Privacy Policy

Bucksfield Asset Management Limited ("Bucksfield", "we", "us", or "our") is a duly registered asset management company in the Federal Republic of Nigeria. We are committed to safeguarding the privacy and personal data of all individuals who interact with our website and services.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information in compliance with the Nigeria Data Protection Regulation (NDPR) 2019 and any subsequent amendments or regulations issued by the National Information Technology Development Agency (NITDA).

By accessing or using our website or services, you acknowledge that you have read and understood this Privacy Policy.

We may collect and process the following categories of personal data:

- **Identity Data:** Full name, date of birth, nationality, government-issued identification number (e.g. NIN, BVN, passport number)
- **Contact Data:** Email address, phone number, mailing address
- **Financial Data:** Bank account details, investment portfolio information, tax identification number (TIN), source of funds
- **Technical Data:** IP address, browser type, device identifiers, cookies, and usage data collected when you visit our website
- **Communication Data:** Records of correspondence, enquiries, and interactions with our team
- **KYC/AML Data:** Information required for Know Your Customer (KYC) and Anti-Money Laundering (AML) compliance

We collect this information directly from you, from authorised third parties (e.g. introducers, custodians), or from publicly available regulatory databases.

We use your personal data for the following purposes:

- To provide, administer, and manage your investment account and related services
- To verify your identity and conduct required KYC/AML checks
- To fulfil our legal and regulatory obligations under Nigerian law, including obligations to the Securities and Exchange Commission (SEC), the Financial Reporting Council, and NITDA
- To communicate with you regarding your investments, account updates, and service changes
- To send you investment insights, reports, or marketing communications where you have provided consent
- To detect, prevent, and investigate fraud, money laundering, or other financial crime
- To improve our website and services through aggregated, anonymised analytics

Under the NDPR, we process your personal data on the following lawful bases:

- **Contract Performance:** Processing necessary to enter into or perform our investment management agreement with you
- **Legal Obligation:** Processing required to comply with applicable Nigerian laws and regulations (e.g. SEC rules, FIRS tax reporting, CBN directives, NDPR)
- **Legitimate Interests:** Processing for fraud prevention, network security, and improving our services, where these interests are not overridden by your rights
- **Consent:** Where we rely on your consent (e.g. for marketing communications), you may withdraw it at any time by contacting us at the details in Section 11

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects without your explicit consent.

We may disclose your personal data to the following categories of recipients, strictly on a need-to-know basis:

- **Regulatory Authorities:** The Securities and Exchange Commission (SEC), the Federal Inland Revenue Service (FIRS), the Central Bank of Nigeria (CBN), NITDA, and other competent Nigerian authorities, where required by law
- **Service Providers:** Custodian banks, fund administrators, technology providers, legal advisers, and auditors who assist in delivering our services, all bound by confidentiality obligations
- **Group Companies:** Affiliated entities within the Bucksfield group, subject to equivalent data protection standards
- **Successors:** In the event of a merger, acquisition, or business restructuring, your data may be transferred to the successor entity

We do not sell, rent, or trade your personal data to any third party for commercial purposes.

We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy and to comply with our legal obligations.

As a SEC-regulated asset manager, we are required to maintain client records for a minimum period specified by applicable SEC regulations (currently a minimum of five (5) years from the end of the business relationship). KYC and AML records are retained in accordance with the Money Laundering (Prevention and Prohibition) Act 2022.

After the applicable retention period, your data will be securely deleted or anonymised.

As a data subject under the NDPR, you have the following rights:

- **Right of Access:** To request a copy of the personal data we hold about you
- **Right to Rectification:** To request correction of inaccurate or incomplete data
- **Right to Erasure:** To request deletion of your data where there is no overriding legal obligation to retain it
- **Right to Restriction:** To request that we limit how we use your data in certain circumstances
- **Right to Data Portability:** To receive your data in a structured, machine-readable format
- **Right to Object:** To object to processing based on legitimate interests or for direct marketing purposes
- **Right to Withdraw Consent:** Where processing is based on consent, to withdraw it at any time without affecting prior processing

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 11. We will respond within 30 days in accordance with the NDPR. You also have the right to lodge a complaint with NITDA.

Our website uses cookies and similar tracking technologies to improve your browsing experience and collect analytical data.

- **Essential Cookies:** Required for core website functionality (e.g. session management). These cannot be disabled.
- **Analytics Cookies:** Used to understand how visitors interact with our website (e.g. pages visited, time on site). Data is aggregated and anonymised.

On your first visit, you will be presented with a cookie consent notice. You may accept or decline non-essential cookies at any time. Please note that disabling certain cookies may affect website functionality.

We do not use cookies for targeted advertising or third-party behavioural tracking.

Our website may contain links to third-party websites, including regulatory bodies, partner platforms, or financial publications. These websites operate independently and have their own privacy policies.

We are not responsible for the privacy practices or content of any third-party websites. We encourage you to review the privacy policy of any external site you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The updated version will be posted on this page with a revised "Last updated" date.

For material changes that significantly affect your rights, we will notify you by email (if we hold your contact details) or by displaying a prominent notice on our website. We encourage you to review this Policy periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact our Data Protection Officer:

Data Protection Officer
Bucksfield Asset Management Limited
Email: privacy@bucksfieldamc.com

If you are not satisfied with our response, you have the right to lodge a complaint with the National Information Technology Development Agency (NITDA) at www.nitda.gov.ng.