Cookie Policy

Section 1Introduction

Bway Microfinance Bank Limited (‘BWAY’, ‘we’, ‘us’, or ‘our’) is a Central Bank of Nigeria (CBN)-licensed Microfinance Bank committed to protecting the privacy and personal data of our customers, website visitors, and digital banking users. When you visit our website at www.bway.ng, use our internet banking portal, or interact with our mobile banking application, we may place small data files known as ‘cookies’ on your device.

This Cookie Policy (‘Policy’) explains what cookies are, the categories of cookies we use, the purposes for which we use them, the legal basis for their use under the Nigeria Data Protection Act (NDPA) 2023, and how you can manage your cookie preferences. This Policy should be read together with BWAY’s Privacy Notice, which provides a full account of how we collect, use, and protect your personal data.

This Policy applies to all Bway digital platforms, including but not limited to: www.bway.ng (our corporate website); the Bway internet banking portal; the Bway mobile banking application; and any other web-based or app-based service operated by Bway or on Bway’s behalf.

By continuing to use any Bway digital platform after being presented with our cookie consent notice, you acknowledge that you have read this Policy. Where your consent is required for any category of cookies, you will be given the opportunity to provide or withhold it via our Cookie Consent Management Tool, which is described in Section 5 below.

Section 2What Are Cookies?

Cookies are small text files that a website places on your computer, smartphone, tablet, or other internet-connected device when you visit the site. Cookies allow the website or a third party to recognise your device on subsequent visits or as you navigate between pages. They are widely used to make websites work more efficiently, to personalise your experience, and to provide analytics data to site operators.

Cookies are not programs and cannot run software, deliver viruses, or access files stored elsewhere on your device. They do not directly identify you as an individual unless they are linked to personal data you have voluntarily provided, such as when you log into your internet banking account.

• Session Cookies: Temporary cookies that exist only for the duration of your browser session. They are automatically deleted when you close your browser. Session cookies are used to maintain your login state during an internet banking session and to ensure the security of your session.
• Persistent Cookies: Cookies that remain on your device for a defined period after your browser is closed, or until you manually delete them. Persistent cookies are used to remember your preferences and to provide analytics data between visits.
• First-Party Cookies: Cookies set directly by Bway on our own digital platforms. These are used for essential banking functions, session management, and your user experience.
• Third-Party Cookies: Cookies set by third-party organisations (e.g., analytics providers, social media platforms) through our website. These are subject to the privacy policies of those third parties, which we reference in Section 6.

In addition to cookies, we may use similar tracking technologies on our digital platforms, including:

• Web Beacons / Pixel Tags: Small invisible images embedded in web pages or emails that help us track whether you have visited a page or opened an email.
• Local Storage: Browser-based storage used to save data on your device to improve performance of our internet banking platform.
• Device Fingerprinting (limited): Used solely for fraud detection and session security purposes on our internet banking portal. No fingerprinting data is shared with third parties for marketing purposes.

For the purposes of this Policy, references to ‘cookies’ include these similar technologies unless otherwise specified.

Section 3Categories of Cookies We Use

We use four categories of cookies on our digital platforms. The summaries below describe each category; the full cookie inventory for each platform is available upon request from our Data Protection Officer.

Section 4Detailed Cookie Inventory

The following table lists the specific cookies currently in use on Bway’s primary website and internet banking platform. This inventory is reviewed and updated whenever material changes are made to our platforms:

Section 5Cookie Consent and How to Manage Your Preferences

When you first visit any BWAY digital platform, you will be presented with a cookie consent banner that allows you to manage your preferences for each category of non-essential cookie. You can choose to:

• Accept all cookies (Strictly Necessary, Analytical, Functionality, and Targeting).
• Reject all non-essential cookies (only Strictly Necessary cookies will be placed).
• Customise your preferences by switching individual cookie categories on or off.

Your consent preferences are stored in a Strictly Necessary cookie (bway_cookie_consent) and applied on all subsequent visits. You may change your preferences at any time by clicking the ‘Manage Cookie Preferences’ link in the footer of any BWAY webpage.

You have the right to withdraw your consent for non-essential cookies at any time, in accordance with the NDPA 2023. Withdrawing consent is as easy as giving it. To withdraw consent:

• Click the ‘Manage Cookie Preferences’ link at the bottom of any BWAY webpage, or
• Contact our Data Protection Officer at dpo@bway.ng to request that your consent record be updated.

Please note that withdrawing consent for non-essential cookies does not affect the lawfulness of any processing that took place before your withdrawal. Strictly Necessary cookies cannot be disabled as they are essential for our services to function and are not dependent on consent.

You can also control cookies through your browser settings. Most browsers allow you to: see what cookies have been placed on your device; block cookies from specific or all websites; delete cookies that are already stored on your device. Guidance for managing cookies in the most common browsers is provided below:

Please note: blocking Strictly Necessary cookies via your browser settings may prevent you from accessing secure areas of our internet banking portal and may limit the functionality of our digital platforms.

Our Bway mobile banking application may use similar technologies (including local device storage and session tokens) to maintain your session security and personalise your in-app experience. These are governed by the permissions you grant during app installation and through your device’s privacy settings. To manage these:

• On iOS: Settings > Privacy & Security > Tracking and App Privacy Report.
• On Android: Settings > Privacy > Permission Manager.

Our mobile application does not use third-party advertising or tracking SDKs beyond those disclosed in this Policy.

Section 6Third-Party Cookies and Services

Some cookies on our digital platforms are placed by third-party organisations. Bway carefully vets all third-party service providers before integrating their technologies and requires them to execute Data Processing Agreements compliant with the NDPA 2023. However, the data processing activities of third-party providers are primarily governed by their own privacy and cookie policies.

Our website may include social media sharing buttons (e.g., ‘Share on Facebook’, ‘Follow us on Twitter/X’, ‘Follow on LinkedIn’). When you click these buttons or when the page loads (depending on your browser settings), data may be transmitted to those social media platforms. This data collection is governed by the respective social media platforms’ privacy and cookie policies, not by Bway’s policy. We recommend reviewing those policies if you have concerns about data collection by social media networks.

Some pages on our website may contain embedded content from third-party providers (e.g., video content, maps, calculators hosted by third parties). Accessing embedded content may allow those third parties to collect data about your interaction. BWAY endeavours to ensure that embedded content providers are selected with data protection standards in mind, and that they are bound by appropriate contractual protections.

Section 7Personal Data Collected Through Cookies

Through the cookies and similar technologies described in this Policy, Bway and our authorised third-party providers may collect the following categories of data:

• Technical data: IP address (anonymised for analytics purposes), browser type and version, operating system, device type, screen resolution, and referring URL.
• Behavioural data: Pages visited, time spent on pages, links clicked, navigation paths, and search terms used on our platforms.
• Preference data: Language settings, accessibility settings, and previously viewed product or service pages.
• Session data: Authentication session tokens and security challenge responses (used for internet banking security, not shared with any third party).
• Advertising data: For Targeting Cookies only: general interest categories inferred from browsing behaviour on our marketing pages. No sensitive financial data (account balances, transaction history, credit scores) is collected via cookies or shared with advertising third parties.

We rely on the following legal bases under the Nigeria Data Protection Act (NDPA) 2023 for processing personal data collected through cookies:

When you visit our website, our servers automatically log your device’s IP address. IP addresses are used for: system administration and performance monitoring; fraud detection and prevention; security monitoring; and generating aggregated, anonymised statistical reports. For analytical purposes, IP addresses are anonymised before processing. We do not use IP addresses to track your location beyond the country level for fraud prevention purposes, and we do not share raw IP address data with third parties except where required by law or for CBN compliance purposes.

Section 8Data Retention

We retain personal data collected through cookies only for as long as necessary to fulfil the purpose for which it was collected, in accordance with the NDPA 2023 storage limitation principle and CBN data retention guidelines. The retention periods for data collected via each cookie category are:

When data collected through cookies reaches the end of its retention period, it is deleted or anonymised so that it can no longer be attributed to you. You may also request early deletion by exercising your rights as described in Section 9.

Section 9Your Rights as a Data Subject (NDPA 2023)

As a data subject under the Nigeria Data Protection Act (NDPA) 2023, you have the following rights in relation to personal data collected through cookies on BWAY’s digital platforms. We are committed to responding to all valid rights requests within 30 (thirty) days of receipt, in accordance with NDPA 2023 requirements:

To exercise any of the above rights, please contact our Data Protection Officer using the contact details in Section 13. We may need to verify your identity before processing your request. We will respond within 30 (thirty) days of receiving a valid request. If we are unable to comply with your request, we will explain the reasons.

Section 10Cross-Border Data Transfers

Some of the third-party providers whose cookies we use are based outside Nigeria. Where the use of third-party cookies involves transferring your personal data outside Nigeria, we ensure that such transfers are conducted in accordance with the NDPA 2023, Section 43 (restriction on cross-border transfer of personal data). Specifically, we will only transfer personal data outside Nigeria where:

• The receiving country, territory, or international organisation provides an adequate level of data protection as determined by the Nigeria Data Protection Commission (NDPC); or
• Appropriate safeguards are in place, such as standard contractual clauses approved by the NDPC or binding corporate rules; or
• The transfer is necessary for the performance of a contract between you and BWAY; or
• You have provided your explicit consent to the transfer after being informed of the possible risks.

The primary third-party providers whose cookies may involve cross-border transfers are: Google LLC (United States — processes analytics data under EU Standard Contractual Clauses and Data Privacy Framework); Meta Platforms Ireland Ltd (European Union / United States — processes advertising data under EU Standard Contractual Clauses). Bway requires all such providers to execute Data Processing Agreements meeting NDPA 2023 requirements.

Section 11Children’s Privacy

BWAY’s digital platforms and banking services are not directed at individuals under the age of 18. We do not knowingly use cookies to collect personal data from children under 18. If you are a parent or guardian and you believe your child under 18 has provided us with personal data through our digital platforms, please contact our Data Protection Officer immediately at ayomide@bway.ng and we will take steps to delete such data.

Section 12No Unsolicited Communications Policy

Bway does not use data collected through cookies to send unsolicited marketing communications (‘spam’) to you without your prior consent. We will only send marketing communications to you where you have opted in to receive them, in accordance with Bway’s marketing consent process. We will not share your email address or contact details collected via our digital platforms with third parties for marketing purposes without your explicit consent.

If you receive any communication purporting to be from Bway that you believe is unsolicited or fraudulent, please report it immediately to our Data Protection Officer at ayomide@bway.ng. Do not click any links in suspicious emails claiming to be from Bway.

Section 13Complaints and How to Contact Us

If you have any questions, concerns, or complaints about our use of cookies or your personal data, please contact our Data Protection Officer:

If you are not satisfied with our response to your complaint or believe that we are processing your personal data in a manner that is inconsistent with the NDPA 2023, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), which is the national supervisory authority for data protection in Nigeria:

Section 14Changes to This Cookie Policy

Bway may update this Cookie Policy from time to time to reflect changes in technology, applicable law (including new CBN directives or NDPC guidance), or our business practices. When we make material changes, we will:

• Post the updated Policy on this page with a revised ‘Effective Date’.
• Display a prominent notice on our website and digital platforms for a period of not less than 30 days following any material update.
• Where we have your contact details and the change is material to your rights or our use of your data, notify you by email or via in-app notification.

We encourage you to review this Policy periodically to stay informed about how we use cookies. Your continued use of BWAY’s digital platforms after being presented with notice of a material change will constitute your acknowledgement of the updated Policy.

Section 15Governance and Policy Review

This Cookie Policy is owned and maintained by Bway’s Data Protection Officer in collaboration with the Legal & Compliance Department. It is reviewed at least annually and updated promptly following any: material change to Bway’s digital platforms or cookie practices; new or updated guidance from the Nigeria Data Protection Commission (NDPC); changes to the NDPA 2023 or NDPA-GAID 2025; or CBN directions relating to consumer data protection in electronic banking. Final approval of this Policy and any updates lie with the Management Team. The approved Policy is published on Bway’s website and made accessible from the footer of every web page.