CBI PRIME PRIVACY POLICY
CBI Prime | Plot 1, Emperor Baywood Close, Anthony Village, Lagos, Nigeria
Last Updated : 8 October 2026
This Privacy Policy explains how CBI Prime ("we", "us" or "our") collects, uses, shares,
protects and otherwise processes personal data when individuals access or use CBI
Prime, including CBI Prime View, CBI Prime 4U, our websites, mobile applications,
creator tools, streaming services, user-generated-content features, payment-enabled
features and related services (together, the "Services").It is designed for CBI Prime as a
streaming and creator economy platform. It should be read together with the CBI Prime
Terms of Use, UGC/Creator Terms, Community Guidelines and the relevant in-app
notices and consent prompts.
1. Who We Are
CBI Prime is the data controller responsible for determining the purposes for which, and
the manner in which, personal data is processed in connection with the Services
described in this Policy. This responsibility covers personal data collected or generated
when individuals register for or manage an account; browse, search for, stream,
download, purchase or otherwise engage with content; use creator, community,
messaging or user-generated-content features; subscribe, make payments or receive
creator earnings; interact with advertising or recommendations; contact customer
support; participate in promotions; or otherwise communicate or transact with CBI
Prime.
As data controller, CBI Prime is responsible for establishing an appropriate lawful basis
for processing, providing transparent information, respecting applicable data-subject
rights, maintaining proportionate security and governance measures, and ensuring that
personal data is processed lawfully, fairly and only for specified and legitimate purposes.
law
Our registered and business address is Plot 1, Emperor Baywood Close, Anthony Village,
Lagos, Nigeria. CBI Prime is the primary point of contact for questions about this Policy,
concerns about our handling of personal data, and requests to exercise applicable
dataprotection rights. Such communications may be submi\ed using the contact details
set out in Section 18. To protect users and prevent unauthorised disclosure, we may
request information reasonably necessary to verify the identity of a requester, confirm
the scope of a request, or establish the authority of a person acting on behalf of anotherCBI Prime Privacy Policy
individual. Any verification information will be used only for the purpose of
authenticating and responding to the request, subject to applicable law.
This Policy is intended to operate in accordance with applicable Nigerian dataprotection
and privacy law, including the Nigeria Data Protection Act 2023 (NDPA), together with
applicable regulations, directives, codes, implementation frameworks and guidance
issued by the Nigeria Data Protection Commission (NDPC). In this Policy, references to
“applicable law” also include any other binding privacy, electronic-communications,
cybersecurity, consumer-protection, financial-services, intellectual-property or
sectorspecific requirements that apply to a particular feature or processing activity.
Where a legal requirement, regulatory direction or feature-specific notice imposes a
higher or more specific standard than this general Policy, CBI Prime will apply that
standard to the relevant processing.
Certain processing connected with CBI Prime may also involve another organisation that
determines, independently or jointly with CBI Prime, why and how personal data is
processed. Depending on the feature or transaction, this may include a payment-service
provider, bank, app store, social-login provider, telecommunications or
identityverification provider, advertiser, analytics provider, content licensor, creator,
distribution partner or other third party.
An organisation acting independently will be responsible for its own processing and
should provide its own privacy information. Where CBI Prime and another organisation
jointly determine the purposes and means of processing, the parties will allocate their
respective data-protection responsibilities as required by applicable law and make the
substance of that arrangement available where necessary. A separate or just-in-time
notice may therefore identify another controller, explain the relevant data flow, or
provide choices that apply only to a specific feature.
Such a notice supplements this Policy and, to the extent of any inconsistency concerning
that specific processing activity, the more specific notice will apply.
2. Personal Data We Collect
Depending on how you access or use CBI Prime, the features you choose, the
permissions you grant and the transactions you undertake, we may collect, generate or
receive the following categories of personal data. We do not necessarily collect every
category from every user.
Account and identity information, such as your name, username, date of birth or age
information, profile photograph, account identifiers, preferred language and other
details you provide when registering for, completing or managing an account.CBI Prime Privacy Policy
Contact information, such as your email address, telephone number, postal or residential
address and communication preferences, where you provide them to us.
Authentication and security information, including passwords stored in protected form,
login records, verification codes, security questions, account-recovery information and
information used to authenticate you, protect your account or investigate suspicious
activity.
Payment and transaction information, including details of subscriptions, rentals,
purchases, pay-per-view transactions, refunds, creator earnings, payouts, transaction
references, billing status and related records. Full card or bank account details may be
collected and processed directly by authorised payment service providers rather than
stored by CBI Prime, although we may receive limited payment-confirmation or account
information from them.
Content and creator information, including videos, images, audio, captions, descriptions,
comments, messages, livestream interactions, drafts, upload details, creator-profile
information and other user-generated content or metadata you choose to submit,
publish or make available through the Services.
Usage and viewing information, including content viewed, searched for, downloaded,
liked, followed, shared or otherwise engaged with; watch and search history; viewing
duration and playback activity; subscriptions; creator and community interactions; saved
preferences; and responses to recommendations or advertising.
Device and technical information, such as device type and model, operating system,
browser type, app version, IP address, device or advertising identifiers, language and
time-zone settings, network and mobile-carrier information, cookie or SDK identifiers,
crash reports, access logs and diagnostic data.
Location information, which may include an approximate location derived from an IP
address or network information, and precise device location where it is required for a
particular feature, content-rights restriction or security purpose and you have permitted
location access through your device.
Camera, microphone, image, video and voice information, when you choose to record,
upload, livestream, communicate or use another feature that requires access to those
functions. Access will depend on the permissions you grant through your device or
operating system.
Advertising, audience and analytics information, including identifiers, inferred interests,
campaign interactions, attribution data, audience segments and performance
measurements used to understand how the Services are used and, where legally
permitted, to select, deliver, personalise or measure advertising.
Information obtained from third parties, such as payment providers, app stores,
distribution partners, telecommunications providers, identity-verification or
fraud prevention providers, advertisers, analytics providers, content licensors and
social login providers. Where you choose a third-party login or integration, we may
receive information permitted by your settings and the third party’s applicable terms
and privacy notice.
3. How We Collect Personal Data
Directly from you when you create or update an account, subscribe to or purchase a
service, complete a transaction, upload or publish content, communicate with other
users, contact customer support, enter a promotion or survey, verify your identity, or
select and change your account, privacy, marketing or device preferences.
Automatically through the Services when you browse, search, stream, download or
otherwise interact with CBI Prime. We may collect this information through cookies,
software development kits (SDKs), pixels, local storage, server logs and similar
technologies, including information about your device, network, app or browser, viewing
and engagement activity, approximate location, diagnostics and interactions with
recommendations or advertising.
From third parties and integration partners, where permitted by applicable law and
consistent with your instructions, permissions and the relevant third party’s terms.
These sources may include payment providers, app stores, social-login services,
identity verification and fraud-prevention providers, telecommunications or distribution
partners, analytics and advertising providers, content licensors and other parties that
help us provide, secure, measure or improve the Services.
4. Purposes and Lawful Bases for Processing
We process personal data only where we have identified an appropriate lawful basis
under applicable law. Depending on the nature and context of the processing, we may
rely on:
• performance of a contract, where processing is necessary to provide a requested
Service, administer an account or complete a transaction;
• consent, where you have made a specific, informed and freely given choice that
may be withdrawn;
• compliance with a legal obligation, where Nigerian or other applicable law
requires us to retain, use or disclose information;
• protection of vital interests, where processing is necessary to protect a person’s
life or physical safety;
• performance of a task carried out in the public interest, where that basis is
legally available;
• or our legitimate interests, or those of a third party, where the processing is
necessary and proportionate and those interests are not overridden by your
rights, freedoms or reasonable expectations.
Where we rely on legitimate interests, we consider the purpose, necessity and likely
impact of the processing and apply appropriate safeguards. The lawful basis may
differ according to the feature used, the type of personal data involved and the
relationship between you and CBI Prime.
We may process personal data to:
Create and administer accounts: register users and creators, verify login credentials or
identity where required, maintain profiles and preferences, support account recovery,
manage permissions, prevent duplicate or fraudulent accounts and protect account
security.
Provide and operate the Services: deliver streaming, search, recommendations,
downloads, creator and user-generated-content tools, community features,
subscriptions, rentals, purchases, pay-per-view offerings, advertising-supported
experiences and other CBI Prime functionality, including troubleshooting and customer
support.
Administer payments and commercial relationships: process and confirm subscriptions,
rentals, purchases and other transactions; calculate and facilitate creator earnings and
payouts; manage billing status, refunds, charge backs and payment disputes; reconcile
accounts; and retain tax, accounting and financial records required for business or legal
purposes.
Personalize content and user experience: remember settings, adapt interfaces, organise
feeds and recommend content, creators, communities or features by reference to
activity, viewing history, engagement and expressed preferences, subject to applicable
law and the controls made available to you.
Promote trust, safety and compliance: review or moderate content and community
interactions; receive and investigate reports, complaints and appeals; apply age, access
or content restrictions; enforce our terms, policies and intellectual-property rules; and
protect users, creators, CBI Prime and third parties from abuse or harm.
Protect the Services and prevent unlawful conduct: detect, investigate, prevent and
respond to fraud, piracy, payment abuse, credential misuse, unauthorised access,
malware, security incidents, manipulation of platform metrics and other conduct that
may threaten the Services, users, creators or third parties.
Measure, research and improve the Services: analyse technical performance, viewing
patterns, audience engagement, service quality, feature usage, errors and customer
feedback; conduct testing and research; produce statistical or aggregated insights; and
design, develop or evaluate new and existing features.
Communicate with you: send account, transaction, security, policy, service availability
and support messages; respond to enquiries; request feedback; and, where permitted
by law or based on your choices, send news, offers, promotions and other marketing
communications through appropriate channels.
Deliver and measure advertising: select, display, limit and measure advertisements;
assess campaign reach, frequency, attribution and effectiveness; prevent advertising
fraud; and provide advertisers, creators, content partners or measurement providers
with aggregated or appropriately de-identified audience and performance insights,
where applicable and subject to available consent or preference controls.
Meet legal and regulatory responsibilities: comply with applicable data protection,
consumer-protection, communications, tax, accounting and financial record
requirements; respond to lawful requests, court orders or regulatory inquiries; establish,
exercise or defend legal claims; cooperate with competent authorities; and manage
audits, investigations, complaints and dispute-resolution processes.
5. User-Generated Content and Public Information
CBI Prime 4U enables users and creators to create, upload, publish, livestream, share
and interact with content and with one another. Depending on the feature used and the
privacy or audience settings selected, information you deliberately make public may
include your profile photograph and biography, username or creator name, videos,
images, audio, livestreams, captions, comments, reactions, likes, follower and following
information, view or engagement counts, tags, mentions and other public posts or
interactions
Public information may be visible to registered users and, in some cases, to persons who
are not signed in; it may also appear in searches, recommendations, feeds, promotional
placements or other areas of the Services.
Content or information made public may be copied, downloaded, recorded, captured by
screenshot, embedded, quoted, translated, indexed, linked to, reshared or otherwise
used by other users or third parties, subject to applicable law and our terms.
Such activity may occur outside CBI Prime and may continue even after you edit or
delete the original content, particularly where another person has already copied or
shared it. CBI Prime cannot control every use made of information that you choose to
disclose publicly. You should therefore review any available audience and privacy
settings and carefully consider the nature of the information, location details,
documents, images or recordings you publish before making them available.
You must not upload or publish personal data relating to another individual unless you
have an appropriate lawful basis and have obtained any consent, authorisation or other
permission required by applicable law. This applies particularly to private
communications, contact or location information, financial or identity documents,
information about children, and sensitive personal data. Where your content depicts,
names or otherwise identifies another person, you are responsible for ensuring that
your collection and disclosure of that person’s information is lawful and consistent with
our terms. You should not post information that infringes another person’s privacy,
confidentiality, intellectual-property or other legal rights.
We may review, restrict, label, disable access to or remove user-generated content,
suspend relevant features or accounts, and investigate reports where reasonably
necessary to enforce our terms and Community Guidelines, protect users or third
parties, comply with law, or address alleged privacy, safety or intellectual-property
violations. However, moderation does not mean that we endorse user-generated
content or can identify every unlawful, inaccurate or inappropriate disclosure. If you
believe content posted through CBI Prime improperly includes your personal data or
violates your rights, you may report it through the available in-service tools or contact us
using the details in Section 18.
6. Children and Young People
CBI Prime is intended to be used only by persons who are legally able to use the relevant
Service or who do so with any consent, supervision or authorisation required from a
parent, guardian or other person with parental responsibility. We do not intend to
permit a child to provide legally effective consent where applicable law requires that
consent or authorisation be given or approved by a parent or guardian. The age at which
a person may consent independently may vary according to applicable law, the type of
processing involved and the country from which the Services are accessed.
Where we know, or reasonably ought to know, that personal data relates to a child or
young person, we will apply safeguards appropriate to the individual’s age, maturity and
the nature and risk of the processing. These safeguards may include presenting privacy
information in clear and age-appropriate language; limiting collection to information
reasonably necessary for the relevant feature; applying more protective privacy or
audience settings by default where appropriate; restricting direct marketing, profiling,
personalized advertising, public visibility, messaging, livestreaming, payments or
location-based features; and involving a parent or guardian where required by law.
We may request age information or use proportionate age-assurance measures to
determine whether a user meets an applicable age requirement, to provide an
age appropriate experience or to identify when parental or guardian involvement is
required. Any age-assurance process will be designed to use no more personal data than
reasonably necessary for the relevant purpose. We may deny registration, restrict access
to particular features or content, place an account into an age appropriate experience,
request further verification or suspend an account where the applicable age
requirement cannot be confirmed.
Parents and guardians should supervise children’s use of internet-enabled services, help
them understand the consequences of publishing information, and review available
account, privacy, communication and device-permission settings. Children and young
people should not disclose unnecessary personal information publicly, including their
home or school address, telephone number, precise location, identity documents,
financial information or another person’s private information.
If we learn that a child’s personal data has been collected, disclosed or otherwise
processed in a manner inconsistent with this Policy or applicable law, we will take
reasonable steps to investigate and, where appropriate, restrict the relevant account or
feature, obtain any required parental or guardian authorisation, or delete or anonymise
the information, subject to any lawful requirement or permitted reason to retain it.
A parent, guardian or other concerned person who believes that a child has provided
personal data without the required authorisation, has made personal information public
inappropriately, or is using an age-restricted feature should contact us using the details
in Section 18. To protect the child and the account, we may request information
reasonably necessary to verify the requester’s identity, relationship to the child and
authority to act.
7. Sensitive Personal Data
Certain information may be treated as sensitive personal data under applicable law,
including information concerning health, biometric or genetic characteristics, religious or
philosophical beliefs, political opinions, trade-union membership, ethnicity, sexual life or
orientation, and other categories designated as sensitive by law. We do not require users
to provide such information unless it is reasonably necessary for a specific feature, legal
requirement, safety measure or other clearly identified purpose. We will process
sensitive personal data only where an applicable lawful condition permits it, such as
explicit consent where valid, compliance with a legal obligation, protection of vital
interests, establishment or defence of legal claims, or another condition recognised by
applicable law.
Where we process sensitive personal data, we will apply safeguards appropriate to the
nature, purpose and risk of the processing. These may include limiting collection and
access, using enhanced security controls, restricting retention, maintaining
confidentiality, carrying out additional risk assessments where appropriate, and sharing
the information only where necessary and lawfully permitted. Users should avoid
uploading or disclosing unnecessary sensitive information in public profiles, videos,
comments, messages, livestreams or community interactions, particularly information
relating to another person. Information deliberately made public may be copied,
reshared or used by others beyond CBI Prime’s control.
8. Cookies, SDKs and Similar Technologies
CBI Prime may use cookies, software development kits (SDKs), pixels, local storage and
similar technologies to operate the Services, remember settings, authenticate users,
protect accounts, measure performance, understand audiences and, where permitted,
personalize or measure advertising. Where consent is required, nonessential
technologies will be used in accordance with the choices presented to you. Available
settings or consent tools may allow you to change relevant preferences.
For these purposes, cookies and similar technologies may include session cookies,
persistent cookies, device identifiers, software development kits, pixels, tags and other
technologies capable of recognising a browser, application, device or account. These
technologies may enable CBI Prime to maintain a user’s session, remember preferences,
understand how features are used, identify technical errors, protect accounts, prevent
fraudulent or unauthorised activity and assess the performance of the Services.
Some cookies and similar technologies may be strictly necessary for the operation,
security and functionality of CBI Prime and may therefore be required for users to access
or use particular features. Other technologies, including those used for analytics,
advertising or personalisation, will be deployed subject to any consent, notice or
preference requirements applicable to that processing.
Where third-party technologies are integrated into CBI Prime, information collected
through those technologies may be processed by the relevant service provider in
accordance with the contractual arrangements governing that service and, where that
provider acts independently of CBI Prime, its applicable privacy notice.
Users may be able to manage cookies and similar technologies through CBI Prime’s
consent-management tools, account settings, browser settings or device settings.
Disabling certain technologies may affect the availability, security, functionality or
performance of particular features of the Services.
8.1 CBI Prime may use cookies, software development kits (SDKs), pixels, tags, local
storage, device identifiers and other similar technologies (collectively, “Tracking
Technologies”) in connection with the Services. These technologies enable CBI Prime
and, where applicable, authorised service providers to recognise a browser, device or
account, maintain sessions, remember settings and preferences, understand how the
Services are used and support the secure and efficient operation of CBI Prime.
8.2 Depending on the Service, device and applicable legal requirements, Tracking
Technologies may be used for purposes including:
(a) strictly necessary functions, such as user authentication, account security, fraud
prevention, maintaining user sessions, load balancing and providing functionality
specifically requested by the user;
(b) functionality and preferences, such as remembering language, viewing,
accessibility, interface and other preferences;
(c) performance and analytics, including measuring traffic, viewing activity,
application performance, crashes, errors, audience engagement and how users navigate
or interact with CBI Prime;
(d) security and fraud prevention, including detecting suspicious access,
unauthorised account activity, malicious behaviour and attempts to interfere with the
Services; and
(e) advertising and measurement, where legally permitted, including measuring
advertisements, frequency, reach, attribution and campaign effectiveness and, where
appropriate and subject to applicable consent requirements, supporting personalised
advertising.
8.3 Where applicable law requires consent before a non-essential Tracking
Technology is used, CBI Prime will seek the user’s consent through an
appropriate cookie banner, consent-management tool, application setting, device
permission or other appropriate mechanism. Users may be given the opportunity
to accept, reject or modify applicable categories of non-essential Tracking
Technologies.
8.4 A user may subsequently change or withdraw a consent or preference
through available CBI Prime settings, browser controls, device settings or any
consent management mechanism made available by CBI Prime. Withdrawal of
consent will not affect the lawfulness of processing undertaken before the
withdrawal.
8.5 Certain Tracking Technologies are required for the security, authentication
or basic operation of the Services. Disabling such technologies may therefore
prevent CBI Prime or particular features from operating properly.
8.6 Where third-party SDKs, analytics technologies, advertising technologies
or similar services are deployed, information generated through those
technologies may also be processed by the relevant third-party provider in
accordance with the contractual arrangements applicable to that provider and,
where it acts independently of CBI Prime, its own privacy notice.
8.7 Further information concerning material Tracking Technologies, their
purposes, relevant providers, duration and available choices may be provided
through a separate Cookie Notice, consent-management interface or other
feature-specific notice.
The following provisions are included pursuant to the platform review directives and
supplement the existing provisions of this Privacy Policy without replacing or amending
them:
a. Platform Identity: CBI Prime operates the consumer-facing platform and
Services.
CBI Prime is responsible for processing personal data in connection with the
platform and Services.
b. OTT and UGC/Creator Data Processing: For clarity, personal data processed
through CBI Prime’s OTT/streaming functionality may include account,
subscription, payment, device, viewing-history, search, recommendation,
content-entitlement and playback information. Personal data processed through
CBI Prime 4U and other UGC/Creator functionality may additionally include
creator profiles, uploaded content and metadata, livestreams, comments,
reports, complaints, moderation and appeal records, account restrictions, creator
earnings, payouts, payment information, transaction records and identity or
tax verification information where required.
c. Creator Economy and Monetisation: Where creator or monetisation features are
used, CBI Prime may process creator-profile information, earnings, payout and
payment information, transaction records and identity or tax-verification
information to administer creator accounts, calculate and facilitate earnings and
payouts, prevent fraud, reconcile transactions and meet applicable legal, tax,
accounting and compliance requirements.
d. UGC, Content Moderation and Trust ti Safety: CBI Prime may collect and process
information generated through content uploads, livestreams, comments, reports,
complaints, moderation actions, appeals, account restrictions and other
trust and-safety or community-enforcement processes. As part of the Community
Guidelines applicable to the UGC section, any X-rated or otherwise inappropriate
content will be taken down. Continued violation will attract deletion of the
relevant account. Moderation and enforcement actions will be undertaken in
accordance with the applicable CBI Prime terms, Community Guidelines and
applicable law.
e. Children, Age-Gating and Parental Consent: CBI Prime may apply feature specific
age gates, age-assurance measures, parental or guardian consent or
authorisation, and restrictions for minors, particularly in relation to CBI Prime 4U,
UGC publication, livestreaming, public interactions, messaging, payments,
creator monetisation, personalised advertising and other higher risk functionality,
where required by applicable law or appropriate to the nature of the feature.
f. Profiling and Automated Processing: Where applicable, CBI Prime may use
personal data in automated systems supporting recommendations, content
ranking, advertising, moderation, fraud prevention and related platform
functions. CBI Prime will provide notices and controls required by applicable law,
including information concerning qualifying automated decision-making and
available rights or review mechanisms.
g. Data Retention and Deletion: CBI Prime will maintain and apply retention
periods or criteria appropriate to major categories of information, including
account information, viewing and search history, UGC and associated metadata,
moderation and enforcement records, creator/payment and transaction records,
and information connected with deleted accounts or content. Applicable periods
may vary according to operational need and legal, accounting, tax,
fraud prevention, dispute, security and regulatory requirements. When personal
data is no longer required, it will be deleted, anonymised or securely disposed of,
subject to lawful retention requirements.
h. Third-Party Processors and International Transfers: CBI Prime will provide
appropriate transparency, through this Policy or a supplementary notice,
regarding material third parties used for payment processing, analytics or
advertising, cloud hosting or content-delivery-network services, identity
verification, social login and other significant processing activities. Where
relevant, such transparency will identify the provider or category of provider, the
processing purpose, relevant storage or access locations and applicable
international-transfer safeguards.
i. User Rights and Privacy Controls: CBI Prime will make available appropriate
methods for users to exercise applicable data-protection rights and to manage
privacy and marketing preferences, device permissions and, where supported or
required, requests for account deletion or deletion of personal data. Requests
will be handled subject to identity verification, lawful retention requirements and
other limitations permitted by applicable law.
9. Advertising, Recommendations and Profiling
We may use information about your viewing, searches, follows, likes, subscriptions,
interactions, device and expressed preferences to organise feeds and recommend
content, creators, communities or features that may be relevant to you. Where legally
permitted, we may also use limited account, device, usage and advertising interaction
information to select, deliver, limit the frequency of, attribute and measure advertising,
including assessing campaign reach and effectiveness. These activities may involve
profiling, meaning the automated analysis of information to infer likely interests or
preferences; however, recommendations and advertising may not always accurately
reflect your interests.
We will apply an appropriate lawful basis and provide any notice, consent request or
preference control required by applicable law. Where processing constitutes direct
marketing, you may object or use available unsubscribe, account, device or consent
settings.
Where a solely automated decision produces legal or similarly significant effects and
applicable law grants corresponding rights, we will provide an appropriate means to
obtain information about the decision, express your views, contest the outcome or
request human review. Withdrawing consent or changing a preference will not affect
processing lawfully carried out before the change and may affect the relevance or
availability of certain personalised features.
10. When We Share Personal Data
We do not sell personal data as a standalone business activity or disclose it to third
parties merely in exchange for monetary payment. We may share personal data only
where reasonably necessary for a specified business, operational or legal purpose, in a
manner consistent with this Policy and subject to applicable law. Depending on the
circumstances, recipients may include:
• Service providers and processors that perform services on our behalf, including cloud
hosting, data storage, content delivery, analytics, customer support, security
monitoring, communications, moderation, payment processing, fraud prevention
and other technical or platform operations. They may access personal data only to
the extent reasonably necessary to provide the relevant service and in accordance
with our instructions and contractual requirements.
• Content and commercial partners, including content licensors, creators, advertisers,
audience-measurement providers and distribution or other commercial partners,
where disclosure is necessary to provide licensed content or creator services,
complete a relevant transaction, attribute activity, measure performance, prevent
fraud, calculate earnings or prepare reports. Where appropriate, we use aggregated,
limited or de-identified information and apply contractual or other safeguards.
• App stores, payment providers and transaction partners where you purchase, rent or
subscribe through them. We may exchange identifiers, transaction references,
subscription status, payment confirmation, refund or charge back information and
other details necessary to authenticate, process, reconcile or support the
transaction. These parties may process payment or account information under their
own terms and privacy notices.
• Professional advisers and assurance providers, including lawyers, accountants,
auditors, consultants, insurers and investigators, where access is reasonably
CBI Prime Privacy Policy
necessary for legal advice, compliance, risk management, insurance, audit, financial
reporting, dispute resolution or the establishment, exercise or defence of legal
claims, subject to professional duties or appropriate confidentiality obligations.
• Courts, regulators, law-enforcement bodies and public authorities where disclosure
is required or permitted by applicable law, regulation, legal process or a valid official
request, or where reasonably necessary to protect rights, safety or security, prevent
or investigate unlawful conduct, or comply with a binding order. Where lawful and
practicable, we assess requests for appropriate authority, scope and proportionality
before disclosing information.
• Parties involved in a corporate transaction, including a prospective or actual buyer,
investor, lender, successor, group company or relevant adviser, in connection with a
proposed or completed merger, acquisition, financing, reorganisation, insolvency,
sale of assets or transfer of all or part of our business. We will limit disclosure to
information reasonably necessary for evaluating or completing the transaction and
apply appropriate confidentiality and data-protection measures.
We seek to limit disclosures to personal data that is relevant and reasonably necessary
for the stated purpose. Where a third party acts as our processor, we require the
processing to be governed by appropriate written terms addressing our instructions,
confidentiality, security, permitted subprocessors, assistance with data-protection
obligations, return or deletion of information and other requirements applicable to the
service. We may review or obtain assurances concerning relevant safeguards where
appropriate. Where a recipient acts as an independent controller, it determines its own
purposes or means of processing and is responsible for complying with applicable law;
its own privacy notice may therefore also apply. Sharing may also involve an
international transfer, in which case the safeguards described in Section 11 will apply
where required.
11. International Transfers
Our service providers, technology infrastructure, content or commercial partners may be
located outside Nigeria. Where personal data is transferred outside Nigeria, we will use a
transfer basis and safeguards permitted by applicable law, including applicable adequacy
mechanisms, contractual safeguards, consent where valid, or another lawful basis for
the transfer.
Before transferring personal data outside Nigeria, CBI Prime will consider the nature of
the personal data, the purpose and circumstances of the transfer, the recipient of the
information and the protections applicable to the transferred data.
Where required by applicable law, appropriate safeguards may include contractual
obligations relating to confidentiality, security, restrictions on further disclosure or
transfer, permitted processing activities and the recipient’s obligations in relation to the
personal data.
Where a service provider or processor transfers personal data on CBI Prime’s behalf or
permits access to such information from another jurisdiction, CBI Prime may require the
provider to apply appropriate contractual, technical and organisational safeguards to the
transferred information and to ensure that any permitted subprocessor is subject to
appropriate data-protection obligations.
CBI Prime may also implement supplementary technical or organisational safeguards
where reasonably necessary, having regard to the nature and risk of the relevant
international processing.
12. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for
which it was collected, including to provide the Services, maintain transaction and
accounting records, resolve disputes, enforce agreements, protect security and comply
with legal or regulatory obligations.
Retention periods may differ according to the type of information, account status,
applicable limitation periods and legal obligations.
When information is no longer required, we will delete, anonymise or otherwise dispose
of it securely, subject to lawful exceptions.
In determining an appropriate retention period, CBI Prime may consider the nature,
volume and sensitivity of the personal data; the purposes for which the information is
processed; whether the purpose can reasonably be achieved by other means; the
duration of the user’s relationship with CBI Prime; security and fraud-prevention
requirements; applicable contractual or statutory limitation periods; and applicable
legal, regulatory, tax, accounting, audit and record-keeping obligations.
Deletion or closure of a CBI Prime account will not necessarily result in the immediate
deletion of all personal data associated with that account. CBI Prime may retain
information where reasonably necessary to comply with a legal or regulatory obligation,
maintain transaction or financial records, prevent or investigate fraud or abuse, resolve a
complaint or dispute, enforce its contractual or legal rights or establish, exercise or
defend legal claims.
Where information is retained solely because of an applicable legal, regulatory, dispute,
investigation or similar requirement, CBI Prime may restrict further processing of that
information to the extent reasonably appropriate for the relevant purpose.
CBI Prime will periodically review retained personal data and, where it is no longer
reasonably required for a lawful purpose, take appropriate steps to delete, anonymise or
securely dispose of it.
13. Data Security
We implement appropriate technical and organisational measures designed to protect
personal data against accidental or unlawful destruction, loss, alteration, unauthorised
disclosure or access. Measures may include access controls, authentication, encryption
where appropriate, monitoring, backup and recovery controls, vendor controls and
security testing. No internet-based service can guarantee absolute security; users must
also protect passwords and account credentials.
CBI Prime’s security measures will be applied having regard to the nature, scope, context
and purpose of the relevant processing and the risks that unauthorised access, use,
alteration, loss or disclosure may present to affected individuals.
Depending on the nature of the systems and information concerned, such measures may
include access and privilege management, authentication controls, encryption where
appropriate, network and application-security controls, system logging and monitoring,
vulnerability management, malware and threat protection, backup and recovery
procedures, incident-response arrangements, confidentiality obligations and controls
governing access by employees, contractors and service providers.
Access to personal data will be limited, where appropriate, to persons who reasonably
require such access for authorised business, operational, legal or technical purposes and
who are subject to appropriate confidentiality and security obligations.
Where a third-party processor or service provider will have access to personal data, CBI
Prime may undertake appropriate due diligence and require relevant contractual
commitments concerning confidentiality, security, incident notification, authorised
processing and compliance with applicable data-protection obligations.
Users are responsible for taking reasonable measures to protect their own accounts,
including keeping passwords, verification codes and other authentication credentials
confidential and promptly notifying CBI Prime where they reasonably suspect
unauthorised access to or use of their account.
14. Personal Data Breaches
We maintain measures for identifying, assessing and responding to personal data
breaches. Where a breach triggers a statutory notification requirement, we will notify
the NDPC and/or affected data subjects in accordance with applicable law, taking
account of the nature and risk of the breach.
CBI Prime’s breach-response process may include reasonable measures to contain the
incident, preserve relevant information, investigate the cause and scope of the breach,
assess its actual or potential consequences, remediate identified vulnerabilities and
reduce the risk of recurrence.
In assessing a personal-data breach, CBI Prime may consider the nature and sensitivity of
the information affected, the categories and number of affected persons where known,
the circumstances of the unauthorised access, disclosure, alteration, loss or destruction,
the likely consequences for affected individuals and any measures taken to mitigate the
resulting risk.
Where notification to affected individuals is required, the notification will, to the extent
required by applicable law, provide relevant information concerning the breach and any
reasonable steps that affected individuals may take to protect themselves.
CBI Prime may maintain internal records of personal-data breaches, associated
assessments, notifications and remedial measures as required by applicable law and its
internal governance procedures.
15. Your Data Protection Rights
Subject to applicable law and any lawful limitations, you may have rights to:
• Be informed about the processing of your personal data.
• Obtain confirmation of processing and access to your personal data.
• Request correction of inaccurate or incomplete personal data.
• Request deletion of personal data in circumstances recognised by law.
• Restrict processing in applicable circumstances.
• Object to certain processing, including applicable direct marketing.
• Withdraw consent at any time where processing is based on consent, without
affecting processing lawfully carried out before withdrawal.
• Request portability of personal data where the legal conditions apply.
• Exercise rights concerning qualifying automated decision-making.
• Lodge a complaint with the Nigeria Data Protection Commission or seek another
remedy available under applicable law.
We may need to verify your identity before actioning a rights request. Where a request
is made on behalf of another person, we may require evidence of authority.
The availability and scope of these rights will depend on the circumstances of the
relevant processing and the requirements of applicable law. A particular right may
therefore not apply in every circumstance.
Where CBI Prime receives a request to exercise a data-protection right, it may request
information reasonably necessary to identify the relevant account or personal data,
verify the identity of the requester and protect personal data from unauthorised
disclosure or alteration.
Where a request is submitted by a representative on behalf of another individual, CBI
Prime may require satisfactory evidence that the representative has authority to act on
that individual’s behalf.
CBI Prime will consider and respond to valid requests within the period prescribed by
applicable law. Where applicable law permits CBI Prime to refuse, restrict or defer a
request, including where information must lawfully be retained or where fulfilling the
request would adversely affect the rights of another person, CBI Prime may apply the
relevant limitation.
Where required by law, CBI Prime will explain the reason why a request has not been
fully granted and provide information regarding any applicable complaint or review
right.
16. Your Choices and Device Permissions
You may be able to manage profile, marketing, notification, privacy and content settings
through CBI Prime or your device. Camera, microphone, photos/media and location
access depend on the permissions you grant through your device or operating system.
Withdrawing a permission may cause the affected feature to stop working.
Depending on the functionality selected by a user, CBI Prime may request access to
device features such as the camera, microphone, photographs, videos, media storage,
location information or notifications. Such access will be used in connection with the
feature for which the permission is requested and subject to applicable law.
Users may generally review, grant, restrict or withdraw these permissions through their
device, browser, operating-system or application settings, where those controls are
available.
Where a device permission is necessary for the operation of a particular feature, refusal
or subsequent withdrawal of that permission may prevent that feature from functioning
properly or may make it unavailable.
Users may also be able to manage marketing communications through account
preferences or by using an unsubscribe mechanism contained in an applicable marketing
communication.
A marketing opt-out will not necessarily prevent CBI Prime from sending non-marketing
communications that are reasonably necessary for account administration, transactions,
security, legal or regulatory compliance, changes to the Services or other essential
service-related matters.
17. Third-Party Services and Links
CBI Prime may contain links to or integrations with third-party websites, apps, payment
services, social networks or other services. Their processing of personal data is governed
by their own terms and privacy notices where they act independently of CBI Prime. We
encourage you to review those notices before providing personal data.
Third-party services may include payment platforms, application stores, social media
platforms, authentication or social-login services and other technologies or services
made available in connection with CBI Prime.
Where a user chooses to interact directly with such a third party, including by making a
payment, using a third-party authentication service, following an external link or
enabling an integration, personal data provided directly to or collected independently by
that third party may be governed by the third party’s own terms, privacy notice and
data-protection responsibilities.
The inclusion of a link or integration with an external service does not alter CBI Prime’s
obligations in respect of personal data for which CBI Prime remains the controller.
Where a third-party processes personal data solely on CBI Prime’s instructions as a
processor rather than as an independent controller, that processing will remain subject
to the applicable contractual and data-protection safeguards governing that service
provider.
19. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes to CBI Prime, our processing
practices, technology, legal requirements or regulatory guidance. Where a change is
material or where applicable law requires notice or renewed consent, we will provide an
appropriate notice through the Services or another suitable channel before or when the
change takes effect. The effective date shown at the beginning of the Policy will identify
the current version.
Changes to this Policy may include amendments resulting from the introduction,
modification or discontinuation of features; changes to the categories of personal data
processed or the purposes for which they are processed; the introduction of new service
providers or technologies; changes to CBI Prime’s operational or security arrangements;
or developments in applicable law or regulatory requirements.
Where practicable and appropriate having regard to the nature of the change, CBI Prime
may communicate a material amendment through CBI Prime, an in-app notification,
email, website notice, account notification or another suitable communication channel.
Where applicable law requires CBI Prime to obtain consent for a new or materially
different processing activity, the amendment of this Privacy Policy alone will not
substitute for the required consent. CBI Prime will obtain the relevant consent before
undertaking the processing where required.
Previous versions of this Policy may be retained where reasonably necessary for legal,
regulatory, compliance, audit or record-keeping purposes.
20. Relationship with Other CBI Prime Documents
This Privacy Policy forms part of the wider CBI Prime legal and compliance framework.
Additional rules may apply under the CBI Prime Terms of Use, UGC/Creator Terms,
Community Guidelines, cookie notice and specific just-in-time or in-app notices and
consents. If a specific notice explains a particular processing activity in greater detail,
that notice should be read together with this Policy.
Each document within the CBI Prime legal and compliance framework may address a
different aspect of a user’s relationship with CBI Prime. This Privacy Policy principally
addresses the collection, use, disclosure, retention, protection and other processing of
personal data, while other CBI Prime terms and policies may govern access to and use of
particular Services, content, creator functionality, community participation, transactions
or other platform features.
A feature-specific or just-in-time privacy notice may provide additional information
regarding a particular processing activity, including the categories of personal data
involved, the purpose of processing, applicable choices or permissions and any third
parties associated with that feature.
Any such specific privacy notice should be read together with this Privacy Policy. Where
a more specific privacy notice applies to a particular processing activity, it may
supplement the general information contained in this Policy in relation to that activity.
Nothing in another CBI Prime document should be interpreted as excluding or restricting
a data subject’s rights, or CBI Prime’s obligations concerning personal data, to the extent
that such rights or obligations cannot lawfully be excluded or restricted.
Publication checklist
Before this Policy is published, CBI Prime should confirm and populate the operational
details below: • Dedicated privacy/DPO contact email and, if applicable, DPO details.
• Exact payment processor(s), analytics/advertising SDKs, cloud/CDN provider(s),
social-login tools and other material processors used by CBI Prime.
• Actual retention schedule for each major data category.
CBI Prime Privacy Policy
• Countries/regions where relevant processors store or access CBI Prime personal data
and the transfer safeguards relied upon.
• Age-gating and parental-consent design, particularly for CBI Prime 4U/UGC
functionality.
• Cookie/SDK consent-management configuration and marketing opt-in/opt-out flows.
• Automated recommendation, profiling and advertising logic requiring specific notice
or user controls.
• Data-subject request intake, identity-verification and response workflow;
incident/breach-response workflow; processor agreements and DPIAs for highrisk
processing.