PRIVACY POLICY FOR TULU ASSET
Introduction
Welcome to Tulu Asset! We are committed to protecting your privacy, confidentiality, security of personal data processed through our website, mobile applications, application programming interfaces, dashboards, onboarding forms, customer support channels and other related digital services with the highest standards of security and care. Tulu Asset is a digital platform designed to empower you by providing a secure and accessible way to manage, grow, and leverage your assets. We believe in creating financial opportunities and fostering economic inclusion through innovative technology.
This Privacy Policy explains how we collect, use, stores, shares, transfers, disclose, retains, and safeguard your information when you use our application, web address and services. We believe that you have a right to know what happens with your data and the rights you may exercise in respects of same.
This policy outlines our practices regarding data that may identify you ("Personal Information") and other data that we collect in connection with your use of the Tulu Asset platform. Our goal is not just to comply with privacy laws, but to earn your trust by being transparent about our data practices.
By using Tulu Asset, you consent to the data practices described in this policy. We encourage you to read this document carefully to understand our views and practices regarding your personal data and how we will treat it. If you have any questions, please do not hesitate to contact us.
Scope of the Policy
This Privacy Policy applies to all data (personal, sensitive, anonymous, or aggregated) that Tulu Asset (referred to as "we", "us" or "our") collects, processes, stores, discloses, transfers, or otherwise uses in connection with the Services offered by the Tulu Asset platform, including but not limited to:
- Users who register, browse, transact, or interact with our Platform (individuals, businesses, developers)
- Any data submitted by Users directly (e.g. profile data, identity verification documents, transaction records)
- Data generated through your use of the Services (e.g. transaction metadata, usage logs, device/application data)
- Data obtained from third parties in connection with providing the Services (e.g. identity verification services, public registries, compliance vendors)
- Data collected via all interfaces including websites, mobile applications, APIs, SDKs, integrations, widgets, or any related tools
This Privacy Policy also covers data processed within jurisdictions where Tulu Asset operates or offers its Services. Where data is transferred across national borders, we will observe applicable global laws, regulations, and safeguards governing cross-border data transfers.
However, this Policy does not apply to:
- Data processed independently by third-party services or websites not controlled by us (except to the extent we facilitate or enable that data exchange)
- Anonymous, aggregated, or de-identified data where individual identification is impossible
- Data related to internal business functions of third parties (e.g. information collected by developers using our APIs for their own internal analytics) unless such data is incorporated into our systems
Information We Collect
When you use or interact with Tulu Asset ("we", "us", or "the Platform"), we may collect various categories of information about you. This may be collected directly from you, from third parties, or generated automatically.
For the purpose of this Privacy Policy:
- Personal Data means any information relating to an identified or identifiable natural person
- Sensitive Personal Data includes any category of data treated as sensitive under applicable law, such as government-issued identifiers, biometric data where collected, financial account information, and other specially protected personal information
- Processing means any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transfer, restriction, deletion, or destruction
- User means any individual or entity representative who accesses or uses Tulu Asset services
- Controller means the entity that determines the purposes and means of processing personal data
- Processor means a party that processes personal data on behalf of a controller
These definitions are included to clarify how this Privacy Policy should be read and applied in practice.
3.1 Types of Information We Collect
Below is a summary of the types of information we collect and how we may use them:
- Identity and Personal Data — full name, date of birth, gender where required, nationality, government-issued identification number, passport details, tax identification details, username, account profile details, photographs, selfies or liveness verification records, and beneficial ownership details where an account relates to a business or legal entity.
- Contact Information — email address, telephone number, residential address, business address, mailing address, and other contact details supplied during registration, onboarding, customer support, or account updates.
- KYC, AML and Due Diligence Information — copies of identification documents, proof of address, bank verification records, politically exposed person screening results, sanctions screening outcomes, source-of-funds or source-of-wealth information, business registration documents, board resolutions, authorised signatory information, and other verification materials.
- Financial Transaction and Asset Data — payment details, bank account information, wallet identifiers, transaction references, asset ownership details, tokenization instructions, fiat or token payment/settlement records, trade history, transfer history, balances, settlement records, and account funding or withdrawal information.
- Usage and Log Data — IP address, browser type, operating system, device identifiers, language settings, login timestamps, session data, cookie identifiers, referral URLs, API request data, usage logs, crash reports, diagnostic reports, geolocation derived from device or network information where permitted, and interaction history across the platform.
- Compliance and Risk Data — AML/KYC screening results, risk scores, sanction/watch-list matches, audit trails.
- Communications and Support Data — records of emails, support tickets, chat conversations, complaint records, feedback submissions, call notes, correspondence history, and communication preferences.
- Derived/Analytical Data — aggregated metrics, behavioral profiles, usage statistics, insights and trends.
- Third-Party Data — Tulu Asset may receive personal data from identity verification partners, payment providers, blockchain analytics providers, fraud monitoring vendors, public registries, regulatory databases, corporate registries, and other lawful third-party sources relevant to onboarding, security, and compliance.
3.2 How Personal Data Is Collected
Tulu Asset may collect personal data through several channels, including:
- Directly from users during account registration, onboarding, verification, transactions, customer support interactions, surveys, or communications
- Automatically through the use of websites, apps, APIs, cookies, logs, and technical tools that monitor system performance and usage
- From service providers, compliance vendors, fraud prevention tools, business partners, payment processors, and public or regulatory databases where lawful and necessary
- From other users or corporate representatives who provide information relating to directors, shareholders, beneficial owners, or authorised contacts as part of business onboarding or transactions
Users are expected to provide accurate, complete, and current information and to notify Tulu Asset of relevant changes when information becomes outdated or inaccurate.
3.3 Purposes for Collection
We collect and use your information:
- To create, verify, administer, and secure user accounts
- To provide platform access and support the use of products, tools, and digital asset services
- To facilitate onboarding, asset tokenization, investment participation, transfers, settlements, and related operations
- To conduct KYC, AML, sanctions screening, fraud detection, identity verification, and risk assessments
- To communicate with users regarding transactions, account activity, updates, support requests, incidents, product notices, and policy changes
- To monitor, maintain, troubleshoot, test, and improve the functionality, performance, reliability, and security of the platform
- To perform analytics, service optimisation, reporting, and business intelligence activities using lawful methods
- To comply with legal, regulatory, audit, tax, reporting, dispute resolution, and law enforcement obligations
- To protect the rights, assets, systems, personnel, users, and legitimate interests of Tulu Asset and relevant stakeholders
- To send marketing communications where permitted by law or where appropriate consent has been obtained, with an option to unsubscribe where required
Tulu Asset will not process personal data for purposes that are incompatible with the purposes originally disclosed unless a lawful basis exists and any required notice or consent will be provided. Users are responsible for providing true, accurate, and complete information and to ensure that such information are updated promptly whenever there is a change (e.g. change of address, legal name, contact info). We may periodically prompt Users to review or revalidate all information submitted or provided on our platform.
Legal Bases for Processing Personal Data
Tulu Asset processes personal data only when there is a lawful basis, in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR) and the Nigeria Data Protection Act. The legal bases for processing personal data may include:
- Consent — where you have provided clear and informed consent for the processing of your personal data for specific purposes (such as subscribing to newsletters, marketing communications, or participation in product research studies).
- Performance of Contract — where processing is necessary to fulfill our obligations under a contract with you, such as providing platform access, creating and managing user accounts, facilitating asset tokenization, or delivering other requested services.
- Legal Obligation — where processing is required to comply with our legal obligations under applicable laws and regulations, such as Anti-Money Laundering (AML), Know-Your-Customer (KYC), tax, or regulatory requirements.
- Legitimate Interests — where processing is necessary for our legitimate interests, provided these interests are not overridden by your rights and freedoms. Legitimate interests may include platform security and integrity, fraud prevention, service improvement, network and information security, and business analytics.
- Vital Interests — where processing is necessary to protect your vital interests or those of another person (such as in emergency cases).
- Public Interest/Task Carried Out in Official Authority — where processing is necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller (where applicable).
Note that Tulu Asset will only process personal data according to these lawful bases and will provide transparency to users regarding the purpose and scope of data collection.
How We Use Your Information
Tulu Asset uses your personal information to deliver, operate, and improve our platform services, ensuring compliance with all relevant data protection obligations (including the GDPR and Nigeria Data Protection Act). We may use your information in the following ways:
- Account Creation and Management — to register new users, manage login credentials, maintain user profiles, and provide access to platform features.
- Asset Tokenization and Transactions — to facilitate the tokenization of real-world assets, execute transactions, enable fractional ownership, and ensure the security of tokenized assets.
- Compliance and Verification — to carry out required KYC, AML, and other legal verification processes to comply with regulatory obligations.
- Communication — to send transactional notifications, platform updates, product/service information, marketing communications (where permitted), and respond to inquiries or requests.
- Security and Fraud Prevention — to detect and prevent fraud, unauthorized access, and activities that may violate platform terms or the law; to monitor and safeguard platform integrity.
- Platform Improvement — to analyze user behavior, preferences, and feedback, helping us improve user experience, develop new features, and optimize our offerings.
- Legal and Regulatory Compliance — to meet obligations imposed by law, regulatory requirements, and enforce our terms of service or protect our legal rights.
- Customer Support — to provide technical support, address complaints, and resolve issues relating to platform usage.
It is important to note that we do not use personal information in ways incompatible with these purposes and will always seek express consent or provide appropriate legal rationale when required by law.
Data Sharing and Disclosure
Tulu Asset takes your privacy seriously and limits data sharing and disclosure to what is necessary to deliver our services, comply with applicable global law, or fulfill business functions. We may share your personal information in the following circumstances:
- Service Providers and Third Parties — trusted third-party vendors who perform services on our behalf (e.g., IT hosting, cloud providers, KYC/AML verification, analytics, payment processing, asset custodians, and marketing support), contractually obligated to safeguard personal data.
- Business Partners and Affiliates — where you engage with products or tokenization features co-developed with our partners, in line with our business processes and your consent.
- Legal and Regulatory Authorities — where required by law, regulation, court order, or governmental request.
- Corporate Transactions — in the event of a merger, acquisition, sale, or restructuring, subject to confidentiality protections.
- With Consent — where you provide informed consent or direct us to share your data with third parties.
- Protecting Rights and Safety — to enforce our Terms of Service, protect the security and integrity of the platform, prevent harm or financial loss, or address fraudulent activity.
It is important to note that we do not sell your personal information for commercial purposes, and we will never disclose your data except as required for legitimate business, legal, or operational purposes. Additionally, where data transfers occur outside your jurisdiction, Tulu Asset will ensure appropriate safeguards under applicable global laws such as GDPR/Nigeria DPA.
However, we may disclose your personal data without further notice to you in the following cases:
- If required by law, regulation, court order, subpoena or other legal process
- To respond to lawful requests by public authorities (e.g. government, law enforcement)
- To protect our rights, property, safety, or the safety of others (e.g. in investigating fraud, security breaches, or threats)
- In connection with legal claims or defending legal action
- If your account is used in a way that violates our Terms, or creates risk for us, other users, or third parties
Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal, regulatory, or business requirements, or as otherwise specified in our privacy policy and data retention schedule. The retention periods vary depending on the type, nature, and sensitivity of the data, as well as applicable global laws:
| Data Type | Retention Period | Purpose / Justification |
|---|---|---|
| KYC / identity documents | Duration of the user relationship + additional period (e.g. 5 years post-termination) | To satisfy regulatory compliance (AML / know-your-customer) |
| Transaction / trading / settlement records | As required by financial / regulatory laws (e.g. 7 years) | To enable audits, dispute resolution, legal compliance |
| Account profile & contact information | Duration of the user's account + period after termination | To maintain records, respond to requests, prevent fraud |
| Usage logs, system logs, API logs | A limited period (e.g. 1–3 years) | For security, performance monitoring, incident investigation |
| Marketing or optional data | Until withdrawn or purpose ends | Based on consent and user preferences |
| Anonymized / aggregated data | Indefinite (where identification is irreversibly removed) | For analytics, benchmarking, platform improvement |
7.1 Deletion, Anonymization & Archival
After the retention period expires or when data is no longer needed for its purpose, we will securely delete, anonymize, or de-identify the Personal Data, unless legal or regulatory obligations require ongoing storage. Anonymized data is no longer treated as personal data and may be used indefinitely for statistical, research, or analytic purposes. In some cases, data may be archived in secure backup systems for disaster recovery or audit purposes until the backup retention period expires.
7.2 User Requests for Deletion / Erasure
Subject to limitations imposed by law or regulatory obligations, you may request deletion or erasure of your personal data. However, we may decline or delay deletion in the following cases:
- Where retention is required by law, regulation, or for compliance (e.g. financial records)
- Where necessary to respond to claims or enforce terms or disputes
- Where we need to preserve data integrity or continuity (e.g. to prevent fraud, abuse)
- Where anonymization is more appropriate than complete deletion
It is important to note that the provisions of this Privacy Policy concerning confidentiality, data subject rights, security, liability, and cross-border transfers shall survive any deletion or termination of data processing.
Data Storage and Security
a) Secure Storage Locations
We store your Personal Data in secure data centers or cloud infrastructure that meet recognized security standards (e.g. ISO 27001, SOC 2, etc.). We may also use encrypted backups (on-site or off-site) to ensure data resilience and recovery in the event of system failures or disasters. Where cross-border storage is involved, we ensure applicable safeguards and compliance with data transfer regulations.
b) Encryption & Access Controls
Personal Data is encrypted at rest and in transit using strong cryptographic protocols (e.g., AES-256, TLS 1.2+ or equivalent). Access to Personal Data is limited on a strict "need-to-know" basis. Only authorized personnel, third-party processors, or contractors who require access to perform their jobs are permitted access. Role-based access control (RBAC) and least-privilege principles are employed to minimize unnecessary access.
c) Authentication & Identity Management
Where applicable, multi-factor authentication (MFA) is required for access to administrative, developer, or sensitive systems containing personal data. Strong password policies, periodic credential rotation, and secure storage of secrets (e.g. inside vaults or secret managers) are enforced.
d) Network & Infrastructure Securities
Firewalls, intrusion detection/prevention systems (IDS/IPS), and boundary protections are deployed to protect infrastructure. Regular vulnerability scanning, penetration testing, and security audits are conducted to identify and remediate weaknesses. Patches, updates, and security fixes are applied in a timely manner to operating systems, databases, software components, and libraries.
e) Logging, Monitoring & Auditing
We maintain audit logs, access records, and change logs to monitor system activity, detect anomalies, and support forensic investigations. Real-time monitoring and alerting are implemented to flag suspicious activity, unauthorized access, or data anomalies. Periodic internal and external security audits and assessments are conducted to verify compliance with this Policy and industry best practices.
f) Incident Response & Breach Management
We maintain a formal Incident Response Plan that includes detection, containment, eradication, recovery, and notification procedures. In the event of a data breach, we will notify affected users and regulatory authorities as required by law. Corrective actions, root-cause analysis, and lessons learned will inform improved security controls.
g) Third-Party Security Requirements
When we engage third-party processors or vendors, we require contractual obligations to maintain equivalent security safeguards for Personal Data. We periodically assess and audit vendor security practices to ensure compliance and alignment with our security standards.
h) Physical Security & Media Handling
Physical access to servers, storage media, and data centers is restricted and controlled via security measures (e.g. access badges, surveillance, locked areas). Disposal or destruction of hardware or storage media containing personal data is done securely (e.g. secure wipe, shredding) to prevent unauthorized recovery.
i) Business Continuity & Disaster Recovery (BC/DR)
We maintain business continuity and disaster recovery plans, including backups, redundancy, and failover infrastructure, to preserve data availability and integrity under adverse conditions. Periodic tests of backup restoration, failover, and restore are conducted to ensure data continuity.
Please note that while we maintain comprehensive security practices, no method of digital storage or transmission over the internet is 100% secure. We encourage users to contact us promptly if they notice any suspicious activity or have specific concerns related to account security.
International/Cross-Border Transfers
In providing our Services, it may be necessary to transfer your personal data across national borders, including to jurisdictions with different or lesser data protection standards than your home country. When doing so, we commit to ensuring that such transfers comply with applicable laws and that adequate safeguards are in place to protect your data.
i. Legal Basis & Compliance
We will only transfer your personal data internationally when one or more of the following legal bases apply, as permitted under applicable law:
- You have consented to the transfer
- The transfer is necessary for performance of a contract (e.g. enabling the Services you requested)
- The transfer is required by a legal obligation (e.g. regulation, law enforcement, court order)
- The transfer is necessary for our legitimate interests, and such interests are not overridden by your rights and freedoms
- Other lawful bases prescribed under data protection laws in relevant jurisdictions
ii. Adequacy & Safeguards
For cross-border transfers, we implement appropriate safeguards to protect your personal data, including but not limited to:
- Standard contractual clauses or model clauses (approved by regulatory authorities) with the recipient
- Binding corporate rules or internal policies ensuring equivalent protection
- The recipient country's adequacy status (where recognized by relevant data protection authorities)
- Encryption or pseudonymization of data during transfer
- Use of secure transfer protocols and encrypted channels
iii. Recipient Jurisdictions
We may transfer data to our affiliates, service providers, custodians, or third-party partners in jurisdictions where we operate or host servers. We maintain a list of such jurisdictions and review them periodically to ensure compliance and appropriateness. If a country lacks statutory protections equivalent to those in Nigeria (or your jurisdiction), we ensure supplementary safeguards through contractual or technical measures before transferring.
iv. Notification & Transparency
When transfers involve sensitive or regulated personal data, we will provide you with notice (in this Privacy Policy or via direct disclosures) regarding the institutions, countries, and safeguards involved. We may also provide you with copies of the relevant safeguards (e.g. contracts, clauses) upon lawful request, subject to confidentiality constraints.
v. Data Subject Rights Across Borders
Even when your data is processed overseas, you retain rights under this Privacy Policy (e.g. access, correction, deletion) and relevant data protection law. You may also raise concerns with supervisory authorities in your jurisdiction. For cross-border transfers to jurisdictions with limited rights frameworks, we will endeavor to ensure your rights to redress remain accessible via contractual obligations or enabling legal mechanisms.
vi. Limitation & Refusal
We may refuse to transfer your personal data to a jurisdiction if we reasonably believe that such transfer would not allow sufficient protection of your rights or would contravene applicable law. In such cases, we may either decline to provide the relevant service requiring the transfer, or provide alternate limited service without cross-border transfer involvement.
Your Rights
As a user of the Tulu Asset platform, you have rights regarding how your personal data is handled, in accordance with applicable laws and regulations (Nigeria Data Protection Act, GDPR, etc.). These include:
- Right to Access — you can request information about what personal data we hold about you and how it is processed.
- Right to Rectification — you may ask for correction of inaccurate or incomplete personal data.
- Right to Erasure ("Right to be Forgotten") — you can request deletion of your personal data where there is no legal requirement for retention.
- Right to Restrict Processing — you may request restriction of processing your data in particular circumstances (e.g., pending a correction).
- Right to Data Portability — you can obtain and reuse your personal data in a commonly used electronic format.
- Right to Object — you may object to the processing of your data for certain purposes, including direct marketing.
- Right to Withdraw Consent — where processing is based on consent, you can withdraw your consent at any time.
- Right to Lodge a Complaint — you have the right to complain to an appropriate data protection authority if you believe your rights have been infringed.
To exercise these rights, please contact us via the details provided in this policy. We will verify your identity before acting on such requests, and respond within the timeframe required by law.
Changes to this Policy
Tulu Asset may update or modify this Privacy Policy from time to time to reflect changes in our practices, legal requirements, platform features, or other operational needs. When we make material changes to how we use or process your data, we will notify you by updating the "Last Updated" date at the top of the policy and, when required, by additional means such as posting a notice on our platform, sending you an email notification, or providing an in-app notice.
We encourage all users to periodically review this Privacy Policy to stay informed of how we protect your personal information. Continued use of Tulu Asset after any changes constitutes your acceptance of the updated policy.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, you may contact us using the information below:
Tulu Asset
[Insert Legal Entity Name & Address]
Phone: [Insert Telephone Number]
Email: privacy@tuluasset.com
You may direct queries related to:
- Accessing, correcting, deleting, or transferring your personal data
- Withdrawing consent where applicable
- Disputing data use or accuracy
- Data breach notifications
- Clarifications on how we process, share, or transfer data
- Complaints or enquiries with respect to data protection
We will strive to respond to your request or inquiry promptly and in accordance with applicable global data protection laws and internal procedures.