Privacy Policy

1. About This Policy

1.1This Privacy Policy explains how First Homes Asset Development & Allied Services Limited (also known as FirstHomes Africa) ("FirstHomes Africa", "we", "us" or "our") collects, uses, shares and protects your personal data when you use the FirstHomes Africa mobile application, our website at www.firsthomes.io and related services (together, the "Platform").

1.2FirstHomes Africa helps you prepare for homeownership. Through the Platform you can create a Home Plan, save towards the equity for your first home through a cooperative savings account, track your Home Readiness Score and, when you are ready and choose to, be presented to participating mortgage lenders. To do this responsibly, we need to handle some personal and financial information about you. This Policy explains what we collect, why, and the control you have.

1.3We process personal data in line with the Nigeria Data Protection Act 2023 ("NDPA"), the Nigeria Data Protection Commission's General Application and Implementation Directive 2025 ("GAID") and other laws that apply to us. Section 14 explains our approach for people outside Nigeria.

1.4This Policy should be read together with our Terms of Service and Cookie Policy. If you join the Cooperative, the Cooperative Bylaws, the in-app Data Sharing Agreement and the Mortgage Readiness Consent also apply.

1.5Using the Platform does not mean you have consented to everything in this Policy. Where we rely on your consent, for example before sharing your profile with mortgage lenders or sending you marketing, we ask for it separately and clearly, and you can withdraw it at any time.

2. Who Is Responsible for Your Data

2.1FirstHomes Africa. First Homes Asset Development & Allied Services Limited (also known as FirstHomes Africa) is a company registered in Nigeria with RC Number 1573828, whose registered office is at 74 Oduduwa Crescent, Ikeja, Lagos, Nigeria. We operate the Platform and are responsible for the personal data we use to provide it.

2.2The Cooperative. When you open a Home Plan Account, you become a member of First Homes Cooperative Multipurpose Society with registeration number 12843 (the "Cooperative"). The Cooperative holds member savings accounts and member records. FirstHomes Africa operates the Platform for the Cooperative and its members. FirstHomes Africa and the Cooperative are each responsible for the personal data they use for their own purposes, and we coordinate so that you can exercise your rights for both through one contact point: privacy@firsthomes.io.

2.3Data Protection Officer. Our Data Protection Officer ("DPO") is Daniel Ohonsi. You can contact the DPO at privacy@firsthomes.io.

3. The Information We Collect

3.1Information you give us or that we collect when you use the Platform. We collect only what we need to run your Home Plan, keep your account secure and meet our legal obligations.

3.2Information we generate about you. Using the information above, we create your Home Readiness Score (shown through the Habit-O-Meter), pillar scores (Contractual Reliability, Equity Strength, Behavioural Maturity, Recovery Resilience, and Identity and Compliance), your readiness level, milestones, projected Mortgage Readiness Date and your Indicative Term Sheet. Section 5 explains how scoring works.

3.3Information from third parties. We receive:

• identity verification results from licensed identity verification providers, which check your BVN and NIN against official records;
• payment and account confirmations from your chosen custodian bank and our payment service providers; and
• basic profile information from social platforms, only if you link an account.

3.4We will only obtain a report about you from a licensed credit bureau with your specific consent.

3.5Information about other people. When you add a next of kin, please make sure they know you are sharing their details with us and point them to this Policy. We do not access your phone contacts. You share your referral link yourself, and we do not collect the contact details of the people you send it to.

3.6What we do not collect. We never ask for or store your online banking username, password or PIN. If you use fingerprint or Face ID login, authentication happens on your device; we receive only a confirmation that it succeeded, not your fingerprint or face data. If you pay by card, your card details are processed by our payment service provider and we do not store full card numbers.

4. How We Use Your Information and Our Legal Bases

4.1Under the NDPA, we must have a lawful basis for each use of your personal data. The table below shows what we use your information for and the basis we rely on.

4.2Where we rely on legitimate interests, we have weighed our interests against your rights and expectations. You can object to this processing at any time (see section 10).

4.3We will not use your information for a new purpose that is unrelated to the purpose for which we collected it without telling you first and, where required, asking for your consent.

4.4We do not sell your personal data, and we do not share it with third parties for their own advertising.

5. Your Home Readiness Score

5.1What it is. The Home Readiness Score, shown through the Habit-O-Meter, is a score from 0 to 100 that measures how prepared you are for homeownership. It is based on how consistently you contribute, how your equity is building, your savings behaviour, how you recover after a missed contribution and whether you have completed identity and compliance steps. It is calculated using automated models, which may include artificial intelligence.

5.2It is a guidance tool. The score is not a credit score and not a lending decision. FirstHomes Africa does not approve or decline mortgages. Participating lenders make their own decisions using their own criteria.

5.3How it affects you. Your score determines your readiness level, the coaching and next best actions we show you, and when you become eligible to request Mortgage Activation.

5.4No black-box scoring. The app tells you why your score changed, what will improve it and what is delaying your Mortgage Readiness Date.

5.5Human review. You have the right not to be subject to a decision based solely on automated processing that significantly affects you. You can ask for a member of our team to review your score or any eligibility decision, give us your point of view and challenge the outcome by contacting privacy@firsthomes.io.

5.6Where we use third-party AI services, we share only the information needed for the task, under a written contract, and we do not permit the provider to use your personal data for its own purposes.

6. Who We Share Your Information With

6.1We share only what each recipient needs for the purpose described.

6.2Service providers who process data for us must act only on our instructions, under written contracts that include the safeguards required by the NDPA.

6.3Custodian banks and mortgage lenders are responsible for the information they receive under their own privacy policies.

6.4When you link a social account, the social platform's own policy applies to its handling of your data. We do not post to your social accounts.

7. International Transfers

7.1Some of our service providers, such as cloud hosting and communication tools, may store or process information outside Nigeria.

7.2We transfer personal data outside Nigeria only where the NDPA permits it: where the destination provides an adequate level of protection, where appropriate safeguards are in place (such as contractual clauses or binding corporate rules), or where another basis in the NDPA applies, such as where the transfer is necessary to perform our contract with you.

7.3You can ask for information about the safeguards we use by contacting privacy@firsthomes.io.

8. How Long We Keep Your Information

8.1We keep personal data only for as long as we need it for the purposes described, or as the law requires. After that, we delete it or anonymise it so it can no longer identify you.

8.2If you ask us to delete information we are legally required to keep, we will tell you what we must keep, why and for how long.

9. How We Protect Your Information

9.1We use technical and organisational measures designed to protect your information, including:

• encryption of data in transit and at rest;
• email one-time passcodes, password controls and optional fingerprint or Face ID login;
• role-based access, so staff can only see the information they need for their work;
• access logging and monitoring;
• due diligence and contracts with service providers; and
• regular review of our security controls.

9.2Your savings are held by licensed partner banks in cooperative savings accounts, not in the Platform itself.

9.3No system is completely secure. Please keep your password and passcodes private. We will never ask you for your password, PIN or one-time passcode.

9.4If a personal data breach is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as the NDPA requires. Where the risk to you is high, we will also tell you without undue delay, explain what happened and what you can do to protect yourself.

10. Your Rights

10.1Under the NDPA, you have the right to:

• be informed about how we use your information (this Policy);
• access a copy of the information we hold about you;
• correct information that is inaccurate or incomplete;
• delete your information, subject to legal retention requirements;
• restrict how we use your information in certain circumstances;
• object to processing based on legitimate interests and to direct marketing;
• withdraw consent at any time, without affecting processing that has already taken place;
• data portability, meaning you can receive your information in a structured, commonly used, machine-readable format;
• not be subject to decisions based solely on automated processing that significantly affect you, including asking for human review of your Home Readiness Score (see section 5); and
• complain to the Nigeria Data Protection Commission.

10.2How to exercise your rights. Contact us through the app or email privacy@firsthomes.io. We may need to verify your identity before acting on a request. We do not charge a fee unless a request is clearly unfounded or excessive.

10.3Timelines. We will respond within 30 days of receiving your request. Corrections to your personal data take effect within 5 business days once we have verified them.

10.4Deleting your account. You can request account deletion in the app or by emailing privacy@firsthomes.io. Before your account can be deleted, any savings balance must be withdrawn and your plan closed in line with our Terms of Service and the Cooperative Bylaws. We will then delete or anonymise your information, except what the law requires us to keep (see section 8).

10.5If you are not satisfied with our response, you can contact our DPO, and you can complain to the Nigeria Data Protection Commission (www.ndpc.gov.ng).

11. Your Communication Choices

• Service messages, such as security alerts, payment confirmations and statements, are part of running your account and cannot be switched off while your account is active.
• Payment reminders, milestone alerts and market insights can be switched on or off in Notifications and Privacy.
• Marketing communications and partner offers are off unless you switch them on. Every marketing email includes an unsubscribe link.
• You can turn off push notifications at any time in your device settings.

12. Children

12.1The Platform is for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it.

12.2If we later offer products that allow parents or guardians to save for a child, we will update this Policy and put in place the parental consent measures the NDPA requires.

13. Cookies and Similar Technologies

13.1We use cookies and similar technologies on our website and app. Non-essential cookies are off by default and are used only with your consent. Please see our Cookie Policy for details and to manage your choices.

14. People Outside Nigeria

14.1The Platform is designed for and offered to residents of Nigeria.

14.2European Union and United Kingdom. If you use the Platform from the EU or UK, the EU or UK General Data Protection Regulation may apply. The rights in section 10 broadly reflect the rights you would have under those laws, and you may also complain to your local data protection authority.

14.3California. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies only to businesses that meet certain thresholds. We do not currently believe we meet them. In any case, we do not sell personal information or share it for cross-context behavioural advertising.

14.4Other African markets. As we expand into other countries, we will publish country-specific supplements reflecting local data protection laws.

15. Changes to This Policy

15.1We will update this Policy when our services or the law change. For material changes, we will notify you in the app or by email at least 30 days before they take effect. The "Last Updated" date at the top shows when this Policy last changed.

16. Contact Us