Privacy Policy.

The Negotiator Group ("the Group", "we", "us" or "our") is a multi-service corporate group headquartered in Lagos, Nigeria, comprising The Negotiator International, The Apartment Pro, TNG Concierge and The Negotiator Capital, together with any present or future subsidiaries, affiliates and product lines (collectively, the "Group Companies").

This Privacy Policy explains how the Group collects, uses, discloses, retains and protects personal information of visitors, registered users, clients, applicants, counterparties and other data subjects who interact with our websites, mobile properties, application portals, customer service channels and related services (collectively, the "Services").

We process personal data in accordance with the Nigeria Data Protection Act, 2023 ("NDPA"), the Nigeria Data Protection Regulation, 2019 ("NDPR"), the Federal Competition and Consumer Protection Act, 2018 ("FCCPA"), the Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, the Money Laundering (Prevention and Prohibition) Act, 2022, the Companies and Allied Matters Act, 2020 ("CAMA") and all other applicable Nigerian laws, regulations, guidelines and codes of practice (the "Applicable Laws").

• Personal Data / Personal Information — any information relating to an identified or identifiable natural person.
• Data Subject — the individual to whom Personal Data relates.
• Processing — any operation performed on Personal Data, including collection, recording, storage, use, disclosure or destruction.
• Data Controller — the Group Company that determines the purposes and means of Processing.
• Data Processor — a third party that Processes Personal Data on behalf of a Data Controller.
• Sensitive Personal Data — information defined as sensitive under the NDPA / NDPR, including financial, health, biometric and identification data.
• KYC — Know-Your-Customer due diligence procedures conducted under Applicable Laws.
• AML — Anti-Money Laundering controls applied under the Money Laundering (Prevention and Prohibition) Act and related regulations.

Depending on the Service requested and the nature of your interaction with the Group, we may collect the following categories of Personal Data. We collect only what is necessary, proportionate and lawful for the relevant purpose, and we apply heightened safeguards to Sensitive Personal Data.

• Directly from you when you register, request a quote, submit a form, apply for financing, book a service or otherwise interact with us.
• Automatically through your device when you visit our digital properties, via cookies, analytics, server logs and security tools.
• From authorised third parties such as credit bureaus, identity verification providers, licensed background-check vendors, insurance underwriters, financial institutions and government registries.
• From referees, employers, guarantors, landlords or business partners that you have nominated in connection with a Service.

• Performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract.
• Compliance with a legal obligation, including KYC, AML, tax, consumer protection and regulatory reporting obligations.
• Your freely given, specific, informed and unambiguous consent, which you may withdraw at any time without affecting the lawfulness of prior processing.
• Our legitimate interests in operating, securing, improving and growing the Group's businesses, balanced against your rights and freedoms.
• Protection of the vital interests of you or another natural person, including fraud prevention and the protection of life and property.
• The performance of a task carried out in the public interest where applicable under Nigerian law.

• To provide, operate and improve the Services across the Group's mobility, real estate, relocation, staffing, financing, insurance and investment lines.
• To verify your identity, conduct KYC and AML screening, sanctions checks and ongoing due diligence.
• To assess affordability, perform credit checks and process financing, leasing, mortgage and rent-to-own applications.
• To process payments, disburse funds, manage repayments, recover debts and prevent fraud and chargeback abuse.
• To deliver communications relating to your transactions via email, SMS, WhatsApp, telephone and in-app notifications.
• To respond to inquiries, complaints and requests, including for after-sales support and dispute resolution.
• To comply with court orders, regulatory directives and lawful requests from competent authorities.
• To carry out research, analytics, product development and statistical analysis using aggregated or de-identified data.

With your consent, where required, we may send you marketing communications about products, offers and insights from across the Group Companies. You can opt out at any time using the unsubscribe link in any email, by replying STOP to an SMS, by adjusting your in-account preferences, or by contacting our Data Protection Officer.

Opting out of marketing communications will not affect transactional or service-related messages that we must send to administer your account, transactions or legal obligations.

Certain pre-qualification, credit-scoring, fraud-screening and pricing decisions may be supported by automated processing. You have the right not to be subject to a decision based solely on automated processing that produces legal effects on you, and may request human review, express your point of view and contest such decisions by contacting our Data Protection Officer.

We perform KYC, customer due diligence, enhanced due diligence and sanctions screening on customers, beneficial owners and counterparties where required by the Money Laundering (Prevention and Prohibition) Act, 2022, the Terrorism (Prevention and Prohibition) Act, 2022, guidelines issued by relevant Nigerian regulators and applicable international standards. We may decline, suspend or terminate a relationship where these checks cannot be completed satisfactorily.

We share Personal Data only when necessary, proportionate and lawful, and under binding confidentiality and data protection terms.

Where Personal Data is transferred outside Nigeria, we ensure that transfers are made only to jurisdictions recognised as providing adequate protection, or are subject to appropriate safeguards such as standard contractual clauses, binding corporate rules or other lawful transfer mechanisms approved by the Nigeria Data Protection Commission ("NDPC"). Copies of the safeguards relied upon may be obtained from our Data Protection Officer.

We retain Personal Data for as long as is necessary to fulfil the purposes for which it was collected, to provide the Services, to comply with our legal, accounting, tax, regulatory and statute-of-limitation obligations, and to establish, exercise or defend legal claims. Financial transaction records, KYC files and regulatory records are typically retained for a minimum of seven (7) years from the end of the relationship, or such longer period as required by Applicable Laws.

We implement appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful Processing, accidental loss, destruction or damage. These include encryption in transit and at rest where appropriate, strict access controls, multi-factor authentication for privileged systems, network and endpoint security monitoring, vendor risk assessments, staff training and incident response procedures.

Subject to Applicable Laws and the limitations they prescribe, you have the following rights in relation to your Personal Data:

Our Services are not directed to children under the age of eighteen (18). We do not knowingly collect Personal Data from minors. If we become aware that we have inadvertently collected such data, we will delete it promptly unless retention is required by law or with verifiable parental or guardian consent.

We maintain a documented incident response and breach notification programme. Where a Personal Data breach is likely to result in a risk to your rights and freedoms, we will notify the NDPC and affected Data Subjects within the timelines and in the manner prescribed under the NDPA.

We may update this Privacy Policy from time to time to reflect changes in our Services, the Group's structure (including the launch of new subsidiaries, products, financing programmes, investment services, insurance services, digital services, mobility services, property services or other business offerings), or Applicable Laws. The updated policy will be posted on this page with a revised Effective Date and, for material changes, we may provide additional notice.

For questions, requests or complaints relating to this Privacy Policy or the Processing of your Personal Data, please contact our Data Protection Officer:

• The Negotiator Group — Data Protection Officer
• Head Office: Lagos, Federal Republic of Nigeria
• Email: legal@thenegotiatorgroup.com
• WhatsApp: +234 703 984 2222

If you are not satisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) or any other competent regulator.