Privacy Policy

The IDL Staff Cooperative Multipurpose Society Limited (“the Society”, “we”, “us”) is a registered cooperative society owned by and run for employees of Intercontinental Distillers Limited (“IDL”). We hold savings, advance loans, supply commodities on instalment and distribute surplus to our members.

To do that we necessarily handle personal information about our members. This policy explains what we collect, why we collect it, who we share it with and what you can ask us to do about it. It covers the member mobile app, this website, and the administrative portal our staff and committee use to run the Society.

For the purposes of the Nigeria Data Protection Act 2023 (NDPA), the Society is the data controller of the information described here. IDL, as your employer, is a separate controller of your employment and payroll records.

We collect only what membership actually requires. It reaches us in three ways.

Information you give us

• Your PF number and phone number, used to verify you at first sign-in.
• Your email address and profile photo, if you choose to add or update them.
• Applications and requests you submit: loan amount, duration and purpose; the guarantors you nominate; savings change requests and your stated reason; commodity purchase applications and the payment plan you pick.
• Correspondence with the Member Services Desk, including anything you send us by email or raise in person.

Information IDL gives us

Because membership is tied to employment and repayment runs through payroll, IDL shares a limited set of records with the Society: your name, PF number, department, designation, cadre and employment status, and the salary figures needed to apply the statutory deduction limits. We also receive confirmation each month of the amounts actually deducted from your salary.

Information collected automatically

• A device identifier for the phone you bind to your account, so that a stolen PIN alone cannot open your account from another handset.
• A public key generated on your device if you enable biometric sign-in — see clause 7 on what this deliberately does not include.
• Sign-in events, failed PIN attempts and lock-outs, kept for security and fraud investigation.
• An audit record of actions taken on your account in the admin portal — who did what, and when — which is a governance requirement, not an optional extra.

Under the NDPA every use of personal data needs a lawful basis. Ours are set out below alongside the purpose they support.

Running your membership

Opening and maintaining your account, recording your savings balance, issuing statements, and calculating your share of the year-end surplus. Basis: performance of your membership contract with the Society.

Payroll deductions

Instructing IDL each month to deduct your savings contribution and any loan or commodity instalment, and reconciling what was actually deducted. Basis: performance of contract.

Credit decisions

Assessing loan and commodity applications against your savings history, existing exposure and the net-salary deduction cap, and pricing the facility. Basis: performance of contract, and our legitimate interest in lending the members’ shared fund prudently.

Guarantor checks

Confirming a nominated guarantor is eligible, notifying them of the request and recording their acceptance. Basis: performance of contract and legitimate interest.

Security

Verifying your identity by OTP, PIN, bound device or biometric signature; detecting and investigating suspected fraud or unauthorised access. Basis: legitimate interest, and legal obligation.

Notifications

Sending SMS, email and in-app messages about your OTP, loan status, guarantor requests, deductions and dividends. Basis: performance of contract.

Governance and audit

Maintaining the books, minutes and audit trail the Society’s by-laws and cooperative regulators require. Basis: legal obligation.

We do not use your information for advertising, we do not sell it, and we do not make any decision about you by purely automated means without a person reviewing it.

We share your information only where it is necessary for one of the purposes above, and only to the extent needed.

• IDL payroll and HR — the deduction schedule each month, and confirmation of your membership status. Payroll sees the amounts to deduct; it does not receive your loan purpose or correspondence with us.
• Other members acting as your guarantors — a member you nominate sees your name, the loan amount and duration, and the undertaking they are being asked to sign. Guaranteeing is a real financial commitment, so this disclosure cannot be avoided; you control it by choosing whom to nominate.
• Service providers who process data on our written instruction: our cloud hosting provider (Amazon Web Services, EU region), and the SMS and email gateways that deliver your one-time codes and alerts.
• The elected committee and Society staff, on a need-to-know basis, to approve applications and run the Society. Every such access is written to the audit log.
• Auditors, regulators and the courts — the Society’s external auditors, the relevant cooperative authorities, and anyone else we are required by law or court order to disclose to.

Society records are held in managed cloud infrastructure hosted in the European Union, with access restricted to authorised Society systems and personnel. Some of our communication providers may process a message in transit outside Nigeria in order to deliver it.

Where personal data leaves Nigeria, we rely on the transfer conditions permitted by the NDPA and require the recipient by contract to protect it to the same standard set out in this policy, to use it only on our instruction, and to return or delete it when our arrangement ends.

Cooperative records outlive individual transactions — a dividend calculation, an audit or a dispute may need to reach back years. We keep information for as long as it serves the purpose it was collected for, and then for the period we are required to retain it.

Membership record

For the duration of your membership, and for at least six years after you exit and your account is fully settled.

Savings & loan ledger

At least six years from the date of the final entry, to support audit, dividend history and any dispute.

Guarantor undertakings

For the life of the guaranteed loan and at least six years after it is discharged, including a snapshot of the exact wording accepted.

Security & audit logs

Typically 24 months, longer where an investigation or dispute is open.

One-time codes

Minutes — they expire on use or shortly afterwards and are not retained as readable values.

Support correspondence

Up to two years after the matter is closed.

• Your six-digit PIN is stored only as a one-way hash. Nobody at the Society — staff, committee or developer — can read it or tell you what it is.
• Your account is bound to one device. Signing in from a new handset requires a fresh one-time code sent to your registered phone number.
• Biometric sign-in uses a key pair created inside your phone’s secure hardware. Your fingerprint or face never leaves the device and is never transmitted to or stored by us — we only verify a signature the device produces.
• Repeated failed PIN attempts lock the account temporarily rather than allowing an attacker to keep guessing.
• All traffic between the app, this site and our servers is encrypted in transit.
• Administrative access is role-based and every consequential action — approvals, adjustments, status changes — is written to an immutable audit log.

No system is perfect. If a breach occurs that is likely to affect your rights, we will notify the Nigeria Data Protection Commission and, where the risk to you is high, contact you directly with what happened and what to do.

Under the NDPA you have the following rights over the information we hold about you.

• Access — ask for a copy of your personal data and an explanation of how we use it.
• Correction — have inaccurate or incomplete details put right. Your phone number, email and photo you can update yourself in the app.
• Erasure — ask us to delete data we no longer have a reason to keep. This does not extend to ledger, audit and statutory records we are obliged to retain. See deleting your account and data for how to ask and what happens.
• Restriction and objection — ask us to pause a particular use, or object to processing we carry out on the basis of legitimate interest.
• Portability — receive the data you gave us in a structured, machine-readable form.
• Withdraw consent — where we rely on your consent, withdraw it at any time. This does not affect anything done before you withdrew it.
• Complain — raise a complaint with the Nigeria Data Protection Commission if you believe we have handled your data unlawfully.

To exercise any of these, write to the Member Services Desk at support@idlcooperativesociety.com. We will respond within 30 days and will verify your identity before releasing or changing anything.

These public pages carry no advertising or third-party tracking. We set no marketing or analytics cookies, and nothing on the marketing site profiles you across other websites.

The admin portal uses a strictly necessary session cookie to keep an authorised user signed in. It exists only to operate the service you have asked for, and is deleted when the session ends.

Membership is open only to employees of IDL, so our services are not directed at anyone under 18 and we do not knowingly collect children’s data. If you believe we hold information about a child, tell us and we will delete it.

We update this policy when the way we handle information changes. The effective date at the top always reflects the current version. Where a change materially affects your rights, we will notify members in the app or by email before it takes effect.

Questions, requests and complaints about this policy go to the Member Services Desk, which is open Monday to Friday, 9am–4pm.

Email

support@idlcooperativesociety.com

In person

The Member Services Desk, IDL Staff Cooperative Multipurpose Society Limited, at the IDL premises.

Regulator

Nigeria Data Protection Commission — if you are not satisfied with how we have handled your complaint.