1. Overview
Vistapro Limited ("Vistapro", "we", "us") operates the VistaLock device financing and merchant technology platform in Nigeria. VistaLock is our customer-facing brand; Vistapro Limited is the data controller for personal data described in this Privacy Policy.
This policy explains how we process personal data when you visit vistalock.ng, register as a merchant, dealer, agent, or customer, or use our mobile apps and dashboards (including VistaProtect).
We comply with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation (NDPR) 2019, and guidance issued by the Nigeria Data Protection Commission (NDPC). Where you are in the European Economic Area, United Kingdom, or another jurisdiction with data-protection law, we apply equivalent safeguards consistent with the EU General Data Protection Regulation (GDPR) and UK GDPR where they apply to our processing.
2. Data We Collect
We collect only data that is necessary for onboarding, credit assessment, fraud prevention, service delivery, regulatory reporting, and customer support. We do not knowingly collect personal data from children under 18 without appropriate parental or guardian authority.
- Identity data: name, NIN, BVN, government ID, photograph, phone, email
- Business data: CAC registration, director details, bank account, tax information
- Financial data: loan applications, repayments, credit bureau results, settlement records
- Device data: IMEI, model, lock status, compliance telemetry (for financed devices via VistaProtect)
- Technical data: IP address, browser type, cookies, session logs, API usage
3. Lawful Basis & Purpose
Under the NDPA and, where applicable, GDPR, we process data based on contract performance, legal obligation, legitimate interests (security, fraud prevention, platform integrity), and explicit consent where required (e.g. credit bureau checks, device management, marketing where offered).
We do not sell personal data. We share data with licensed financiers, payment partners, credit bureaus, cloud and device-management providers, and regulators only as needed to operate the platform lawfully and as disclosed to you.
4. International Transfers
Some service providers (e.g. cloud hosting, email, device management APIs) may process data outside Nigeria. Where this occurs, we use contractual safeguards, security controls, and transfer mechanisms required under the NDPA, NDPR, and applicable international law.
If you are in the EEA or UK, you may have additional rights including data portability and the right to lodge a complaint with your local supervisory authority. Our primary Nigerian supervisory authority for data protection is the NDPC.
5. Retention & Security
We retain records for as long as needed to provide services, meet legal and regulatory obligations (including AML, KYC, and consumer credit rules under CBN guidelines), and resolve disputes. We apply encryption, access controls, role-based restrictions, audit logging, and staff training.
If we become aware of a personal data breach likely to affect your rights, we will notify the NDPC within 72 hours where required and inform affected individuals without undue delay where there is a high risk to their rights.
6. Your Rights
To exercise your rights, email privacy@vistalock.ng with sufficient detail to verify your identity. We respond within timelines required by applicable law (typically within 30 days under NDPA).
- Access, correction, and deletion (subject to legal and regulatory retention)
- Restriction or objection to certain processing
- Withdraw consent where processing is consent-based
- Data portability where applicable under NDPA or GDPR
- Complaints to the NDPC (Nigeria) or our privacy team
Contact
Vistapro Limited (VistaLock) — RC: RC8204344
Rose wale filling station, 136 Lagos - Ibadan Expy, Iwo Road, Ibadan 121108, Oyo, Nigeria
Privacy & data rights: privacy@vistalock.ng
Legal: legal@vistalock.ng | Support: support@vistalock.ng
VistaLock website: https://vistalock.ng