Privacy Notice

1.1 This Privacy Notice explains how Bridge and Ladder Synergy Solution Ltd trading as “BridgeX”, collects and processes personal data when you use www.bridgexng.com, the BridgeX mobile applications, communicate with us, create an account, use the marketplace, apply to become a Service Provider or otherwise interact with BridgeX. 1.2 BridgeX will ordinarily act as a data controller for account administration, provider onboarding and verification, marketplace operation, fraud prevention, safety, support, analytics, marketing preferences and compliance because BridgeX determines why and how those activities are carried out. In limited circumstances BridgeX may act as a processor where it handles personal data solely on documented instructions of another controller.

“Account and identity data” name, username, date of birth or age confirmation, email, telephone number, profile photograph and authentication information.

“Provider verification data” government-issued identification details, business registration information, professional licence or qualification details, verification results, references and other category-specific due diligence information.

“Contact and profile data” address, service location, biography, skills, languages, service categories, availability and profile content. “Booking and transaction data” service requests, quotations, booking history, amounts, fees, payment status, refunds, chargebacks, payout references and receipts. Full payment card data should ordinarily be processed by the licensed payment processor rather than stored by BridgeX. “Location data” approximate or precise location where you enable a location-dependent feature, together with service addresses supplied for a Booking. “Communications and support data” messages exchanged through Platform tools, complaint records, support requests, call or chat metadata and evidence you submit.

“Device and technical data” IP address, device identifiers, operating system, app version, browser type, log data, crash data, security events and similar technical information.

“Content and reputation data” reviews, ratings, comments, reports, photographs and moderation records. “Marketing and preference data” marketing choices, notification settings, referral participation and campaign interactions.

“Compliance and safety data” fraud indicators, sanctions or regulatory information where lawfully checked, account enforcement history and records necessary to respond to legal or regulatory requests.

2.1 BridgeX shall not collect sensitive personal data merely because it is available. Where a feature would involve biometric, health, criminal allegation or other higher-risk information, BridgeX will apply a specific necessity assessment, additional safeguards and a Data Protection Impact Assessment where required.

• directly from you when you register, submit a provider application, book a service, communicate, upload Content or contact support
• from Service Providers and Users where they provide information necessary to administer a Booking, complaint or safety matter
• from identity, business, licence, payment, mapping, analytics, messaging and other vendors used to operate the Platform
• from public or official registries where provider verification requires a lawful check
• automatically from your device when you use the website or application, subject to applicable permissions and tracking choices; and f) from regulators, law enforcement, insurers, professional bodies or other lawful sources where necessary for compliance, safety or dispute handling.

“Provide the Platform and perform our contract” to create accounts, authenticate users, match Users and Providers, enable communications, administer Bookings and provide customer support.

“Provider onboarding and verification” to verify identity, business status, professional licences and other stated criteria, relying on contract steps, legitimate interests in marketplace safety, legal obligations where applicable and consent where genuinely required.

“Payments and settlement” to facilitate payments through licensed payment providers, reconcile transactions, administer fees, refunds, chargebacks and provider payouts. “Safety, fraud prevention and security” to prevent account takeover, impersonation, forged credentials, payment fraud, abuse and cybersecurity incidents. BridgeX relies principally on legitimate interests, legal obligations and, in emergencies, protection of vital interests where applicable. “Complaints, disputes and enforcement” to investigate reports, preserve evidence, moderate Content, enforce policies, facilitate resolution and establish, exercise or defend legal claims.

“Legal and regulatory compliance” to comply with the Nigeria Data Protection Act 2023, GAID 2025, consumer, platform, tax, court, law-enforcement and other applicable requirements.

“Analytics and improvement” to understand feature performance, diagnose errors, improve user experience and develop new features, using aggregated or de-identified data where reasonably possible.

“Marketing and communications” to send promotions, product updates or campaigns where BridgeX has a lawful basis and, where required, valid consent. You can opt out of marketing without losing access to core Platform services. “Corporate transactions” to conduct lawful due diligence, financing, restructuring, merger or business transfer, subject to confidentiality and data protection safeguards.

5.1 BridgeX may request access to location, camera, photographs, notifications or similar device features only where a Platform feature needs them. A device permission is not a licence to use the resulting data for unrelated purposes.

5.2 Precise or background location should be collected only where necessary for a clearly stated feature. You can normally change permissions in your device settings, although disabling a necessary permission may prevent that feature from working.

6.1 Provider verification may involve identity documents, business records and professional credentials. BridgeX should minimise copies of identity documents and, where feasible, retain a verification result or token instead of a full document image.

6.2 Where a verification vendor uses facial comparison, liveness detection or other biometric technology, BridgeX will provide an appropriate notice and apply the lawful basis and safeguards required by the NDPA and GAID before such processing is enabled.

• Service Providers and Users, to the extent necessary to arrange and perform a Booking
• payment processors and financial service providers used to process payments, refunds and payouts
• identity, business and professional verification providers
• cloud hosting, database, authentication, mapping, messaging, email, SMS, customer support, analytics, crash reporting and security vendors
• professional advisers, auditors, insurers and financing counterparties under appropriate confidentiality obligations
• regulators, courts, law enforcement or government agencies where disclosure is required or lawfully requested; and g) a purchaser, investor or successor in connection with a lawful corporate transaction, subject to appropriate safeguards. 7.1 BridgeX does not sell personal data merely because a third-party vendor processes it on BridgeX’s behalf. Processors should be bound by appropriate data processing, confidentiality and security terms.

8.1 Some BridgeX vendors may host or access personal data outside Nigeria. BridgeX will identify material transfer destinations and use a transfer mechanism permitted by sections 41 to 43 of the Nigeria Data Protection Act 2023 and the GAID 2025, including an adequacy basis or appropriate safeguards where required. 8.2 Further information about material transfer safeguards may be requested from info@bridgexng.com

9.1 BridgeX retains personal data only for as long as reasonably necessary for the purpose collected, legal or regulatory requirements, fraud prevention, complaint handling, tax and accounting, security and the establishment or defence of legal claims. 9.2 Retention periods will vary by data category. BridgeX should maintain an internal retention schedule covering account records, KYC and verification evidence, transaction data, communications, complaints, content moderation, security logs and legal holds. When retention is no longer justified, data should be securely deleted or irreversibly anonymised.

10.1 BridgeX applies technical and organisational measures appropriate to the nature and risk of processing, which should include role-based access, multi-factor authentication for privileged access,

encryption in transit and at rest where appropriate, security logging, vulnerability management, backups, vendor controls and incident response procedures.

10.2 No internet service is completely secure. You are responsible for keeping your password and onetime codes confidential and for notifying BridgeX promptly if you suspect account compromise.

11.1 BridgeX maintains an incident process for investigating suspected personal data breaches, mitigating harm, documenting the incident and notifying affected persons and the Nigeria Data Protection Commission where required. Where a breach is likely to result in a risk to individuals’ rights and freedoms, the NDPA requires notification to the Commission within 72 hours of awareness, subject to the statutory framework.

12.1 Subject to the conditions and exemptions in applicable law, you may have rights to be informed, access your personal data, correct inaccurate data, request deletion, restrict processing, object to processing, withdraw consent, request portability, and obtain safeguards in relation to certain automated decisions. 12.2 To exercise a right, contact info@bridgexng.com. BridgeX may request information reasonably necessary to confirm identity and protect another person’s data. BridgeX will respond within the period required by applicable law and will explain any lawful refusal or limitation.

12.3 You may complain to the Nigeria Data Protection Commission if you believe your personal data has been processed unlawfully. BridgeX encourages you to contact us first where appropriate so we can investigate and attempt to resolve the issue.

13.1 BridgeX may use automated signals to detect suspicious accounts, prioritise moderation or support marketplace safety. BridgeX should not make a decision producing legal or similarly significant effects solely by automated means unless the processing is lawful and appropriate safeguards, including human review where required, are available.

14.1 Marketing consent is separate from acceptance of the Platform Terms. Where consent is the applicable lawful basis, BridgeX will use an affirmative choice and will not pre-tick marketing consent.

14.2 You may opt out of promotional email, SMS or push notifications using the unsubscribe or preference tools provided. Service, security, transaction and legal notices are not marketing and may still be sent where necessary.

15.1 BridgeX’s initial public marketplace is intended for persons aged 18 or over. BridgeX does not knowingly permit a child to create an ordinary marketplace account. If BridgeX learns that a child’s data has been collected contrary to this rule, BridgeX will take appropriate steps to investigate and delete or otherwise lawfully handle the data.

16.1 The website and mobile applications may use cookies, software development kits, local storage, device identifiers and similar technologies for authentication, security, preferences, analytics and,

where enabled, advertising. Non-essential tracking should be controlled through appropriate consent or preference tools where required.

16.2 A separate Cookie and Tracking Notice should be published once the final production SDK and cookie inventory has been verified.

17.1 BridgeX may update this Notice to reflect legal, product, vendor or operational changes. Material changes will be notified through an appropriate channel and the updated version will state its effective date.

General support: info@bridgexng.com