1. Overview
Vistapro Limited ("Vistapro", "we", "us") operates the VistaLock device financing and merchant technology platform in Nigeria. VistaLock is our customer-facing brand; Vistapro Limited is the data controller for personal data described in this Privacy Policy.
This policy explains how we process personal data when you visit vistalock.ng, register as a merchant, dealer, agent, or customer, or use our mobile apps and dashboards (including VistaProtect and VistaLock DPC).
We comply with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation (NDPR) 2019, and guidance issued by the Nigeria Data Protection Commission (NDPC). Where you are in the European Economic Area, United Kingdom, or another jurisdiction with data-protection law, we apply equivalent safeguards consistent with the EU General Data Protection Regulation (GDPR) and UK GDPR where they apply to our processing.
2. Data We Collect
We collect only data that is necessary for onboarding, credit assessment, fraud prevention, service delivery, regulatory reporting, and customer support. We do not knowingly collect personal data from children under 18 without appropriate parental or guardian authority.
- Identity data: name, NIN, BVN, government ID, photograph, phone, email
- Business data: CAC registration, director details, bank account, tax information
- Financial data: loan applications, repayments, credit bureau results, settlement records
- Device data: IMEI, model, lock status, and compliance telemetry for financed devices (via VistaProtect and, where provisioned, VistaLock DPC). These apps are not used to read SMS, photos, or unrelated personal files
- Technical data: IP address, browser type, cookies, session logs, API usage
3. Device Owner & VistaLock DPC
VistaLock DPC (Android package com.vistalock.dpc) is a Device Policy Controller used only on financed phones provisioned at sale, typically after a factory reset during Android setup (out-of-box experience). It is not installed on personal phones outside that financed-sale flow.
When a loan is overdue under the signed finance agreement, the DPC may enforce Device Owner restrictions, including locking the device. Restrictions are released when the loan is paid according to the merchant and financier process.
Emergency calling remains available when a lock screen is shown. VistaLock DPC does not collect location or GPS. If that changes, we will update this policy and the Google Play Data safety form for that app.
Customer-facing device-management terms are also set out in our Device Management Notice at https://vistalock.ng/device-notice.
4. Lawful Basis & Purpose
Under the NDPA and, where applicable, GDPR, we process data based on contract performance, legal obligation, legitimate interests (security, fraud prevention, platform integrity), and explicit consent where required (e.g. credit bureau checks, device management including Device Owner provisioning and lock/unlock, marketing where offered).
We do not sell personal data. We share data with licensed financiers, payment partners, credit bureaus, cloud and device-management providers, and regulators only as needed to operate the platform lawfully and as disclosed to you.
5. International Transfers
Some service providers (e.g. cloud hosting, email, device management APIs) may process data outside Nigeria. Where this occurs, we use contractual safeguards, security controls, and transfer mechanisms required under the NDPA, NDPR, and applicable international law.
If you are in the EEA or UK, you may have additional rights including data portability and the right to lodge a complaint with your local supervisory authority. Our primary Nigerian supervisory authority for data protection is the NDPC.
6. Retention & Security
We retain records for as long as needed to provide services, meet legal and regulatory obligations (including AML, KYC, and consumer credit rules under CBN guidelines), and resolve disputes. We apply encryption, access controls, role-based restrictions, audit logging, and staff training.
If we become aware of a personal data breach likely to affect your rights, we will notify the NDPC within 72 hours where required and inform affected individuals without undue delay where there is a high risk to their rights.
7. Your Rights
To exercise your rights, email privacy@vistalock.ng with sufficient detail to verify your identity. We respond within timelines required by applicable law (typically within 30 days under NDPA).
- Access, correction, and deletion (subject to legal and regulatory retention)
- Restriction or objection to certain processing
- Withdraw consent where processing is consent-based
- Data portability where applicable under NDPA or GDPR
- Complaints to the NDPC (Nigeria) or our privacy team
Contact
Vistapro Limited (VistaLock) — RC: RC8204344
Rose wale filling station, 136 Lagos - Ibadan Expy, Iwo Road, Ibadan 121108, Oyo, Nigeria
Privacy & data rights: privacy@vistalock.ng
Legal: legal@vistalock.ng | Support: support@vistalock.ng
VistaLock website: https://vistalock.ng