External Privacy Policy

Aim of the Privacy Policy

This External Privacy Policy outlines the practices of Interstate Securities Limited (ISL) regarding the collection, use, recording, organization, storage, adaptation, retrieval, disclosure, and management of personal data belonging to clients, customers, and all individuals who utilize our services or visit our premises. Additionally, it informs individuals of their rights concerning the personal data we hold.

This policy is established in compliance with the Nigeria Data Protection Act (NDP Act), 2023, as well as other relevant data privacy laws and regulations.

Who We Are

At ISL, our tailored service delivery includes Corporate Finance, Brokerage Services, Advisory Services, Asset tracking and Dividend Recovery. This Privacy Policy describes what Personal Data we collect, what we do with it, and how we protect it.

This policy (together with our Cookie Policy and Terms & Conditions) describes how we handle your personal data. By continuing to visit our website https://interstatesecurities.com/privacy-policy, you accept and agree to the practices described in this policy.

What We Do

At ISL, we gather and process your Personal Data in accordance with this privacy notice and in compliance with the relevant data protection regulations and laws. This notice provides you with the necessary information regarding your rights and our obligations and explains how, why, and when we process your personal data.

Individuals to whom this Privacy Policy is addressed

This privacy policy is addressed to individuals who are:

Recruitment Candidates
Customers
Vendors
Brokers/Agents
Website Visitors
Visitors
Voice Data from users or any individuals utilizing our service
CCTV Surveillance Subjects
Recipients of electronic or other communications which contain or refer to this Privacy Policy

Information that we collect and how it is used

We process your Personal Data to meet our obligations and provide our products and services. We may collect your personal data via different mediums such as hard copy forms, web forms, emails, cookies, CCTV, voice recording and employment CVs. We may also collect and receive information from you when you visit our website or communicate with us via email, in writing or social media. In addition, we may receive information about you from other sources such as third-party organisations, regulatory authorities’ government agencies (NAICOM, NIBSS, SEC, NGX, CSCS, or from our subsidiaries. Furthermore, we may receive information about you from cookies and other tracking technologies on our websites, and when you use our mobile apps and digital channels. We collect only necessary personal data and process it as specified in this notice. We take your privacy seriously and will not disclose, share, or sell your data without your consent, unless required by law. You can withdraw your consent for promotional offers and marketing at any time by clicking here.

Data Subjects	Personal Data Processed	Business/Commercial Purpose for Processing	Lawful Basis for Processing
Recruitment Candidates	Name, address, phone number, email, CV, academic qualifications, certifications and experience, employment history, date of birth, Previous Salary, educational background	To conduct recruitment exercises to identify qualified candidates to fill job openings (i.e., communicating with applicants during the recruitment process and making decisions on their suitability for roles applied)	Performance of a Contract
Pre-employment medical assessment candidates	Blood type/group, blood pressure, fitness report, detailed medical results	To ascertain the health status and fitness of prospective candidates for employment.	Legal Obligation
Customers	Name, BVN, address, email, phone number, passport photograph, date of birth, employer’s details, Employment details, next of kin details, Means of Identification, Tax ID, Email, Payment Details/bank Details, Source of funds, Medical History/Medical report/health status, nationality, Risk Location, Asset details, Vehicle details, Client Profile data real time location	To provide our tailored products and services. To provide support services.	Necessary step before entering a contract or for the performance of a contract
		To fulfil our KYC obligations prior to you opening an account with us	Legal obligation
		To complete asset validation	Consent
		For marketing and sales strategy purposes	Legitimate Interest
		Regulatory reporting to government and tax authorities	Legal Obligation
Vendors	Director’s name/Contact Person’s name, Address, email address, phone number	To establish communication and ensure the delivery of contracted goods and services.	Necessary step before entering a contract or for the performance of a contract
Vendors		To fulfill contractual payment obligations	Performance of Contract
Brokers/Agents	Name of Representative, phone number, email addresses, account details, date of birth, photo, blood group	For onboarding of brokers	Contract
Brokers/Agents		Enroll agents in medical benefit schemes/ programs	Contract
Directors	Name, address, phone number, email, date of birth, means of identification, marital status, height, weight.	To meet statutory requirement for appointment of directors	Legal Obligation
		To store and manage director records internally	Legal Obligation
		To fulfill public disclosure obligations under company law	Legal Obligation
Website Visitors	Name, Phone number, email address, country product/ service selection, message content	To respond to inquiries made via web forms and fulfill service requests under a customer contract	Legitimate interest
Website Visitors	Session ID, cookies, IP address, browser information, Location, Device Type	To optimize website performance, analytics, marketing, and personalization	Consent
Visitors	Name, phone number, address, purpose of visit, time in and out, signature	To properly manage visitor access and issue visitor tags. To maintain a record of visits and for compliance	Legitimate Interest
Voice Data Subjects	Call Audio	Quality assurance and record maintenance.	Legitimate interest
CCTV Surveillance Subjects	Physical appearance of individuals captured on video footage	This monitoring is conducted in the public interest to ensure a secure environment	Legitimate interest

Retention of Data

ISL only retains personal data for as long as necessary under applicable regulations. We may also retain personal data for the defence of a legal claim. The length of time your personal data is stored depends on the purpose of data processing, with the data being retained only as long as reasonably required by law or best practice. We collect and store personal data to serve you or respond to legitimate inquiries about our transactions with you, taking this responsibility very seriously to ensure your privacy as guaranteed under the Constitution of the Federal Republic of Nigeria and international human rights laws.

Your Rights

You have the right to access any Personal Data that we process about you and to request information about:

What personal data we hold about you
The purposes of the processing
The categories of personal data concerned
The recipients of your personal data or who it will be disclosed to
How long we intend to store your personal data for
The source of data if we did not collect the data directly from you

If you believe that we hold any incomplete or inaccurate data about you, you have the right to ask us to correct and/or complete the information and we will strive to correct it as quickly as possible; unless there is a valid reason for not doing so, at which point you will be notified.

In some circumstances, you also have a right to request a portable extract of your personal data, which will allow you to reuse your personal data for your own purposes. You also have a right to lodge a complaint to the data protection supervisory authority (Nigeria Data Protection Commission).

You also have the right to request the erasure of your personal data or to restrict processing (where applicable) in accordance with the data protection laws; as well as to object to certain processing operations we conduct; and not to be subject to any automated decision-making we may use.

If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the request. This is to ensure that your data is protected and kept secure.

Sharing and Disclosing Your Personal Data

We do not share or disclose any of your personal data without your consent, other than for the purposes specified in this notice and or where there is a legal requirement; other than these your consent will be requested for. We use data processors [a third-party/third parties] to provide some services and business functions. However, all data processors acting on our behalf are required to only process your data in accordance with instructions from us and comply fully with this privacy notice, the data protection laws and any other appropriate confidentiality and security measures.

Law enforcement

Under certain circumstances, we may be required to disclose your Personal Data if required to do so by Law or in response to valid requests by public authorities (e.g. a court or a government agency).

Our Subsidiaries

We may share the information about you and your dealings with us, to the extent permitted by law, with our Group including:

Custodian Investment Plc
Custodian Life Assurance Limited
Custodian Trustees Limited
Custodian and Allied Insurance Limited
CrusaderSterling Pensions Limited
UPDC Plc
Festival Hotel

Third Party Services

We may use third-party services on our website or applications. These services may collect, and process personal information on our behalf. We ensure that these third-party services are reputable and comply with applicable data protection laws.

Central Securities Clearing System
Car Tracking Service Companies
Digital Lifestyle Service Companies
External Auditors

Protecting and Safeguarding Your Information

We take your privacy seriously and take every reasonable measure and precaution to protect and secure your personal data. Our Company securely stores your data in very secure databases in our data center (on-premises and cloud) protected by perimeter firewalls and intrusion detection devices. We work hard to protect you and your information from unauthorised access, alteration, disclosure, or destruction and have implemented security controls at several layers of our IT infrastructure, including but not limited to network security, encryption, restricted access, firewalls, anti-virus/malware, and other forms of security to ensure that your data is protected.

We require all parties, including our staff and third parties processing data on our behalf, to comply with relevant policies and guidelines to ensure the confidentiality and protection of information in use, during storage, and during transmission. Our security controls and processes are regularly updated to meet and exceed industry standards.

Children or Minors

ISL’s services are not directed at children or minors under the age of 18, and the Company does not knowingly collect personal information from them. In the event that a child has provided us with personal information without the consent of a parent or guardian, the parent or guardian may contact ISL by sending an email to Gregory.okonofua@interstatesecurities.com Where required, we may request consent from the parents or guardians before providing services to children.

Transfers Outside Nigeria

ISL puts in place safeguards to ensure that the recipient adequately protects the personal data. With respect to the transfer of personal data from Nigeria to outside the country, ISL will not transfer, or permit your personal data to be transferred to another country unless the recipient country is subject to a law, binding corporate rules, contractual clauses, code of conduct, or certification mechanism that affords an adequate level of protection with respect to the personal data in accordance with the Nigeria Data Protection Act. Where permitted, and as applicable, we will rely on the individual’s consent.

For more information about specific transfer mechanisms, including information on existing safeguards implemented by ISL, please contact us at info@interstatesecurities.com.

Legitimate Interests

As noted in the ‘Information we collect and how it is used’ section of this notice, we occasionally process your Personal Data under the ‘legitimate interests’ basis. Where this is the case, we will conduct a thorough Legitimate Interests’ Assessment (LIA) to ensure that we have weighed your interests and any risk posed to you against our own interests, ensuring that they are proportionate and appropriate.

Where you have consented to us using your details for direct marketing, we will keep such data until you notify us otherwise and/or withdraw your consent.

Sensitive Data

Owing to our Legal/Regulatory obligations, ISL sometimes needs to process sensitive Personal Data (known as sensitive data) about you, to uniquely identify/ distinguish you and sometimes for regulatory reasons. Where we collect such information, we will only request and process the minimum necessary for the specified purpose and identify a compliant legal basis for doing so.

Where we rely on your consent for processing sensitive data, we will obtain your explicit consent through a signature/explicit mechanism. You can modify or withdraw consent at any time, which we will act on immediately unless there is a legitimate or legal reason for not doing so.

Links to Other Websites

Our website may contain links to other sites that are not operated by us. When you click on such links, you will be directed to that third party’s site.

We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

We will let you know via email and/or a prominent notice on our service, prior to the change becoming effective.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.