Privacy Policy

Thank you for choosing to be part of our community at Toplorgical Nigeria Limited ("company", "we", "us", or "our"), the team behind CoopOS. We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about our policy, or our practices with regards to your personal information, please contact us at dataprotection@toplorgical.com.

When you visit CoopOS (www.coopos.app) and use our cooperative management platform, you trust us with your personal information. We take your privacy very seriously. In this privacy notice, we describe our privacy policy and seek to explain to you in the clearest way possible what information we collect, how we use it and what rights you have in relation to it. We hope you take some time to read through it carefully, as it is important.

If there are any terms in this privacy policy that you do not agree with, please discontinue use of our site and our services.

This privacy policy applies to all information collected through our platform (www.coopos.app and related subdomains), and/or any related services, sales, marketing or events (referred to collectively as the "Services").

We collect personal information that you provide directly to us in the following circumstances:

When You Register for CoopOS:

• Full name
• Phone number
• Email address
• Cooperative or organization name
• Role and designation within the cooperative

For Recruitment and Job Applications:

• Curriculum Vitae (CV)
• Home address
• Guarantor information (name and address)
• Passport photograph
• Educational and professional qualifications
• References

Automatically Collected Information:

• Derivative Data: Information our servers automatically collect when you access the platform, such as your IP address, browser type, operating system, referring URLs, device identifiers, and access times.
• Financial Data: When you subscribe to our plans or process transactions, we may collect payment method details. Full card numbers are never stored — we use PCI-DSS compliant payment processors.
• Cooperative Transaction Data: Loan records, savings contributions, member ledger entries, and governance votes entered or generated during platform use.
• Usage Data: Features accessed, pages visited, session duration, and interaction patterns within the CoopOS dashboard.

We use personal information collected for a variety of business purposes described below. We process your personal information for these purposes in reliance on our legitimate business interests ("Business Purposes"), in order to enter into or perform a contract with you ("Contractual"), with your consent ("Consent"), and/or for compliance with our legal obligations ("Legal Reasons").

We use the information we collect or receive to:

• Create and Manage Your Account [Contractual]: Set up your cooperative workspace, manage member profiles, assign roles, and provision access controls.
• Process Cooperative Transactions [Contractual]: Record savings contributions, process loan applications, manage repayments, and generate financial statements and audit trails.
• Send Marketing and Promotional Communications [Business Purposes / Consent]: We and/or our third-party marketing partners may use your personal information for marketing purposes, if this is in accordance with your marketing preferences. You can opt-out of our marketing emails at any time.
• Send Administrative Information [Business Purposes / Legal Reasons]: We may use your personal information to send you product, service, and new feature information, and/or information about changes to our terms, conditions, and policies.
• Fulfill and Manage Your Onboarding/Engagement [Contractual]: We may use your information to provide you with a service.
• Respond to Legal Requests and Prevent Harm [Legal Reasons]: If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.
• Improve Our Platform [Business Purposes]: Data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns, and evaluating and improving our platform, products, services, marketing, and your experience.
• Customer Support [Business Purposes]: Respond to inquiries, resolve disputes, troubleshoot problems, and enforce our agreements.

We only share and disclose your information in the following situations:

• Compliance with Laws: We may disclose your information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process, such as in response to a court order or a subpoena (including in response to public authorities to meet national security or law enforcement requirements).
• Vital Interests and Legal Rights: We may disclose your information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person and illegal activities, or as evidence in litigation in which we are involved.
• Vendors, Consultants and Other Third-Party Service Providers: We may share your data with third party vendors, service providers, contractors or agents who perform services for us or on our behalf and require access to such information to do that work. Examples include: payment processing, data analysis, email delivery, hosting services, customer service and marketing efforts. Unless described in this Policy, we do not share, sell, rent or trade any of your information with third parties for their promotional purposes.
• Affiliates: We may share your information with our affiliates, in which case we will require those affiliates to honor this privacy policy. Affiliates include any subsidiaries, joint venture partners or other companies that we control or that are under common control with us.
• With your Consent: We may disclose your personal information for any other purpose with your consent.

Our data retention periods are based on business needs and legal requirements. We store the information we collect about you for as long as is necessary for the purposes for which we originally collected it, or as needed to provide the products or services to you unless a longer retention period is required or permitted by applicable law.

You may request that we delete your information but note that we may retain certain information as reasonably needed to comply with the law, meet regulatory requirements, or for legitimate purposes. We may also retain cached or archived copies of information about you for a certain period.

We protect personal information through technical measures including:

• Encryption of data in transit (TLS 1.2/1.3) and at rest (AES-256)
• Access controls based on the principle of least privilege
• Multi-factor authentication
• Regular vulnerability assessments

Organizationally, we enforce data protection policies, conduct staff awareness training, and maintain an incident response procedure. However, please also remember that we cannot guarantee that the internet itself is 100% secure. Although we will do our best to protect your personal information, transmission of personal information to and from our platform is at your own risk. You should only access the services within a secure environment.

You have the following rights in relation to your personal data held by us:

• Right of Access: You have the right to request a copy of the information that we hold about you.
• Right of Rectification: You have a right to correct data that we hold about you that is inaccurate or incomplete.
• Right to be Forgotten: In certain circumstances you can ask for the data we hold about you to be erased from our records.
• Right to Restriction of Processing: Where certain conditions apply you have a right to restrict the processing of your data.
• Right of Portability: You have the right to have the data we hold about you transferred to another organisation.
• Right to Object: You have the right to object to certain types of processing such as direct marketing.
• Right to Object to Automated Processing (including profiling): You also have the right to be subject to the legal effects of automated processing or profiling.

To exercise any of the above rights, please contact our Data Protection team at dataprotection@toplorgical.com. We will respond to your request within 30 days.

We use cookies, web beacons, tracking pixels, and other tracking technologies to help customize the platform and improve your experience. For full details, please review our dedicated Cookie Policy.

In summary, we use the following types of cookies:

• Essential Cookies: Required for the platform to function correctly, including authentication sessions and audit trail integrity.
• Analytics Cookies: Help us understand how users navigate CoopOS so we can improve features.
• Preference Cookies: Remember your settings, theme, and display preferences.
• Marketing Cookies: Used to deliver relevant promotional content and measure campaign effectiveness.

CoopOS is not intended for use by children under the age of 16. We do not knowingly collect personal information from children under 16 years of age. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at dataprotection@toplorgical.com so that we can take appropriate action.

Toplorgical Nigeria Limited operates primarily in Nigeria and processes data within the country. However, some of our third-party service providers may be located outside Nigeria. When we transfer personal data internationally, we ensure appropriate safeguards are in place, consistent with applicable data protection laws including the Nigeria Data Protection Act (NDPA).

We strive to ensure that your data is processed with the same level of protection as described in this policy, regardless of where processing takes place.

We may update this privacy policy from time to time. The updated version will be indicated by an updated "Revised" date and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy policy, we will notify you either by prominently posting a notice of such changes or by directly sending you a notification.

We encourage you to review this privacy policy frequently to be informed of how we are protecting your information.

If you have any questions or comments about this Privacy Policy, or if you wish to exercise your data rights, please contact us using the details below: