Privacy Policy

2. Description of the Metric ID Service

Metric ID is intended to help participating banks and authorized financial-service partners collect, validate, verify and manage residential-address information for:

1. New bank-account applications: supporting the verification of an applicant’s declared residential address as part of the participating bank’s account-opening and customer due diligence processes.
2. Existing bank-account customers: supporting reverification of an address previously provided to a bank when the customer reports a change of residence, the bank identifies an outdated or incomplete address, or reverification is otherwise lawfully required.
3. Address corrections and updates: enabling users to submit corrected address information and supporting evidence for review by the authorized bank or verification personnel.
4. Verification status and reporting: communicating whether a verification request is submitted, pending, completed, unsuccessful or requires further information.
5. Fraud prevention and auditability: helping participating institutions identify inconsistencies, prevent misuse and maintain appropriate verification records.

The relevant bank remains responsible for its account-opening decisions, customer acceptance, account restrictions, regulatory reporting and other banking obligations. A verification result does not automatically establish ownership of a property, prove legal title, guarantee identity, or compel a bank to open or maintain an account.

3. Who Is Responsible for Your Data?

Depending on the relevant service agreement and actual processing arrangement:

• BabKem Consulting Services, LTD., may act as a data controller for information it processes to operate, secure and administer Metric ID, and/or as a data processor when it processes information solely on documented instructions from a participating bank.
• The participating bank may act as the data controller for information processed to meet its customer due diligence, account-opening, address-reverification, banking and recordkeeping obligations.
• Authorized verification partners may process limited information to perform address checks or related services under the applicable agreement and legal requirements.

The precise roles will depend on the actual arrangement for each participating bank. Where required, the relevant institution and its role will be disclosed to the user during onboarding or before data collection.

4. Personal Information We May Collect

Metric ID collects only information reasonably necessary for the disclosed verification service and supported by an appropriate lawful basis.

Identity and contact information

Depending on the bank’s requirements, we may collect:

• Full name.
• Telephone number and/or email address.
• A verification reference or user/account identifier.
• Limited identity details required to match a verification request to the correct person.

Government-issued identity numbers, including a National Identification Number (NIN), will be collected or accessed only where the specific service requires it, the relevant legal basis and authorization exist, and the appropriate security and disclosure requirements have been satisfied. Metric ID will not collect such identifiers merely because they may be available.

Residential address information

We may collect:

• House or building number and street name.
• Estate, apartment, landmark or other address description.
• Ward, local government area, city or state.
• Declared current residential address.
• Previous or bank-registered address, where necessary to compare or update records.
• Date of address submission or change.
• Address verification status and supporting verification reference.

Previous addresses will be accessed or processed only where needed for the authorized verification task. Address information will not be made publicly searchable.

Address evidence and verification records

Where the participating bank’s process requires supporting evidence, we may collect:

• Relevant proof-of-address documents.
• Photographs of a building entrance, premises or address evidence.
• Verification notes and results from authorized field personnel.
• Date, time and status of the verification visit or check.
• Limited evidence showing whether the submitted address corresponds with the observed location.

Users will be informed of the evidence required for the relevant verification process. We will not request unrelated documents or photographs.

Location information

If Metric ID uses GPS or other location services, it may process the device’s approximate or precise location to support a disclosed address-verification function, such as confirming that a verification visit took place at a stated location.

Location access will be requested through the relevant device permission and limited to the purpose explained to the user.

When you accept a verification request, the app sets a geofence around the address being verified and records when your device enters, stays in or leaves that area, with the device’s coordinates where available. Because a verification runs over the tracking window chosen by the requesting bank (between one and four days), this happens in the background, including while the app is closed, and only after you give explicit consent in the app. Tracking stops automatically when the window ends, when you decline or cancel the verification, or when you delete your account. Location is not collected outside an active verification.

If location access is not necessary for a particular verification method, Metric ID will not require it for unrelated app functionality.

Technical and security information

We may collect:

• Device type, operating system and application version.
• IP address and session information.
• Authentication and access logs.
• App diagnostics, crash reports and security events, collected through Google Firebase Analytics and Firebase Crashlytics.
• Verification timestamps, transaction or request references and audit records.

We will not collect or link persistent device identifiers to personal information in a manner prohibited by Google Play, Apple App Store or other applicable rules.

Biometric unlock

You may choose to unlock the app with Face ID, Touch ID or your device’s fingerprint or face unlock. The check is performed entirely by your device’s operating system. Metric ID never receives, stores or transmits your biometric data; it only learns whether the check succeeded.

Information we do not intend to collect unnecessarily

Metric ID is not designed to collect bank passwords, PINs, one-time passwords (OTPs), full payment-card credentials or unrelated financial account information for address verification.

Metric ID will not request banking credentials merely to confirm a residential address. Any additional information required for a future feature must be separately assessed, lawfully justified, clearly disclosed and appropriately secured before that feature is introduced.

5. Why We Collect and Use Your Information

We may process your information for the following purposes:

1. To create and manage verification requests.
2. To match a request with the correct user and participating bank.
3. To validate the completeness and consistency of the submitted address.
4. To support an authorized address check, field visit or evidence review.
5. To help a participating bank verify an address for a new account application.
6. To help a participating bank reverify or update an existing customer’s registered address.
7. To communicate verification progress, requests for additional evidence and outcomes.
8. To detect suspicious submissions, impersonation, duplicate requests and potential fraud.
9. To maintain verification logs, audit trails and evidence of completed checks.
10. To provide technical support, maintain system availability and improve reliability.
11. To comply with applicable legal, regulatory, contractual and recordkeeping obligations.
12. To establish, exercise or defend legal claims where lawfully necessary.

We will not use address or identity information for unrelated advertising, commercial profiling, sale of personal data or unrelated marketing. Any new purpose that is materially different from the purpose originally disclosed will be assessed for legal compatibility and will require additional notice or consent where applicable.

6. Lawful Basis for Processing

Depending on the specific processing activity, the relevant controller may rely on one or more lawful bases recognized by the NDPA, including:

• Performance of a contract or steps requested before entering into a contract.
• Compliance with a legal obligation.
• Consent, where consent is the appropriate legal basis.
• Legitimate interests, where permitted by law and after appropriate consideration of the individual’s rights and interests.
• Another lawful basis expressly permitted by applicable data protection law.

Any participating bank’s regulatory obligations do not automatically authorize every form of processing by BabKem. Each processing activity must have an appropriate legal basis.

Where consent is relied upon, it must be appropriately informed and freely given where required. Users may withdraw consent where applicable, without affecting the lawfulness of processing already carried out. Some records may nevertheless need to be retained on another lawful basis.

7. Address Verification Workflow

Subject to the participating bank’s approved process, Metric ID may operate as follows:

1. The user receives or initiates an authorized address-verification request.
2. The user reviews the relevant privacy information and submits the required address details and evidence.
3. Where applicable, the user grants the required location or camera permission.
4. Metric ID validates the submission and securely transmits the relevant information to the authorized verification workflow.
5. An authorized verification partner or bank reviewer performs the applicable checks.
6. The verification status and relevant evidence are provided to the authorized bank or institution.
7. The bank makes its own decision about account opening, account regularization or further customer due diligence.

Metric ID does not guarantee a successful result. An address may require further evidence, manual review or a repeat verification visit.

8. Sharing and Disclosure of Information

We may disclose relevant information only to authorized recipients and for legitimate, disclosed purposes.

Participating Banks

We may share address information, submitted evidence, verification outcomes, timestamps and audit records with the participating bank that requested or is authorized to receive the verification.

Authorized verification partners

We may share the minimum necessary information with contracted field agents, verification providers, technology vendors or other authorized partners involved in carrying out the requested verification.

Technology and infrastructure providers

We may use approved providers for secure hosting, data storage, cybersecurity, application maintenance, communications, diagnostics and technical support. These providers must be subject to appropriate confidentiality, security and data-processing obligations.

Regulators and public authorities

Information may be disclosed where required by applicable law, a valid legal process, a lawful regulatory request or another legally recognized basis.

Corporate transactions

Information may be transferred as part of a lawful merger, restructuring or business transfer, subject to applicable legal safeguards and appropriate notice where required.

We do not sell personal information. We do not publicly disclose residential addresses, government identification numbers, address evidence or verification records. Access is restricted to authorized personnel and recipients with a legitimate need and lawful authority.

9. Data Security

BabKem will implement reasonable and appropriate technical and organizational safeguards proportionate to the sensitivity of address and identity information.

Safeguards may include:

• Encryption in transit and, where appropriate, at rest.
• Role-based access controls and least privilege permissions.
• Secure authentication and access logging.
• Restricted access to verification documents and photographs.
• Secure configuration, software updates and vulnerability management.
• Backup and recovery procedures.
• Monitoring, incident investigation and response processes.
• Confidentiality commitments and staff training.
• Security assessment of relevant technology and verification partners.

Verification personnel should access only the information necessary for their assigned tasks. Sensitive evidence should not be stored on personal devices or shared through unapproved channels.

No technology can guarantee absolute security. If a personal data breach occurs, the controller responsible will assess and manage the incident, notify the relevant authority and affected individuals where required by applicable law, and take reasonable remedial action.

10. Data Storage and International Transfers

Metric ID information will be stored in systems selected and managed according to the service’s security, availability and legal requirements. Access will be limited to authorized users, systems and providers.

BabKem may use cloud or technology providers located in Nigeria or other countries. Any international transfer of personal information will be subject to the NDPA, GAID and other applicable requirements, including relevant transfer conditions and safeguards.

The exact hosting location, service providers and transfer arrangements will be documented internally and disclosed where legally required. BabKem will not represent that all data is stored exclusively in Nigeria unless this is factually accurate.

11. Data Retention and Deletion

We retain personal information only for as long as reasonably necessary to perform the verification, meet applicable legal and contractual obligations, maintain appropriate audit records, resolve disputes and protect against fraud.

Retention will depend on the category of information and the participating bank’s lawful requirements. For example:

• Account and contact information: for the duration necessary to administer the relevant service and any justified follow-up period.
• Address submissions and verification evidence: for the period necessary to complete the verification, provide the results and satisfy documented retention requirements.
• Bank-related audit records: for the applicable legal, regulatory and contractual retention period determined with the participating bank.
• Technical and security logs: for a proportionate period required for security, troubleshooting and compliance.
• Support correspondence: for a reasonable period necessary to resolve the issue and manage related claims.

When information is no longer required, it will be securely deleted, anonymized or otherwise disposed of, subject to applicable legal retention obligations and other lawful exceptions.

A deletion request does not automatically require the destruction of records that a participating bank or other responsible controller is legally required to retain. Where retention is necessary, the responsible party will restrict use to the lawful purpose and explain the applicable limitation where appropriate.

12. User Rights

Subject to applicable law and its exceptions, users may have the right to:

• Request access to their personal information.
• Request correction of inaccurate, incomplete or outdated information.
• Request deletion or erasure of information where legally applicable.
• Request restriction of certain processing activities.
• Object to certain processing.
• Withdraw consent where consent is the applicable legal basis.
• Request information about relevant recipients or transfers.
• Exercise applicable rights concerning automated decisions.
• Lodge a complaint with the Nigeria Data Protection Commission or another competent supervisory authority.

Because the participating bank may determine the purpose and means of certain verification processing, some requests may need to be directed to that bank. BabKem will direct requests appropriately or coordinate with the controller responsible where required.

To protect users against unauthorized disclosure, we may reasonably verify a requester’s identity before responding. Users should not send passwords, OTPs or unnecessary sensitive information by ordinary email.

13. Account Deletion and Verification-Record Requests

Where Metric ID permits users to create an account, users will be provided with an accessible method to request account deletion.

• In-app route: Profile → Delete account
• Online request form: https://metricid.net/delete-account (for users who cannot sign in or no longer have the app)
• Privacy request email: info@babkemconsulting.com

When you delete your account in the app, your access ends immediately, every session is signed out and any active location tracking stops. Metric ID holds your account and verification records, unused, for 3 months so it can answer fraud, dispute and audit queries from a participating bank, then permanently deletes your account, address and verification records, location events and outcomes. Requests made online or by email are handled the same way once we confirm the requester controls the account’s email address.

BabKem will process deletion requests in accordance with applicable law and the responsibilities agreed with the participating bank. The request will cover account information and associated personal information that is required to be deleted and that BabKem is authorized to delete.

Some address-verification records may need to remain with the participating bank for a legally required period. BabKem will not promise immediate deletion of records it is legally required to retain or has no authority to delete. Where appropriate, users will be told which records must remain, why, and for how long.

If Metric ID does not create user accounts, BabKem will provide an appropriate process for users to request access to, correction of or deletion of information, where applicable.

14. Location, Camera and Field Verification

If a feature uses GPS, camera access or photographs of premises, Metric ID will explain the purpose before the relevant collection and request device permissions as required.

Location and photographic evidence will be used only for the disclosed verification or security purpose, subject to the applicable lawful basis and retention schedule.

Metric ID will not use location information to continuously track users unless a specific feature genuinely requires it, the practice is lawful, the user has been appropriately informed, and the necessary platform permissions and approvals are in place.

Users should avoid including unrelated people, private documents or sensitive material in submitted photographs. Access to submitted evidence will be restricted to authorized verification personnel and other legitimate recipients.

15. Automated Checks and Human Review

Metric ID may use automated checks to identify incomplete addresses, inconsistent information, duplicate submissions or potential fraud.

Automated checks may support a verification result but will not be represented as infallible proof of residence. Where a decision with legal or similarly significant effects is made solely by automated processing, the controller responsible will implement the safeguards required by applicable law, including human review or intervention where required.

The participating bank remains responsible for its account-opening and customer due diligence decisions.

16. Children’s Privacy

Metric ID is designed for address verification associated with banking customers and authorized applicants. It is not intended to target children unless a participating bank’s lawful process expressly requires a child’s information and the necessary legal authority, parental or guardian involvement, and safeguards are in place.

We will not knowingly collect children’s personal information outside a lawful and appropriately safeguarded process.

17. Third-Party Services

Metric ID may rely on third-party hosting, mapping, communication, identity-verification or security services. Such providers may process limited information necessary to perform their contracted functions. These currently include Google Maps Platform (displaying maps and converting a submitted address into map coordinates, which sends that address to Google) and Google Firebase (app analytics and crash reporting).

BabKem will assess relevant providers, establish appropriate contractual safeguards and update their disclosures when material data practices change.

Where a bank or independent service provider acts as a separate data controller, its own privacy notice may also apply. Users should review that notice when directed to the relevant provider.

18. Intellectual Property and Confidentiality

Metric ID’s software, source code, algorithms, application design, interface, branding, trademarks, documentation, databases and other materials owned by or licensed to BabKem are protected by applicable intellectual-property laws.

Except as permitted by law or authorized in writing, users may not reproduce, distribute, modify, reverse engineer, commercially exploit or misuse BabKem’s protected materials.

Users retain the rights afforded to them by law in their personal information and submitted materials. This Policy does not transfer ownership of a user’s personal information to BabKem. BabKem may process submitted materials only as necessary for the disclosed service, under applicable terms and lawful instructions.

19. Changes to This Policy

We may update this Policy to reflect changes to Metric ID, participating-bank requirements, technology, data practices or applicable law.

The latest version will be published at the official privacy-policy URL with an updated “Last Updated” date. Where a material change requires additional notice or consent, BabKem or the responsible controller will provide it as required by law.

20. Contact and Complaints

For privacy enquiries, access or correction requests, deletion requests, consent withdrawals or complaints, please contact:

Please identify Metric ID and describe your request. Do not include passwords, OTPs, full bank credentials or unnecessary sensitive information in your message.

You may also submit a complaint to the Nigeria Data Protection Commission (NDPC) or another competent supervisory authority, subject to the applicable legal framework.

21. Applicable Law

This Policy is intended to support compliance with the Nigeria Data Protection Act 2023, the General Application and Implementation Directive 2025, and other applicable legal requirements, together with relevant Google Play and Apple App Store privacy requirements.

Nothing in this Policy removes or restricts any right or obligation that cannot lawfully be excluded.

End of Metric ID Privacy Policy. © BabKem Consulting Services, LTD. All rights reserved.