Privacy Policy

1. Introduction

Trebor Finance Limited (“Trebor”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and security of the personal data entrusted to us by our customers, prospective customers, business partners, vendors, corporate clients, employees and other individuals who interact with our website, applications, products and services.

This Privacy Policy explains how we collect, receive, use, store, disclose, retain and otherwise process personal data when you visit our website, create or use an account, apply for financing, participate in a transaction, interact with our marketplace, use our payment-related services, communicate with us, or otherwise engage with Trebor.

Trebor provides and is developing financial and business solutions designed to support individuals, vendors, small and medium-sized enterprises (SMEs), distributors, contractors and corporate supply chains. Depending on the service involved, our activities may include invoice financing, purchase order financing, other forms of business financing, payment-related services, marketplace services and workforce-related financial solutions.

This Policy is intended to explain our privacy practices across these activities. The information we collect and the ways we use it will depend on the particular service you use and your relationship with Trebor.

We process personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA), applicable regulations and other relevant laws governing our activities.

Please read this Policy carefully to understand how we handle your personal data and the rights available to you.

2. Scope of This Policy

This Policy applies to personal data processed by Trebor in connection with:

Our website, digital platforms, applications and other online services.
Individual and business account registration and administration.
Customer identification and verification, including applicable KYC and KYB processes.
Invoice financing, purchase order financing and other financing products offered by Trebor.
Corporate clients, vendors, suppliers, distributors, contractors and other participants in business transactions.
Payment-related services, marketplace activities and associated transaction records.
Workforce-related services, including payroll, employee benefits and employment-document features, where these services are made available.
Customer support, complaints, enquiries, marketing communications and business development.
Our relationships with employees, applicants, consultants, suppliers, service providers and business partners.

This Policy applies to personal data relating to identifiable individuals. Information about a company may not itself constitute personal data, but information about its owners, directors, employees, representatives, guarantors or other identifiable individuals may be protected under applicable data protection laws.

Where a particular Trebor service has additional privacy terms or notices, those terms should be read alongside this Policy.

3. Who Is Responsible for Your Personal Data?

Trebor Finance Limited is responsible for determining how and why personal data is processed in connection with its services, where Trebor acts as the data controller under applicable law.

Depending on the circumstances, Trebor may also process personal data on behalf of a corporate client or another organisation under documented instructions. In those circumstances, the respective responsibilities of Trebor and that organisation will depend on the arrangement and applicable law.

For questions about this Policy, your personal data or your data protection rights, please contact us using the details in Section 16.

Company: Trebor Finance Limited

Website: https://www.trebor.finance

Contact: support@trebor.finance; helpdesk@trebor.finance

Business address:

Paul Okon Street (now branded as Nathaniel Adiakpan Street), Uyo, Akwa Ibom State, Nigeria
No. 14, Bachaman Crescent, Wuse II, FCT, Abuja, Nigeria
1 Mofolorunsho Jegede Street, Isheri/Olofin, Lagos, Nigeria
29 Hatton Garden, L3 2EZ, Liverpool, United Kingdom

4. Personal Data We May Collect

The personal data we collect depends on the services you use, the information required to provide those services and our applicable legal and contractual obligations.

4.1 Identity and Contact Information

We may collect:

Full name and other names appearing on identification documents.
Date of birth, where required.
Telephone number and email address.
Residential, business or correspondence address.
Nationality and other identity-related information where legally required.
Government-issued identification details and supporting documents.
Photographs, identification images or verification records, where required for identity verification.
Contact information for authorised representatives, guarantors or other relevant persons, where necessary and lawfully obtained.

4.2 Business and Corporate Information

Where you apply for or use our business services, we may collect:

Registered business name and trading name.
Business registration and incorporation details.
Tax identification information, where required.
Business address and contact information.
Details of directors, beneficial owners, shareholders and authorised representatives, where relevant.
Business licences, permits and other supporting documents, where applicable.
Information used to verify ownership, authority to act or the legitimacy of a business.
Supplier, customer, distributor and corporate-client relationship information.
Business correspondence and records relevant to a transaction or financing request.

4.3 Financial and Credit-Related Information

When you use or apply for a financial service, we may collect information necessary to evaluate, administer or support that service, including:

Bank account details and account ownership information.
Payment instructions, transaction references and settlement details.
Financial statements, bank statements and relevant business records.
Invoices, purchase orders, contracts, delivery notes and proof of completed work.
Receivables, payment terms, outstanding obligations and repayment information.
Information relating to previous financing arrangements or repayment performance, where relevant and lawfully obtained.
Credit-reference information or verification results obtained from authorised providers, where applicable.
Information relevant to assessing eligibility, affordability, transaction validity, financial exposure and fraud risk.
We will seek to collect only information that is adequate, relevant and reasonably necessary for the applicable purpose.

4.4 Transaction and Marketplace Information

Where you participate in a transaction through Trebor, we may process information such as:

The identity of relevant transaction participants.
The amount, date, status and reference of a transaction.
Payment, disbursement, settlement and reconciliation records.
Relevant invoice, purchase order, supply, delivery and fulfilment information.
Marketplace listings, offers, orders and related communications, where applicable.
Records of disputes, reversals, failed transactions and customer complaints.
Information needed to administer balances, transaction histories or other account features made available through our services.

We may share specific transaction information with the relevant parties where necessary to perform the transaction, verify a claim, administer financing, resolve a dispute or comply with applicable law.

4.5 Workforce-Related Information

If you use a Trebor workforce or employee-facing service, including WorkHub when available, we may process relevant employment-related information such as:

Employee names, contact details and identification information.
Employer, department, role and employment status.
Payroll instructions and payment records.
Benefits enrolment and administration information.
Employment documents, payslips and related records.
Information needed to administer employee financial or workplace services.

The information processed will depend on the specific features made available and the relationship between the employee, employer and Trebor.

Where a corporate employer provides employee information to Trebor, the employer must have an appropriate legal basis and satisfy its applicable obligations for providing that information.

4.6 Communications and Customer Support

We may collect information you provide when you:

Contact our customer support team.
Submit a complaint, enquiry, application or feedback.
Communicate with us by email, telephone, messaging platform or other available channel.
Participate in a survey or provide a review.
Interact with our official social media accounts.
Submit documents or evidence to help us investigate a transaction or resolve a dispute.

Where communications are recorded, we will handle the recordings in accordance with applicable law and provide any notice required.

4.7 Technical and Usage Information

When you visit our website or use our digital services, we may collect certain technical information, including:

Internet Protocol (IP) address.
Browser type, device type and operating system.
Website pages visited and interactions with our digital platforms.
Dates, times and duration of access.
Login activity, security events and diagnostic information.
Cookie identifiers and similar technologies, subject to applicable requirements and your choices.

We use this information where necessary to operate our website, maintain security, troubleshoot errors, understand service performance and improve user experience.

4.8 Information Obtained from Other Sources

Where lawful and necessary, we may receive relevant information from:

Corporate clients, employers, vendors, suppliers and transaction counterparties.
Identity and business-verification providers.
Financial institutions, payment service providers and transaction partners.
Credit-reference agencies or other authorised risk-assessment providers.
Public registers and other lawful public sources.
Regulators, law enforcement authorities or other competent bodies where legally permitted or required.
Other service providers involved in delivering a service you request.

Where information is obtained indirectly, we will provide the required privacy information unless a lawful exception applies.

4.9 Information We Do Not Intentionally Seek

We do not intentionally collect sensitive personal data unless it is necessary for a specified and lawful purpose, an appropriate legal basis exists, and any additional requirements under applicable law are satisfied.

Please do not provide personal data about another individual unless you are authorised to do so or otherwise have a lawful basis for providing it.

5. How We Collect Personal Data

We may collect personal data through the following methods:

Directly from you: When you register, complete an application, submit documents, request financing, initiate a transaction or communicate with us.
Through your organisation: When a corporate client, employer or authorised representative provides information necessary to administer a business relationship or service.
Through transaction participants: When a vendor, buyer, supplier or other participant submits information necessary to verify or complete a transaction involving you.
Through authorised third parties: When identity-verification providers, financial institutions, payment providers, credit-reference agencies or other relevant providers supply information lawfully.
Automatically through digital services: Through server logs, cookies and similar technologies, subject to applicable law and your choices.
From public or official sources: Where permitted by law and relevant to verification, compliance, fraud prevention or another specified purpose.

We will take reasonable steps to ensure that personal data obtained from third parties is collected and used lawfully.

6. Why We Use Your Personal Data

We may process your personal data for the following purposes, depending on the service and applicable circumstances.

6.1 To Provide and Administer Our Services

We use personal data to:

Register and administer user and business accounts.
Verify your identity, business details and authority to act.
Assess and process applications for our products and services.
Facilitate financing requests, payment instructions, transaction administration and settlement.
Verify invoices, purchase orders, contracts, delivery records and other transaction documents.
Administer marketplace activity and business relationships.
Provide customer support and respond to requests.
Maintain transaction histories and account records.

6.2 To Assess Financing Applications and Manage Risk

Where you apply for financing, we may use relevant personal, business, financial and transaction information to:

Confirm the identity and legitimacy of the applicant and relevant transaction participants.
Verify supporting documents and the underlying commercial transaction.
Assess eligibility under the applicable product criteria.
Evaluate relevant repayment capacity, credit exposure and transaction risks.
Detect inconsistencies, suspected fraud or potentially unlawful activity.
Monitor repayment obligations and administer outstanding financing.
Support lawful recovery, dispute resolution and risk-management processes.

The specific information and assessment methods used will depend on the financing product and the information reasonably necessary for the assessment.

Where a decision is made solely by automated means and applicable law grants you additional rights, we will provide the required information and applicable means of exercising those rights.

6.3 To Meet Legal and Regulatory Obligations

We may process personal data to:

Comply with applicable data protection, financial services, anti-fraud, anti-money-laundering, tax, accounting and reporting requirements.
Respond to lawful requests from courts, regulators or competent authorities.
Maintain records required by law.
Conduct necessary compliance checks.
Investigate suspected misconduct, fraud or security incidents.
Establish, exercise or defend legal claims.

The specific obligations applicable to Trebor will depend on the products it offers, its regulatory status and the role it performs in each transaction.

6.4 To Protect Users, Trebor and Our Services

We may process relevant information to:

Detect, investigate and prevent fraud, impersonation, account misuse and unauthorised transactions.
Protect our systems, accounts, infrastructure and business operations.
Investigate complaints, disputes and suspected breaches of applicable terms.
Enforce our contractual rights where lawful.
Maintain service reliability and business continuity.

6.5 To Improve Our Products and Digital Experience

We may use appropriate information to:

Diagnose technical problems.
Understand how our website and services are used.
Evaluate service performance.
Improve product usability, reliability and accessibility.
Develop and test new features.
Conduct analysis using aggregated or de-identified information where appropriate.

Where possible, we will use aggregated or de-identified information for analytical purposes where individual identification is not required.

6.6 To Communicate With You

We may contact you regarding:

Account registration and verification.
Application status and service requests.
Transactions, payments and financing arrangements.
Security alerts and important account notices.
Changes to our services, terms or policies.
Complaints, support requests and operational matters.

These service-related communications may be necessary to provide the service or fulfil our legal obligations and are distinct from optional promotional communications.

6.7 To Send Marketing Communications

Where permitted by law, we may send information about products, services, offers or events that may be relevant to you.

Where consent is required, we will obtain it before sending such communications. You may opt out at any time using the unsubscribe mechanism provided or by contacting us.

Opting out of marketing will not prevent us from sending essential service, security, transaction or legally required communications.

7. Our Lawful Bases for Processing

We will process personal data only where an applicable lawful basis exists under the NDPA and other relevant laws. Depending on the circumstances, these bases may include:

Performance of a contract: Where processing is necessary to provide a service you request, administer an agreement or take steps at your request before entering into an agreement.
Legal obligation: Where processing is necessary to comply with an obligation imposed by law.
Consent: Where you have freely given valid consent for a specified purpose and consent is the appropriate lawful basis.
Legitimate interests: Where processing is necessary for a legitimate interest pursued by Trebor or another party, provided that the applicable legal requirements are met and your rights and interests do not override those interests.
Vital interests or public interest: Where a lawful basis of this nature applies in the specific circumstances.

The applicable lawful basis will depend on the processing activity. We will not rely on consent as a blanket justification for all processing, and withdrawing consent will not affect processing lawfully carried out before withdrawal or processing that continues under another valid lawful basis.

8. How We Share Personal Data

We do not sell personal data as a commercial product. We may disclose or make personal data available to the following categories of recipients where necessary, lawful and consistent with the purpose for which the information was collected.

8.1 Corporate Clients and Transaction Participants

Where necessary to provide a service, we may share relevant information with a corporate client, vendor, supplier, buyer, contractor or other transaction participant.

For example, in a financing arrangement, the relevant parties may need information to verify an invoice or purchase order, confirm the status of a supply transaction, administer payment obligations, reconcile a transaction or resolve a dispute.

We will seek to limit disclosures to information reasonably necessary for the relevant purpose.

8.2 Financial Institutions and Payment Service Providers

Where applicable, we may share necessary information with banks, payment processors, settlement partners and other financial service providers involved in processing payments, disbursements, collections or reconciliations.

These parties may process information under their own legal obligations and privacy policies, depending on their role.

8.3 Verification, Credit and Risk Service Providers

Where required for a service and lawfully permitted, we may share relevant information with identity-verification providers, business-verification providers, credit-reference agencies, fraud-prevention services and other risk-assessment providers.

We will not represent that a particular provider or database is used unless that arrangement is in place.

8.4 Technology and Operational Service Providers

We may engage service providers to support our operations, including providers of:

Cloud hosting, data storage and infrastructure.
Software, application development and maintenance.
Cybersecurity and fraud monitoring.
Customer support and communications.
Analytics and website performance.
Document management and electronic signatures.
Payroll or workforce technology, where applicable.

Where these providers process personal data on our behalf, we will take appropriate steps to ensure that their processing is governed by suitable contractual, confidentiality and security requirements.

8.5 Professional Advisers and Auditors

We may disclose relevant information to lawyers, accountants, auditors, insurers and other professional advisers where necessary for legal advice, audit, risk management, dispute resolution or related professional services.

8.6 Regulators, Courts and Law Enforcement

We may disclose personal data where required or permitted by applicable law, a valid court order, a lawful regulatory request or another legally recognised basis.

8.7 Corporate Transactions

If Trebor undergoes a restructuring, merger, acquisition, investment transaction or transfer of some or all of its business or assets, personal data may be disclosed to relevant parties where lawful and subject to appropriate confidentiality and data protection safeguards.

8.8 With Your Direction or Consent

We may share personal data with another party where you have directed us to do so or provided valid consent, where that is the appropriate lawful basis.

We will not disclose personal data to unrelated third parties for their independent purposes merely because those parties are commercially connected to Trebor.

9. Cookies and Similar Technologies

Our website may use cookies and similar technologies to support essential website functions, remember preferences, protect security and understand website performance.

Depending on the technologies deployed, these may include:

Essential cookies: Necessary for core website functions, security or requested services.
Preference cookies: Used to remember choices and settings.
Analytics cookies: Used to understand website usage and improve performance.
Marketing cookies: Used for promotional measurement or advertising, where implemented and permitted.

Where consent is required for non-essential cookies, we will seek it before activating them. You may be able to manage your choices through a cookie banner, website settings or your browser controls.

Blocking certain cookies may affect the functionality of parts of the website.

The final cookie disclosures should reflect the technologies actually installed on Trebor's website and digital platforms.

10. Data Security

Trebor recognises the importance of protecting personal data against unauthorised access, unlawful processing, accidental loss, alteration, disclosure or destruction.

We will implement appropriate technical and organisational measures designed to protect personal data, taking into account the nature of the information, the purposes of processing, the risks involved and applicable legal requirements.

Depending on the systems and services in use, these measures may include:

Access controls and restrictions based on authorised responsibilities.
Authentication and account-protection measures.
Secure data transmission and storage practices.
Confidentiality obligations for authorised personnel.
Security monitoring, backups and recovery arrangements.
Procedures for identifying, investigating and responding to security incidents.
Appropriate oversight of service providers who handle personal data.

Access to personal data should be limited to individuals and service providers who need it for authorised purposes.

No website, network, application or storage system can be guaranteed to be completely secure. However, we will take reasonable and appropriate steps to protect the information entrusted to us and respond to security incidents in accordance with applicable law.

Where a personal data breach occurs, we will assess and manage the incident, take appropriate steps to mitigate harm and notify affected individuals and the relevant authority where required by law.

11. How Long We Keep Personal Data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected or further processed, subject to applicable legal, regulatory, contractual, accounting and reporting obligations.

The retention period may depend on:
The type of information involved.
The service or relationship to which it relates.
Whether an application or transaction is ongoing.
Applicable record-keeping requirements.
The need to investigate fraud, disputes or security incidents.
The establishment, exercise or defence of legal claims.

For example, transaction records, financing documentation, verification records and related correspondence may need to be retained for a period after a service ends where applicable law or a legitimate business need requires it.

When personal data is no longer required, we will take appropriate steps to delete it, anonymise it or otherwise dispose of it securely, subject to any lawful reason for continued retention.

Closing an account or ending a business relationship does not automatically mean that all related records can be deleted immediately.

Trebor should maintain an internal retention schedule specifying the applicable periods for its different categories of records.

12. International Data Transfers

Some of our technology or operational service providers may store or process information outside Nigeria.

Where personal data is transferred to another country or made accessible to a recipient outside Nigeria, Trebor will ensure that the transfer complies with the NDPA and applicable cross-border data-transfer requirements.

Depending on the circumstances, this may involve assessing the recipient and destination, applying an appropriate lawful transfer mechanism, implementing contractual safeguards or taking other measures required by law.

We will not assume that a transfer is lawful simply because a service provider operates internationally.

13. Your Data Protection Rights

Subject to applicable law and the circumstances of the request, you may have the right to:

Be informed: Receive clear information about how and why your personal data is processed.
Access: Request confirmation of whether we process your personal data and obtain access to it, subject to applicable limitations.
Rectification: Request correction of inaccurate or incomplete personal data.
Erasure: Request deletion of personal data where the legal requirements for erasure are satisfied.
Restriction: Request that certain processing activities be restricted where a legal ground applies.
Object: Object to certain processing, including processing based on legitimate interests, where applicable.
Withdraw consent: Withdraw consent where consent is the lawful basis for the relevant processing.
Data portability: Request a copy of eligible personal data in a structured, commonly used and machine-readable format, where the legal requirements are met.
Challenge certain automated decisions: Exercise applicable rights concerning decisions based solely on automated processing, including profiling, where the law provides such rights.
Lodge a complaint: Submit a complaint to the Nigeria Data Protection Commission where you believe your data protection rights have been infringed.

These rights are not absolute in every circumstance. For example, we may be required to retain certain records to comply with law or establish, exercise or defend legal claims.

We will consider requests in accordance with applicable law and explain where a request cannot be fully granted, to the extent we are permitted to do so.

14. How to Exercise Your Rights or Make a Complaint

To submit a privacy request or raise a concern, contact us using the privacy contact details in Section 16.

To help us handle your request, please provide:

Your name and preferred contact details.
Sufficient information to identify the account, service or records involved.
A description of the request or concern.
Any additional information reasonably necessary to verify your identity or clarify the request.

We may need to verify your identity before disclosing or changing personal data. We will seek only information reasonably necessary for this purpose.

We will respond within the timeframe required by applicable law. If a request requires additional time or cannot be fulfilled in full, we will communicate the position and any available next steps where required.

If you are dissatisfied with how we handle your personal data or your request, you may lodge a complaint with the Nigeria Data Protection Commission through its official channels.

15. Children's Privacy

Trebor's financial and business services are intended for eligible users who meet the applicable age and legal requirements for the relevant product.

We do not knowingly collect children's personal data where doing so is not permitted by law. If a service lawfully involves the personal data of a child, we will apply the additional safeguards, notices and consent requirements applicable to that processing.

If you believe a child has provided personal data to Trebor in circumstances where this was not permitted, please contact us so we can assess and address the matter appropriately.

16. Third-Party Websites and Services

Our website or digital platforms may contain links to websites, applications or services operated by third parties.

Those third parties may have their own privacy policies and data-processing practices. Trebor does not control the independent privacy practices of third parties merely because their websites or services are linked to ours.

We encourage you to review the relevant privacy notices before providing personal data directly to another organisation.

Where a third party processes personal data on Trebor's behalf, our relationship with that provider will be governed by the applicable contractual and data protection arrangements.

17. Marketing Preferences

We may update this Policy to reflect changes in our services, business operations, technology, legal obligations or data protection practices.

When we make changes, we will update the “Last Updated” date and publish the revised Policy through the relevant website or platform. Where required by law, we will provide additional notice of material changes.

We encourage you to review this Policy periodically so you remain informed about how we handle personal data.

Where a change requires consent or another specific legal step, we will take that step rather than treating continued use alone as sufficient consent.

18. Changes to This Privacy Policy

The text for this section is coming soon.

19. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights or have a concern about how Trebor handles personal data, please contact us:

Trebor Finance Limited