Internal Privacy Policy

Introduction

This internal privacy policy details how Interstate Securities Limited (ISL) collects, uses, and discloses the personal data of employees, directors, and interns.

It is upheld in accordance with the Nigeria Data Protection Act (NDP Act), 2023, and other applicable data privacy laws and regulations. This policy describes the organization’s practices for safeguarding personal data.

Who We Are

Interstate Securities Limited is registered by the Securities & Exchange Commission as a Broker/Dealer and an Issuing House. It commenced business as a dealing member of the Nigerian Exchange Limited in March 1985 with registration number RC:69487 and a principal place of business at 14B, Keffi Street, South West Ikoyi, Lagos.

At ISL, we provide tailored services that include Corporate Finance, Brokerage Services, Advisory Services, Asset Tracking, and Dividend Recovery. Consequently, we treat your personal data with the utmost privacy and confidentiality.

We function as the Data Controller when processing your personal data. Our designated Data Protection Officer can be contacted via email at gregory.okonofua@interstatesecurities.com.

Individuals to whom this Privacy Policy is addressed

This policy is addressed to existing and former employees, including third-party consultants, Directors, and interns during and after employment with ISL.

Information that we collect and how it is used

We process your personal data to meet our contractual obligations and provide you with medical and other related benefits. We collect only necessary personal data and process it as specified in this notice. We take your privacy seriously and will not disclose, share, or sell your data without your consent, unless required by law.

Data Subjects	Personal Data Processed	Processing Activity/Purpose	Lawful Basis for Processing
Employees	Name, address, phone number, email, date of birth, state of origin, educational background, marital status, children’s details, dependent details, health benefit enrollment information, employee ID, bank details, role, training history, pension enrollment details, performance metrics, benefit entitlements, beneficiary details, medical data, employment history, reference contacts, pension information, Tax ID.	Employee onboarding, Payroll processing	Performance of contract
		Health care management, Performance appraisals, Learning and development, Workforce planning and strategy, ID Card issuance, Administration, and record-keeping	Performance of contract
		Pension Payments, Tax remittance	Legal Obligation
		Security logging and monitoring of applications and workstations.	Legitimate interest
Interns	Name, phone number, email, home address, educational background, account number,	Employee onboarding, Payroll processing	Performance of contract
		Workforce planning and strategy, ID Card issuance, Administration, and record-keeping	Legitimate Interest
		Security logging and monitoring of applications and workstations	Legitimate Interest
Directors	Name, address, phone number, email, date of birth, means of identification, marital status.	To meet statutory requirement for appointment of directors	Legal Obligation
		To store and manage director records internally	Performance of contract
		To fulfill public disclosure obligations under company law	Legal Obligation

Lawful Bases for Processing

As highlighted in the table above, we may process your personal data based on one of the six lawful bases:

Contract: We process your personal data to fulfil contractual obligations
Legitimate interest: We may process your personal data to fulfil the legitimate interests pursued by ISL
Vital Interest: We may process your personal data to protect your vital interests during medical emergencies.
Public Interest: We may process your personal data to perform a task carried out in the interest of the public.
Legal Obligation: We may process your personal data to comply with a legal or regulatory requirement.

Data Retention
ISL only retains personal data for as long as necessary under applicable regulations. We may also retain personal data for the defence of a legal claim. The length of time your personal data is stored depends on the purpose of data processing, with the data being retained only as long as reasonably required by law or best practice.

Your Rights
Right to access/request a copy of your information: You have the right to access personal data that we process about you and to request information about:

What personal data we hold about you
The purposes of the processing
The categories of personal data concerned
The recipients of your personal data or who it will be disclosed to
How long we intend to store your personal data for
The source of data if we did not collect the data directly from you

Right to rectification: If you believe that we hold any incomplete or inaccurate data about you, you have the right to ask us to correct and/or complete the information and we will strive to correct it as quickly as possible; unless there is a valid reason for not doing so, at which point you will be notified.

Right to data portability: In some circumstances, you also have a right to request a portable machine-readable format of your personal data, and for it to be transmitted directly to another controller, where feasible.

Right to withdraw consent: You have the right to withdraw your consent to the processing of your personal data. Where you have consented to us using your details for direct marketing, we will keep such data until you notify us otherwise and/or withdraw your consent.

Right to lodge a complaint with supervisory authority: You have a right to lodge a complaint to the data protection supervisory authority, the Nigeria Data Protection Commission (NDPC).

Right to erasure: Under certain circumstances, you may request for the erasure of your personal data from our systems. For instance, if you have withdrawn consent to processing or if the personal data is no longer required to fulfil the purpose for which it was collected.

Right to restrict processing: You have the right to request for processing to be restricted (where applicable) in accordance with the data protection laws; as well as to object to certain processing operations we conduct; and not to be subject to any automated decision-making we may use.

If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the request. This is to ensure that your data is protected and kept secure.

Sharing and Disclosing Your Personal Data
We do not share or disclose any of your personal data other than for the purposes specified in this notice and where there is a legal requirement; other than these your consent will be requested for. We may use data processors [a third-party/third parties] to provide some services and business functions; however, all data processors acting on our behalf are required to only process your data in accordance with instructions from us and comply fully with this privacy notice, the data protection laws and with appropriate confidentiality and security measures.

Law Enforcement

Under certain circumstances, we may be required to disclose your personal data if required to do so by law, or in response to valid requests by public authorities (e.g., a court or a government agency).

Third Party Services
We may use third-party services on our applications. These services may collect, and process personal information on our behalf. We ensure that these third-party services are reputable and comply with applicable data protection laws. In addition, we may share your information with our contracted service providers including:

HR Management Service Providers
CSCS, NGX.

Protecting and Safeguarding Your Information

We take your privacy seriously and take every reasonable measure and precaution to protect and secure your personal data. We work hard to protect you and your information from unauthorised access, alteration, disclosure, or destruction and have implemented security controls at several layers of our IT infrastructure, including but not limited to network security, encryption, restricted access, firewalls, anti-virus/malware, and other forms of security to ensure that your data is protected.

We require all parties, including employees and third parties processing data on our behalf, to comply with relevant policies and guidelines to ensure the confidentiality and protection of information in use, during storage, and during transmission. Our security controls and processes are regularly updated to meet and exceed industry standards.

Transfers Outside Nigeria

ISL puts in place safeguards to ensure that the recipient adequately protects the personal data. With respect to the transfer of personal data from Nigeria to outside the country, ISL will not transfer, or permit your personal data to be transferred to another country unless the recipient country is subject to a law, binding corporate rules, contractual clauses, code of conduct, or certification mechanism that affords an adequate level of protection with respect to the personal data in accordance with the Nigeria Data Protection Act. Where permitted, and as applicable, we will rely on the individual’s consent.

For more information about specific transfer mechanisms, including information on existing safeguards implemented by ISL, please contact us at gregory.okonofua@interstatesecurities.com

Legitimate Interests
As noted in the ‘Information we collect and how it is used’ section of this notice, we may occasionally process your personal data on the basis of fulfilling our ‘legitimate interests’. Where this is the case, we will conduct a thorough Legitimate Interests’ Assessment (LIA) to ensure that we have weighed your interests and any risk posed to you against our own interests, ensuring that they are proportionate and appropriate.

Sensitive Personal Data

Owing to our Legal/Regulatory obligations, ISL sometimes needs to process sensitive personal data about you, to uniquely identify/ distinguish you and sometimes for regulatory reasons. Where we collect such information, we will only request and process the minimum personal data necessary for the specified purpose and identify a compliant legal basis for doing so.

Where we rely on your consent for processing sensitive data, we will obtain your explicit consent through a signature/explicit mechanism. You can modify or withdraw consent at any time, which we will act on immediately unless there is a legitimate or legal reason for not doing so.

Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes either by email or by posting the new Privacy Policy on this page

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted.

Contact Us

If you have any questions about this Privacy Policy, you can contact the Data Protection Officer: