Privacy & Data Policy

This policy explains how personal data would be handled by the proposed FMBN Payments & Collections portal (“the portal”), operated by the Federal Mortgage Bank of Nigeria (“FMBN”, “we”, “us”). It covers people who make payments, verify receipts or contact support through the portal. Payments are collected by Adept-Nexus Atelier Limited, appointed by FMBN as its collection agent, and are processed by Paystack.

It supplements FMBN's official Personal Data Policy. Where the two differ, the official policy applies.

We collect only what is needed to process your payment and issue your receipt:

• Identity and contact details — your full name or company name, email address and, if you choose to give it, your phone number. The portal does not send emails; your email address is kept with the payment record as a contact detail.
• Payment details — the service you are paying for (rent / lease or service charge), the FMBN building and the unit, suite or office you state, the amount you enter and the payment reference.
• Transaction records from Paystack — confirmation that a payment was received, its amount and time, how it was paid and related transaction details as reported by Paystack. Card and banking details are entered on Paystack's secure checkout, not on the portal; we never see or store your internet banking password, full card number or PIN.
• Support requests — what you tell us when you contact support.
• Technical data — your IP address and basic request information, used for security, fraud prevention and rate limiting.

We use your data to:

• create your payment advice and secure payment link, and confirm your payment with Paystack;
• issue your receipt and allow it to be verified;
• contact you about your payment where necessary and respond to support requests;
• reconcile payments, handle refunds and resolve problems;
• meet FMBN's legal and regulatory obligations, including anti-money laundering (AML/CFT/CPF), audit and financial reporting; and
• protect the portal and its users from fraud and misuse.

We do not sell your data or use it for marketing.

We process personal data under the Nigeria Data Protection Act 2023 (NDPA). The main lawful bases are the performance of the transaction you ask us to carry out, compliance with FMBN's legal obligations, FMBN's legitimate interest in keeping payments secure and accurate, and — where we ask for it — your consent.

Access within FMBN is role-based. Only authorised staff who need your data for their work — for example finance, estate management or support officers — can see it, and actions taken on payment records are recorded in a tamper-evident audit trail.

We share data only where necessary with Adept-Nexus Atelier Limited, the collection agent appointed by FMBN, with Paystack and the banks that process your payment (your name, email address, what you are paying for, the amount and the payment reference are passed to Paystack), with auditors and regulators, or where the law requires it. These parties must protect your data.

Anyone with a receipt number or QR code can check whether a receipt is genuine. Verification shows only non-sensitive details such as the receipt number, amount, date, payment type and status. It does not show your email address, phone number or bank account details.

Payment and receipt records are financial records and are kept for as long as FMBN is required to keep them for accounting, audit and legal purposes. Support requests and technical logs are kept only as long as needed to resolve the matter and protect the service. When data is no longer needed it is securely deleted or anonymised.

The portal uses encrypted connections, role-based access controls, rate limiting and audit logging. No system can be guaranteed completely secure, but we take reasonable steps to protect your data and will act promptly if we become aware of a problem.

Under the NDPA you have rights over your personal data, including the right to:

• be informed about how your data is used;
• access a copy of the data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete data or restrict its use, where we are not required to keep it;
• object to certain processing and withdraw consent where processing relies on consent; and
• complain to the Nigeria Data Protection Commission.

Some rights are limited where FMBN must keep financial records by law.

To exercise your rights or ask about this policy, use the contact form or email info@fmbn.gov.ng. For FMBN's full approach to personal data, read the official Personal Data Policy.