1. Data Controller and Contact

• Fracwave Ltd, a company registered with the Corporate Affairs Commission in Nigeria.

• Email: [email protected]

• Website: www.fracwave.com

2. Personal data we collect

Depending on how you use the Platform, we may collect:​​

• Identification data: full name, date of birth, residential address, BVN or NIN where required, ID document details (e.g. passport, driver’s licence).​​

• Contact data: email address, phone number, postal address.​​

• Verification and compliance data: KYC / AML / CFT / KYB information, occupation, source of funds declarations, risk profile, politically exposed person status.​​

• Financial and transaction data: bank account details, payment instrument details processed via integrated payment providers, deposits, withdrawals, asset purchases, sales, distributions, and other transactions conducted on the Platform.​​

• Asset and profile data: investment preferences, watchlists, token holdings, ownership records, asset listing information, documents submitted for asset verification, and related metadata.​

• Technical and usage data: IP address, device identifiers, browser type, operating system, referring URLs, clickstream data, login timestamps, session activity, and other telemetry collected via cookies and similar technologies.​

• Communication data: records of your communications with us, including emails, support tickets, and feedback.​

Where required by law, we will obtain your explicit consent before collecting sensitive personal data.​

3. How we collect personal data

We collect data:​

• Directly from you when you register an account, complete KYC/KYB, list an asset, make an investment, contact support, or subscribe to updates.​

• Automatically when you use the Platform, through cookies, SDKs and similar tools.​

• From third parties, such as banks, payment processors, KYC/AML service providers, credit or risk bureaus, and other partners, where permitted by law and necessary for onboarding and compliance.​​

4. Legal bases for processing

We process personal data on the following bases under Nigerian data protection law:​ ​

• Consent: where you have given clear consent, for example to receive marketing communications.

• Contract: to enter into and perform our agreement with you, including creating and maintaining your Platform account and processing your transactions.​

• Legal obligation: to comply with obligations under NDPA/NDPR, anti‑money laundering, counter‑terrorist financing, tax, and securities regulations.​

• Legitimate interests: to operate, secure, and improve the Platform, manage our relationship with you, and protect our rights, provided these interests are not overridden by your fundamental rights and freedoms.​

5. Purposes for processing

We use personal data for the following purposes:​​

• Account creation and management, including identity verification, access control, and profile maintenance.

• Contract: to enter into and perform our agreement with you, including creating and maintaining your Platform account and processing your transactions.​

• Provision of platform services, including listing assets, enabling primary and secondary market transactions, processing payments, distributions and redemptions, and displaying your holdings.​

• Compliance and risk management, including KYC/AML/CFT checks, transaction monitoring, sanctions and fraud screening, record keeping, audits, and regulatory reporting.​​

• Communications, including service announcements, transaction notifications, security alerts, and responses to your enquiries.

• Analytics, product development and service improvement, such as monitoring platform usage, measuring performance, and developing new features (for example, OwnMore, RentLess and debt fractionalization modules).​​

• Marketing, where permitted, including sending information about new features, assets, or campaigns you may be interested in; you can opt out at any time.​

• Protection of our rights and those of other users, including enforcing our Terms of Service, investigating violations, and managing disputes or claims.​

6. Cookies and tracking technologies

We use cookies and similar technologies to:​

• Authenticate users and maintain sessions.

• Remember preferences and improve user experience.

• Perform analytics and measure the effectiveness of content and campaigns.

You can manage cookies through your browser settings, but disabling some cookies may affect functionality of the Platform.​

7. Data sharing and third‑party recipients

We may share personal data with:​​

• Banking and payment partners (e.g. Polaris Bank and other settlement providers) to facilitate deposits, withdrawals, and payouts.
• KYC/AML and verification providers to perform identity, address and sanctions checks and to validate assets.
• Trust companies, custodians and trustees responsible for holding asset documentation, escrow, or other security arrangements.
• Technology and infrastructure providers, including hosting, analytics, communications, and cybersecurity vendors.
• Professional advisers (lawyers, auditors, consultants) and regulators or law enforcement where required by law or reasonably necessary to protect our rights or the rights of others.

We do not sell your personal data. Any sharing for marketing purposes with third parties will only occur with your prior consent, where applicable.​

8. International transfers

Where personal data is transferred outside Nigeria, we will ensure that the receiving jurisdiction has adequate data protection safeguards or that appropriate contractual protections are in place, consistent with the Nigeria Data Protection Act and NDPR.​

9. Data retention

We retain personal data:​

• For as long as your account is active and reasonably thereafter for legitimate business purposes.
• For the period required by applicable laws and regulations, including financial, tax, KYC/AML and securities record‑keeping obligations, which may require us to retain certain records for a number of years after the end of the relationship.

When personal data is no longer required, we will delete or irreversibly anonymise it in line with our retention policies, subject to applicable legal requirements.​

10. Data subject rights

Subject to applicable law, you have the right to:​

• Request access to your personal data.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data where it is no longer necessary or where you withdraw consent, subject to our legal obligations.
• Object to or request restriction of processing in certain circumstances.
• Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing prior to withdrawal.
• Request data portability where technically feasible and applicable.

To exercise these rights, contact us at [email protected] with sufficient information to identify you and your request.​

You also have the right to lodge a complaint with the Nigeria Data Protection Commission or other competent authority if you believe your data protection rights have been infringed.​

11. Security measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or loss. These measures include encryption, access controls, secure storage, and regular reviews of our security practices.​

However, no system is completely secure and you are responsible for keeping your login credentials confidential and for securing your devices and internet connection.​

12. Third‑party sites and services

The Platform may contain links to third‑party websites, applications or services that are not controlled by Fracwave. This Privacy Policy does not apply to such third‑party assets and you are encouraged to review their privacy notices before providing personal data.​

13. Children's privacy

The Platform is not directed at persons under the age of 18 and we do not knowingly collect personal data from minors. If you believe a minor has provided personal data, contact us so that we can take appropriate action.​

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. The updated version will be indicated by a revised "Last updated" date and will be effective when posted on fracwave.com.​