Privacy Policy

Wafira-Ntaba Limited (herein after referred to as “Wafira-Ntaba,” “we,” “us,” or “our”), the Providers of Plan B, is committed to protecting the privacy and personal information of our clients and employees (herein after collectively referred to as “data subjects” or “you”). Wafira-Ntaba is the entity responsible for collecting and processing your personal information and ensuring compliance with applicable Nigerian data protection laws. We do not outsource this responsibility to any third party.

By providing your personal information, or the personal information of a beneficiary under your policy, you acknowledge that Wafira-Ntaba may use the information only as described in this Privacy Policy.

This policy may be updated periodically due to new government regulations, new technologies, or other developments in data protection and privacy laws. The current version is available on our website: https://planbinsurance.org/.

Definitions

For the purposes of this policy, the following definitions apply:

• Data Subject: An identifiable individual who can be identified directly or indirectly, particularly by reference to an identification number or one or more factors specific to their physical, physiological, mental, economic, cultural, or social identity. This includes Wafira-Ntaba’s clients, users, customers, business partners, and employees.
• Data Administrator: A person or organization that processes data. For this policy, Wafira-Ntaba Limited is the Data Administrator.
• Data Controller: A person who, alone or jointly with others, determines the purposes and means of processing personal data. For this policy, the Managing Director is the Data Controller, or their designated representative.
• Data Protection Officer: Appointed by the Data Controller to ensure the data protection strategy and its implementation comply with this policy and relevant laws. For this policy, the Chief Compliance Officer of Wafira-Ntaba is the Data Protection Officer.

The responsibilities of the Data Administrator, Data Controller, and Data Protection Officer are detailed in the Nigeria Data Protection Regulation (2019).

1. Introduction

Wafira-Ntaba adheres to strict controls when collecting and processing the personal information of data subjects, ensuring it is obtained and used in line with our privacy principles. We handle personal data with the utmost care and only for legitimate and specified business purposes, guided by these principles:

• We respect the privacy rights of our employees, customers, clients, business partners, and other individuals whose personal data we hold.
• We protect personal data by implementing appropriate technical and organizational measures in our data processing activities.
• We obtain personal data fairly and only use it for legitimate business purposes.
• We are accountable for demonstrating compliance with applicable legal and regulatory requirements and understanding our roles.

All personal information collected by Wafira-Ntaba is processed according to applicable data protection laws in Nigeria.

2. Types of Information Processed

The specific personal data Wafira-Ntaba processes depends on your relationship with us. As an insurer, we may process the following information:

• Personal Information: Name, age, gender, date of birth, nationality. Even if we do not receive your name directly, we require sufficient information to identify you and your policy to provide services.
• Identification: Date of birth, National Identity Card Number (NIN), international passport details, driver’s license, voter’s card details, etc.
• Contact Information: Email address, physical address, phone number.
• Online Information: Cookies and IP address (your computer’s internet address) if you use our website.
• Financial Information: Payment information related to your insurance policy, including Bank Verification Number (BVN) and information from credit reference agencies.
• Contractual Information: Details of your policies and with whom you hold them.
• Health Information: Smoker status or medical information relevant to your policy or a claim.
• Other Sensitive Personal Data: Health background/information, marital status, criminal history, biometric details, academic records, and gender.

3. Requirement for Consent

When you provide consent for the use of your personal information, Wafira-Ntaba will explain why we are requesting it. Without your consent, we may be unable to provide the required coverage or handle claims. If you provide personal information about third parties, you must confirm that they have consented for you to act on their behalf and provide us with a copy of their consent.

Consent will be obtained through the same medium used to collect the information or other acceptable means. We will provide you with this policy or a simplified version, and you will be required to indicate your understanding and acceptance, either by signature for physical documents or a checked box for electronic platforms.

When Wafira-Ntaba has a legitimate business need to use your personal information for business records, product development, or service improvement, we will take extra care to protect your security and confidentiality rights.

4. Reasons for Use and Processing of Data

Wafira-Ntaba will obtain your consent before using and processing your data for specific, disclosed purposes. Personal data obtained with your consent will not be used for any other purpose without further consent.

We may use your personal data for:

• Underwriting our business with our clients.
• Managing claims.
• Assessing, improving, and developing our services.
• Enhancing our understanding of risk and insurance markets.
• Fulfilling legal or regulatory obligations and protecting ourselves and our clients against fraud. Regulators may include the National Insurance Commission, National Financial Intelligence Unit, and other relevant agencies.
• Protecting the public interest, such as investigating fraudulent claims and anti-money laundering.
• Archiving for public interest, scientific, historical research, or statistical purposes.
• Assessing proposed employee employability and other employee benefits-related purposes.

Wafira-Ntaba uses information protection technologies, including perimeter security, malware management, data loss prevention, and backups. Our data centers are protected against environmental threats. Our information security policies apply to all personal information in our custody.

We will only transfer personal information to a third party after ensuring its protection and obtaining your consent. We will review the third party’s privacy policy to guarantee the safeguard of your personal data. We will not seek, give, or accept consent in any circumstance that may promote atrocities, hate, child rights violations, criminal acts, or anti-social conduct.

5. Methods of Collecting Personal Information

Wafira-Ntaba often receives personal data from third parties, such as corporate clients, and may also receive it directly from you. We collect personal information through:

• Direct Collection:
  • Know Your Customer (KYC) forms
  • Claim forms
  • Forums and feedback forms
  • Enquiry and quote forms
  • Recorded telephone conversations
  • Digital touchpoints
  • Electronic means (emails and apps)
  • Employee engagement personal data forms (including medical reports)
• Third-Party Data Collection:
  • Individuals or employers with policies with Wafira-Ntaba under which you are insured (e.g., a named individual in a group life insurance policy).
  • Credit reference agencies.
  • Family members in case of incapacitation or death of the insured for claims payment.
  • Medical professionals and hospitals.
  • Aggregators.
  • Loss adjusters and claim assessors.

For data obtained from third-party sources, a copy of your consent given to the third party to transfer the data to Wafira-Ntaba will suffice for our use and processing.

6. Wafira-Ntaba’s Use of Cookies

Our websites use cookies to track browsing history and improve user experience. All our websites allow visitors to accept or decline the use of cookies. Consent is required before any data processing. All consents will be securely stored as evidence.

For our customers, consent is given through a dialogue box with clear declarations indicating whether consent is given or declined. For children’s personal data, consent will be sought from their legal guardian.

7. Social Media Platforms

You may participate in blogs, forums, and other social media platforms hosted by Wafira-Ntaba (“Social Media Platforms”). While these platforms facilitate content sharing, we are not responsible for personal information you share that is subsequently used, misused, or appropriated by another user. Consult the privacy statements of these services before using them.

8. Third-Party Access and Purpose of Access

• Disclosure to Employees: Wafira-Ntaba employees access and process personal data on a “need to know” basis to perform their jobs. We regularly monitor system access.
• Disclosures to Third Parties: We may disclose your personal data to:
  • Service providers and agents (e.g., IT companies, marketing agencies, research specialists, document management providers, tax advisors).
  • Professional advisors (e.g., auditors, reinsurers, medical agencies, legal counsel).
  • Clients who provide us with your personal data.
  • Legally authorized representatives (e.g., lawyers, insurance brokers, loss adjusters).
  • Individuals you nominate and authorize to engage with us.
  • Wafira-Ntaba recommended garages or other service providers.
  • Credit referencing organizations.
  • Fraud detection agencies.