Privacy Policy

Erad Investment Limited and its subsidiaries (collectively referred to as "Erad Group", "We", "Our"), is committed to protecting the privacy and personal data of individuals who visit our website, communicate with us, or enquire about our services or interact with us.

This Privacy Policy explains how we collect, use, disclose, store and protect personal data obtained through our website, communications and other interactions with us. It also explains the rights available to you in respect of your personal data.

This Privacy Policy applies to personal data processed by us through our corporate website and related business activities. Where you subsequently engage with any subsidiary or affiliate within the Erad Group, your personal data may also be processed in accordance with this policy or such other privacy policy as may be applicable to that entity or the specific services provided.

We process personal data in accordance with the Nigeria Data Protection Act, 2023 ("NDPA"), subsidiary regulations and other applicable data protection laws.

By accessing or using our website, contacting us or submitting your personal information to us, you acknowledge that your personal data will be processed in accordance with this Privacy Policy.

Once on our website or engaging our services, you will be required to provide your personal information. We recognise that your privacy is important, and are dedicated to protecting your data and privacy. The Personal Information that we collect is used for providing and improving the services we provide to you. We will not use or share your personal information with anyone except as described in this Policy.

By browsing through, accessing or using our website or services, you agree to the collection and use of your information in accordance with this Policy and our Terms of Use, also available on our website. Once you provide consent, you may change your mind and withdraw the consent at any time by contacting us via email at investwithus@eradinvest.co. However, consent withdrawal will not affect the legality of any information processing carried out before your withdrawal of consent.

Personal information as used here includes any data relating to an individual who can be identified directly or indirectly by reference to a name, identification number, address, phone number, any other unique identifiable information which may be collected automatically or from third parties for our website to function properly. ("Personal Information").

We limit the collection and use of non-public personal information to the minimum as we believe is necessary to deliver excellent service to you. Our services may include advising you about your investments, maintaining your account with us and other opportunities.

Disclosure of Personal Information: We do not sell or disclose your Personal Information to third parties except when we believe it is necessary to respond to your enquiry, facilitate our business operations, comply with legal or regulatory obligations, protect our legitimate interests, or where you have otherwise authorised us to do so. Except otherwise indicated in this Policy, we will not make any disclosures of non-public personal information to other third parties who may want to sell their products or services to you.

We may collect the following categories of personal information depending on the nature of your interaction with us:

• identification information such as your name, title and organisation;
• contact information including your email address, telephone number and business address;
• information contained in enquiries, correspondence or requests submitted through our website or by email;
• information submitted when applying for employment opportunities with us;
• information voluntarily provided when subscribing to newsletters, updates or events;
• technical information such as IP address, browser type, operating system, referring website, pages visited and usage statistics;
• general location information derived from your IP address; and
• any additional information you voluntarily provide to us.

For the avoidance of doubt, this website is intended primarily to provide information about Erad Group and facilitate communication with prospective clients, partners, service providers, investors, employees and other stakeholders. Where a visitor subsequently engages with any member of the Erad Group for regulated financial products or services, additional personal information may be collected under any other applicable privacy policy.

When you are asked to provide Personal Information, you may decline, and you may use web browser or operating system controls to prevent certain types of automatic data collection. However, where we need to collect Personal Information by law, or under the terms of a contract we have with you and you fail to provide such information when requested, we may not be able to perform the contract we have or are trying to enter into with you.

We collect data through:

• Enquiries: If you contact us directly, (for an inquiry, application or a support request), we may receive additional personal data about you, including the content of your communications.
• Feedback/Survey Forms: If you voluntarily complete a survey or feedback form, additional information may be collected.
• Mailing List: You may be asked from time to time to join a mailing list, however, you may accept or decline the same. Where you accept, it may be necessary for us to collect additional information.
• Personal data collected automatically or usage information: We automatically receive information about your interactions with our website.
• Device Information: When we receive information about the device and software you use to access our Services, including internet protocol (IP) address, web browser type, operating system version, and device identifiers.
• Location Information: When you use our website or services, we may collect or infer your general location information. For example, your IP address may indicate your general geographic region.
• Personal Information received or inferred from third parties: We may receive additional personal data from third parties and other identification/verification services.

We may retrieve information from public sources such as open government databases and we may infer additional personal data based on the personal data described above.

We require this information to understand your needs, which will enable us to provide you with better products as well as smart service solutions. Other operational reasons:

• Internal record keeping and maintain accurate record of users;
• To improve our products and services;
• To improve our service delivery;
• To contact you occasionally for market research purposes;
• To send emails about new investment opportunities, investment valuation statements or other information which we believe would be of importance to you, however, you will always have the option to unsubscribe if you do not want to receive such information;
• To improve our website through the feedback you provide on products and services; and
• any other purpose that may be disclosed to you in the course of your engagement or interaction with us

We process personal data only where we have a lawful basis to do so. Depending on the circumstances, our lawful basis may include:

• your consent;
• taking steps at your request before entering into a contract or performing a contract with you;
• compliance with our legal and regulatory obligations;
• pursuing our legitimate business interests, provided those interests do not override your rights and freedoms; or
• any other lawful basis recognised under applicable data protection laws.

Where processing is based on your consent, you may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing undertaken before such withdrawal.

We use necessary cookies and similar first-party storage to keep this website working, remember your cookie choices, support security, and manage newsletter popup display preferences. Optional analytics and marketing cookies are not set by the website unless you give the relevant consent through our cookie banner or preferences manager.

Our Cookie Policy lists the active cookie and storage categories, purposes, providers, and expected retention periods. You can review it at /cookie-policy and update your choices at any time using the Cookie settings control in the website footer.

When Analytics consent is granted, we may use Google Analytics 4 and Microsoft Clarity through Google Tag Manager to understand website performance, page engagement, service interest, newsletter conversions, and future lead conversions. These tools help us improve the website, measure campaign effectiveness, diagnose usability issues, and maintain service quality.

The website is configured to use Basic Consent Mode. Google Analytics 4, Microsoft Clarity, and future marketing tags must not make optional analytics or marketing network requests before the relevant consent is granted. If Analytics consent is withdrawn, the website updates supported vendor consent signals and clears known optional analytics cookies where supported.

We do not intentionally send names, email addresses, telephone numbers, full free-text form values, raw referrer URLs, full page URLs with query strings, Sheet record IDs, Google client IDs, Clarity IDs, IP addresses, or other direct contact details as GA4 or Clarity event parameters.

• Google Analytics 4 may receive page paths, approved event names, consented campaign fields, service/category labels, and controlled content identifiers.
• Microsoft Clarity may receive consented sessions, masked interaction data, and approved custom event names for high-value actions.
• Google Tag Manager is the delivery container for GA4, Clarity, and any future approved marketing tags.
• GA4 measurement IDs and Microsoft Clarity project IDs are configured inside the production GTM workspace, not exposed as application variables.

When you subscribe to the newsletter, the email address you submit is sent to our backend and then to an ERAD-controlled Google Apps Script and Google Sheet only after validation. Newsletter analytics events are emitted only after the backend confirms that the Google Sheet write succeeded.

The Google Sheet contains a Subscribers tab for newsletter operations and a Marketing Attribution tab for append-only, non-PII conversion attribution. The Marketing Attribution tab must not contain email addresses, names, telephone numbers, unrestricted form values, raw browser data, or arbitrary query strings.

Approved campaign attribution and consent state may be forwarded to the backend and Sheet so that we can understand how consented newsletter and future lead conversions occurred. Advertising click IDs such as gclid, msclkid, or fbclid are captured or stored only when Marketing consent is granted.

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, to satisfy legal and regulatory obligations, resolve disputes, prevent fraud and abuse, enforce agreements, and maintain appropriate business records.

• Google Analytics 4 retention is set in the ERAD-owned GA4 property and must be reviewed with the DPO or privacy owner before production launch and during quarterly access reviews.
• Microsoft Clarity retention is set in the ERAD-owned Clarity project and must be reviewed with the DPO or privacy owner before production launch and during quarterly access reviews.
• Subscribers records are retained while you remain subscribed and thereafter only as needed for suppression, audit, legal, regulatory, or operational purposes.
• Marketing Attribution records are retained as non-PII conversion attribution records for campaign reconciliation, audit, and analytics-quality review, subject to ERAD's approved retention schedule.
• Newsletter popup local-storage suppression values are retained only to avoid repeatedly showing the popup or to remember that the popup subscription was completed on that browser.

You may unsubscribe from marketing or newsletter communications using the unsubscribe mechanism provided in the communication, where available, or by contacting us at investwithus@eradinvest.co. Once processed, we will stop sending the relevant marketing communication, subject to any legally required or operationally necessary suppression record.

You may request deletion or restriction of personal data using the contact details in this Privacy Policy. For newsletter records, ERAD will locate the relevant Subscriber record, remove or mark the email record according to the approved retention and suppression process, and avoid deleting non-PII Marketing Attribution rows unless required by applicable law or the approved data-governance process.

ERAD prohibits sending personal contact details or unrestricted personal data to GA4 or Clarity through event names, event parameters, page titles, page paths, page URLs, form names, custom dimensions, Clarity custom events, GTM variables, or debug labels.

If analytics or tag configuration accidentally transmits personal data, the incident must be treated as a privacy incident, investigated by the responsible technical owner and DPO or privacy owner, remediated promptly, and documented in ERAD's private operations runbook.

ERAD must review access to Google Sheet, Google Apps Script, Google Tag Manager, Google Analytics 4, Microsoft Clarity, Vercel, and related private operations records at least quarterly. Access should be limited to approved personnel and removed promptly when no longer required.

Category classification, Basic Consent Mode, optional-cookie behavior, analytics retention settings, Clarity masking, and newsletter popup storage classification require DPO or legal approval before production analytics activation. Evidence of that approval is recorded outside this public repository.

The designated analytics technical owner is responsible for tag configuration, environment isolation, event quality, and production smoke checks. The DPO or privacy owner is responsible for privacy classification, retention approval, incident assessment, and data-subject request handling.

Our website may contain links to other websites of interest. However, ERAD Group shall not be responsible for the protection and privacy of any information provided by you while visiting such websites; such websites are not governed by this policy. We recommend that you should exercise caution and review the privacy statement(s) applicable to that website.

Your Personal Information is stored in a manner that reasonably protects it from being accidentally or deliberately compromised, or from misuse, loss, unauthorized access and/or modification. When your Personal Information is no longer needed for the purpose for which it was obtained, we will take reasonable steps to destroy or permanently de-identify your Personal Information. The Personal Information we process will be stored for as long as necessary to fulfil the purposes described in this Policy or our Terms of Use. However, we will also retain your personal information subject to the Nigerian Data Protection Act 2023 (NDPA) and any other applicable laws, to resolve disputes, prevent fraud and abuse, and enforce our legal agreements and policies for a period of 6 years. In addition, we will delete your data for targeted marketing purposes once you unsubscribe from our marketing communications.

We may rely on third-party servers or databases co-located with hosting providers resident in foreign jurisdictions, which constitutes the transfer of your personal data to computers or servers in foreign countries. We take steps designed to ensure that the data we collect under this Policy is processed and protected according to the provisions of this Policy and applicable law wherever the data is located.

Where Personal Information is to be transferred to a country outside Nigeria, we will put adequate measures in place to ensure the security of such Personal Information. Any transfer of Personal Information out of Nigeria will be in accordance with the provisions of the NDPA. In addition, we will use contractual terms to ensure protection of the information or ensure the country has adequate data protection laws as required under the NDPA. Furthermore, we can transfer when we have a legal obligation, need to establish or defend a legal claim, or there is a public interest obligation.

Should you wish to transfer personal data to a country deemed to have inadequate data protection laws, we will take all necessary steps to ensure that informed consent is obtained from you, and you are aware of the risks entailed with such transfer. In any instance, we will ensure Personal Information is transmitted in a safe and secure manner.

Subject to applicable law, you have the following rights in relation to your Personal Information:

• Right of Access: You have the right to request confirmation as to whether we process your personal data and, where we do, to request access to such personal information relating to the processing. You may access your Personal Information in order to update and/ or correct the details, subject to certain exceptions. If you wish to do this, please contact us in writing, however, we will require some form of identification from you before releasing the requested information.
• Right to Rectification: You may request that we correct or update any Personal Information that is inaccurate, incomplete or out of date.
• Right to Erasure: You may request that we delete your personal data where there is no lawful basis for its continued processing, subject to any legal, regulatory or contractual obligations requiring us to retain such information.
• Right to Restrict Processing: You may request that we temporarily restrict the processing of your personal data in certain circumstances, including where you contest its accuracy or object to its processing.
• Right to Object: You have the right to object to the processing of your personal data where such processing is based on our legitimate interests or where your personal data is used for direct marketing purposes.
• Right to Withdraw Consent: Where we rely on your consent to process your personal data, you may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out before such withdrawal.
• Right to Lodge a Complaint: If you believe that your personal data has been processed in violation of applicable data protection laws, you may contact us using the details provided in this Privacy Policy. You also have the right to lodge a complaint with the Nigeria Data Protection Commission or any other competent supervisory authority. Requests relating to the exercise of these rights may be submitted using the contact details provided in this Privacy Policy. We may request sufficient information to verify your identity before responding to your request. We will respond within the period prescribed under applicable law.

You certify that the information provided as a user is correct to the best of your knowledge. Furthermore, when providing the personal data of any other person, you confirm that you are only providing accurate and up-to-date data and with their consent, or if a minor the consent of their parent/s or guardian/s, and in accordance with this Policy.

Any violation of this Privacy Policy should be brought to our attention investwithus@eradinvest.co for appropriate sanctioning and treatment.

We may need to update, modify or amend our Privacy Policy from time to time as necessary or required by law. If we materially change the ways in which we use or share personal data previously collected from you through our Services, we will provide notice or obtain consent regarding such changes as may be required by law. This Policy will apply from the effective date provided on our website.