Document Ref: PS-MS/DPCS/2026-V1
Last Reviewed: June 20, 2026
Effective Law: Nigeria Data Protection Act (NDPA) 2023
Data Controller: Pearl Systems Limited (Operator of MamaSave)
1. CORPORATE COMMITMENT
PEARL SYSTEMS LIMITED (“the Company”) is fully committed to maintaining the highest standards of data privacy, technical security, and operational integrity across our digital micro-savings and fintech ecosystem, MamaSave (accessible via mamasave.ng).
This Data Protection Compliance Statement (“Statement”) outlines the technical, administrative, and legal safeguards implemented by the Company to guarantee that all processing of personal identifiable information (PII) aligns completely with the Nigeria Data Protection Act (NDPA) 2023 and all administrative guidelines issued by the Nigeria Data Protection Commission (NDPC).
2. DATA PROTECTION OFFICER (DPO) AND ACCREDITATION
In compliance with Section 32 of the NDPA 2023, Pearl Systems Limited has designated an internal Data Protection Officer (DPO) to oversee corporate data processing operations, conduct continuous privacy impact assessments, and serve as the official liaison with the NDPC.
-
Designated Data Desk: Privacy and Compliance Team
-
Official Channel: privacy@mamasave.ng
The Company retains a licensed Data Protection Compliance Organisation (DPCO) to perform independent data audits and file our statutory Annual Compliance Returns with the Commission.
3. TECHNICAL & ARCHITECTURAL SAFEGUARDS
To protect sensitive financial metadata, user Bank Verification Numbers (BVN), and daily transaction logs from unauthorized access, loss, or alteration, Pearl Systems Limited enforces an enterprise-grade security framework built natively into the MamaSave source code and server infrastructure:
-
Data Encryption in Transit: All telemetry transmitted between user mobile applications, field agent devices, the mamasave.ng portal, and external core banking endpoints is encrypted utilizing secure, modern Transport Layer Security protocols (TLS 1.2/1.3).
-
Data Encryption at Rest: Critical user profile databases, bank account mappings, and verification credentials are encrypted at rest using Advanced Encryption Standard (AES-256) architectures.
-
Cryptographic PIN Hashing: User passwords and transactional security PINs are never stored in plain text. They are securely transformed using industrial-grade, salted cryptographic hashing algorithms before being recorded.
-
Role-Based Access Controls (RBAC): Tight access controls ensure that Field Collection Agents can only view the basic name and daily collection targets of savers in their explicit, pre-assigned market zone. Deep ledger logs and database records are restricted strictly to authorized backend administrators.
-
Device Mapping & Session Controls: To eliminate unauthorized session cloning or remote hijacking, user and agent profiles are programmatically mapped to verified unique device configurations.
4. BANK VERIFICATION NUMBER (BVN) AND KYC PROCESSING SANITY
In full alignment with Central Bank of Nigeria (CBN) Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) laws, MamaSave collects BVNs exclusively for identity sanitization and fraud prevention.
-
The BVN validation pipeline utilizes secure, direct read-only API integrations through licensed Payment Service Providers (PSSPs).
-
Pearl Systems Limited does not store raw BVN databases internally. We only cache the boolean verification status flags required to authenticate that the account owner matches their submitted government identification.
5. DATA RETENTION AND DISPOSAL SCHEDULE
Pursuant to Section 24(1)(e) of the NDPA 2023 and binding Nigerian financial bookkeeping acts:
-
All transactional data, ledger balances, and KYC metadata are systematically retained for a mandatory operational period of five (5) years starting from the date a user officially terminates their relationship with MamaSave.
-
Upon expiration of this statutory retention timeline, records are permanently expunged utilizing secure database sanitization tools or transformed into completely anonymized numerical datasets for long-term platform macro-analysis.
6. INCIDENT MANAGEMENT AND BREACH NOTIFICATION PLAYBOOK
Pearl Systems Limited operates an active Incident Response Playbook to handle data anomalies, anomalous server traffic patterns, or security alerts.
In strict adherence to Section 40 of the NDPA 2023, where a material data breach is validated that poses a risk to the rights and freedoms of data subjects, Pearl Systems Limited will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of formal discovery. Impacted platform users will be systematically alerted via registered communication channels (SMS/Email) outlining the nature of the event and immediate remediations deployed.
7. FIELD COLLECTION AGENT COMPLIANCE MANAGEMENT
Since MamaSave relies on physical Field Collection Agents to manage daily market transactions, the Company legally binds all field staff to strict data handling constraints via a comprehensive Field Collection Agent Agreement:
-
Agents are strictly prohibited from writing down, photographing, or copying customer records onto external notebooks or personal local device storage.
-
Agents must perform all entry tasks dynamically within the secure, sandboxed application workspace in front of the customer.
-
Any data leakage or unauthorized access caused by an agent’s malicious behavior or negligence results in immediate profile deactivation, termination of the independent contractor engagement, and immediate referral to national law enforcement authorities.
8. LEGAL EFFECT AND FILING STATUS
This statement is updated periodically to stay in perfect harmony with evolving administrative regulations. It serves as an active testament to the data handling architecture of our digital application assets. Pearl Systems Limited performs data mapping loops regularly to remain fully compliant, auditable, and secure on day one of operation.
For corporate compliance inquiries, please write to: The Compliance Desk, Pearl Systems Limited
compliance@mamasave.ng | https://mamasave.ng