;

•clearing agents;

•delivery partners; and

•other logistics service providers.

Such information may include names, contact details, delivery information, shipment references, cargo information and other information reasonably necessary to perform the logistics service.

7.5Regulatory Authorities

(a)Jonify may disclose personal data to:

•courts;

•regulators;

•law enforcement authorities;

•customs authorities;

•tax authorities;

•government agencies; and

•other competent authorities,

where required or permitted by applicable law, regulation, court order or lawful governmental request.

7.6Affiliates and Group Companies

(a)Jonify may share personal data with its affiliates or group companies where reasonably necessary for:

•Platform administration;

•technology services;

•compliance;

•security;

•internal administration;

•customer support;

•business continuity; or

•other legitimate business purposes.

Such sharing will remain subject to applicable data protection requirements.

7.7Business Transfers

(a)If Jonify is involved in a merger, acquisition, restructuring, financing, sale of assets, reorganisation or similar transaction, personal data may be transferred as part of the transaction, subject to applicable law and appropriate confidentiality and data protection safeguards.

(b)Jonify will not sell personal data as a standalone commercial asset in circumstances prohibited by applicable law.

8Cross-border Data Transfers

(a)Because Jonify's sourcing and logistics operations may involve suppliers, service providers, technology providers and logistics partners located outside Nigeria, personal data may be transferred to or accessed from jurisdictions outside Nigeria, including jurisdictions in which Jonify's service providers or sourcing partners operate.

(b)Where personal data is transferred outside Nigeria, Jonify will implement appropriate safeguards and comply with applicable requirements governing cross-border transfers.

Depending on the circumstances, safeguards may include:

•adequacy decisions or recognised adequate protection mechanisms;

•appropriate contractual safeguards;

•data processing agreements;

•standard contractual clauses or equivalent safeguards where applicable;

•confidentiality obligations;

•encryption;

•access controls;

•data minimisation; and

•other safeguards required by applicable law.

(c)Where personal data is shared with suppliers, logistics providers or other service providers in China, Jonify will take reasonable steps to ensure that the transfer and subsequent processing are conducted in accordance with applicable data protection requirements.

(d)Cross-border transfers may be necessary to perform a transaction requested by the customer, particularly where goods are being sourced, procured, inspected, warehoused or shipped from outside Nigeria.

9Data Retention

(a)Jonify retains personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law.

Retention periods may depend on:

•the nature of the information;

•the purpose for which it was collected;

•the existence of an active account;

•contractual obligations;

•legal and regulatory requirements;

•tax and accounting obligations;

•audit requirements;

•fraud prevention;

•security requirements;

•dispute resolution;

•enforcement of contractual rights; and

•legitimate business requirements.

Generally:

•Active account information may be retained while the account remains active.

•Transaction and payment records may be retained for the period reasonably necessary to satisfy legal, tax, accounting, audit, fraud prevention and dispute resolution requirements.

•Sourcing Requests and quotations may be retained for transaction administration,

performance analysis, dispute resolution, fraud prevention and legitimate record-keeping purposes.

•Communications and support records may be retained for as long as reasonably necessary to address the relevant matter and protect Jonify's legal interests.

•Inactive accounts may be deleted, anonymised or otherwise de-identified where there is no continuing lawful reason to retain the information.

(b)Deletion does not necessarily mean immediate physical destruction of every copy of information where retention is required by law, legitimate security requirements, backups or other lawful purposes.

10Cookies and Similar Technologies

(a)Jonify and its authorised service providers may use cookies, software development kits, pixels, device identifiers, local storage, analytics technologies and similar technologies to:

•keep users signed in;

•maintain sessions;

•remember preferences;

•operate Platform functionality;

•understand Platform usage;

•improve performance;

•detect fraud and security threats;

•analyse traffic;

•measure service performance; and

•where permitted, support marketing activities.

(b)Where applicable, users may manage certain cookie preferences through available Platform controls or browser/device settings.

(c)Disabling certain cookies or technologies may affect the availability or functionality of some Platform features.

(d)Where required by applicable law, Jonify will obtain consent before placing or using non- essential cookies or similar technologies.

11Marketing and Communications

(a)Jonify may use personal data to send users:

•service announcements;

•transactional notifications;

•account notifications;

•sourcing and quotation notifications;

•payment notifications;

•shipment updates;

•security alerts;

•Platform updates;

•newsletters; and

•promotional or marketing communications.

Marketing Communications

(b)Where consent is required, Jonify will obtain the appropriate consent before sending direct marketing communications.

Users may opt out of marketing communications through:

•an unsubscribe mechanism contained in marketing emails;

•applicable Platform settings;

•notification preferences; or

•contacting Jonify at the designated privacy or support address.

Transactional Communications

(c)Opting out of marketing communications will not generally prevent Jonify from sending communications necessary to:

•process an order;

•administer a Sourcing Request;

•notify the user of quotation activity;

•notify an agent of a claim or deadline;

•administer payment;

•provide shipment updates;

•protect account security;

•notify users of material service changes; or

•comply with legal or contractual obligations.

12Data Subject Rights (NDPA Rights)

(a)Subject to applicable law and any lawful limitations, Data Subjects may have rights including the right to:

•request access to personal data held about them;

•request correction of inaccurate or incomplete personal data;

•request deletion or erasure where legally applicable;

•request restriction of processing in appropriate circumstances;

•object to certain processing;

•request data portability where applicable;

•withdraw consent where processing is based on consent;

•object to certain direct marketing;

•request information concerning the processing of their personal data; and

•lodge a complaint with the Nigeria Data Protection Commission or another competent authority where applicable.

(b)These rights are not absolute and may be subject to statutory exceptions, legal obligations, legitimate interests, contractual requirements, security considerations and other lawful grounds.

(c)To exercise a data protection right, a Data Subject may submit a request to Jonify using the contact details provided in Section 20.

(d)Jonify may request reasonable information to verify the identity of the person making the request before responding.

(e)Jonify will respond to valid requests within the period required by applicable law, subject to any lawful extension or limitation.

13AI, Automated Processing and Platform Decision-making

(a)The Platform uses automation and AI-assisted functionality, including the AI Sourcing Assistant, to support users in creating and managing Sourcing Requests.

The AI Sourcing Assistant may:

•interpret natural-language descriptions;

•identify products described by a customer;

•separate multiple products where appropriate;

•ask clarification questions;

•structure information supplied by the customer; and

•generate an editable draft Sourcing Request.

(b)The AI-generated information is intended to assist the customer and may contain errors, omissions or inaccuracies.

(c)The customer is responsible for reviewing and confirming the Sourcing Request before submitting it to the marketplace.

(d)Jonify does not represent that AI-generated information will always be complete, accurate or suitable for a particular commercial purpose.

(e)The Platform may also use automated rules and systems to administer:

•agent eligibility;

•marketplace claim limits;

•the maximum of three agents per Sourcing Request;

•the maximum of three active sourcing orders per agent;

•quotation deadlines;

•expiry of unsubmitted claims;

•customer decision timers;

•agent revision deadlines;

•notifications;

•order status changes;

•fee calculations; and

•agent earning calculations.

These automated processes are principally operational and administrative.

(f)Where applicable law gives a Data Subject rights in relation to solely automated decision- making that produces legal or similarly significant effects, Jonify will comply with those requirements and provide applicable safeguards.

14Data Security

(a)Registered users are responsible for maintaining the confidentiality of their account credentials and authentication information.

Users must:

•keep passwords confidential;

•avoid sharing authentication codes;

•use reasonable security measures;

•notify Jonify promptly of suspected unauthorised access;

•log out of shared or public devices; and

•avoid submitting unnecessary personal or sensitive information through public or inappropriate Platform channels.

(b)Jonify implements reasonable technical, organisational and administrative measures designed to protect personal data.

These measures may include:

•access controls;

•authentication mechanisms;

•encryption;

•secure infrastructure;

•monitoring;

•logging;

•backup procedures;

•incident response processes; and

•staff confidentiality obligations.

However, no internet-connected system can be guaranteed to be completely secure. Users acknowledge that electronic transmission involves inherent risks.

15Children's Data

(a)The Platform is not intended for persons under 18 years of age unless expressly permitted by applicable law and Jonify's applicable service rules.

(b)Jonify does not knowingly seek to collect personal data from children in circumstances where such collection is prohibited by law.

(c)If Jonify becomes aware that personal data relating to a child has been collected unlawfully, Jonify may take reasonable steps to delete or restrict such information.

(d)A parent or lawful guardian who believes that a child has provided personal data to Jonify may contact Jonify using the details provided in Section 20.

16Third-party Services

(a)The Platform may integrate with or rely upon third-party services, including:

•payment processors;

•cloud infrastructure providers;

•AI and technology providers;

•analytics providers;

•communication and notification services;

•logistics providers;

•warehouse operators;

•shipping providers;

•customs and clearing agents;

•supplier verification services;

•identity verification providers; and

•other service providers required to operate the Platform.

Third-party services may have their own terms and privacy policies.

(b)Jonify does not control the independent privacy practices of third parties acting as separate controllers.

(c)Where a third party processes personal data on Jonify's behalf, Jonify will seek to impose appropriate data protection and confidentiality obligations consistent with applicable law.

(d)Relevant third parties may process personal data outside Nigeria where necessary for the services they provide, subject to applicable cross-border transfer requirements.

17Data Ethics & Privacy By Design

(a)Jonify adopts a Privacy by Design and Privacy by Default approach to the development and operation of the Platform.

(b)Jonify seeks, where reasonably practicable, to:

•collect only information reasonably necessary for identified purposes;

•limit access to personal data;

•use appropriate security measures;

•implement appropriate retention periods;

•minimise unnecessary disclosure;

•consider privacy risks when introducing new Platform features;

•incorporate data protection considerations into technology development;

•provide appropriate user controls; and

•assess material changes to processing practices before implementation.

(c)Jonify may conduct privacy or data protection assessments where required by applicable law or where the nature and risk of a proposed processing activity reasonably warrant such assessment.

18Data Breach Management

(a)Jonify maintains procedures designed to identify, contain, investigate and respond to actual or suspected personal data breaches.

(b)Where a personal data breach occurs, Jonify may:

•take immediate containment and mitigation measures;

•investigate the nature and scope of the incident;

•assess the risks to affected Data Subjects;

•preserve relevant evidence;

•notify the NDPC where required by applicable law;

•notify affected Data Subjects where legally required or otherwise appropriate;

•notify relevant service providers or business partners where necessary; and

•take reasonable measures to prevent recurrence.

(c)Where notification to a regulator or Data Subject is legally required, Jonify will make such notification within the applicable statutory or regulatory timeframe.

19Changes to This Privacy Policy

(a)Jonify may amend, revise or update this Privacy Policy from time to time to reflect:

•changes in applicable law;

•regulatory requirements;

•regulatory guidance;

•technological developments;

•changes to the Platform;

•introduction of new features;

•changes to data processing practices;

•changes in service providers; or

•legitimate business and operational requirements.

(b)Where material changes are made, Jonify will take reasonable steps to notify users in a manner appropriate to the nature and significance of the change.

Notification may be provided through:

•in-app notifications;

•email;

•website notices;

•Platform banners;

•account notifications; or

•other appropriate means.

(c)Where applicable law requires consent for a material change in processing, Jonify will obtain the necessary consent before implementing the relevant processing.

(d)Unless otherwise stated, the revised Policy will become effective upon publication on the Platform.

Users are encouraged to periodically review this Privacy Policy.

The “Last Updated” date appearing at the beginning of this Policy indicates the date of the most recent revision.

20Contact and Data Protection Officer

For privacy, data protection, access requests, complaints or other data protection enquiries, please contact:

Where a Data Subject submits a request relating to personal data, Jonify may require reasonable information to verify the identity of the requester before processing the request.

21Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act, 2023 and applicable regulations, guidelines and directives issued under it.

Nothing in this Policy is intended to exclude or limit any mandatory right or protection available to a Data Subject under applicable data protection law.