Attend privacy policy

This Privacy Policy explains how Meristem Securities Limited ("Meristem", "we", "us", "our") collects, uses, discloses, and protects personal data when you use the Attend platform ("Attend"), including the AGMs & Investor Relations, Launch Event, and Hackathons & Innovation Challenges, across our mobile apps, web app, and admin portal.

This Policy applies to shareholders, retail and diaspora investors, company secretaries, event organizers, delegates, students, challenge judges, speakers, and any other individual whose personal data we process in connection with Attend. Where we process personal data on behalf of a Client Organization (for example, a listed company's shareholder register for an AGM), we acts as a data processor for that data and the Client Organization acts as data controller; this Policy explains Meristem's own controller-role processing (such as account and platform-usage data) and summarizes the processor-role safeguards that apply to Client Organization data.

Attend processes personal data in accordance with the Nigeria Data Protection Act 2023 ("NDPA"), as well as all other applicable laws, regulations and regulatory requirements governing identity verification services, shareholder records, corporate events and other activities conducted through Attend, as may be amended or replaced from time to time.

Any reference in this Policy to a statute, regulation, rule, or other law is a reference to that law as amended, re-enacted, consolidated, or replaced from time to time, and includes any subordinate legislation, rules, regulations, guidelines, or circulars made or issued under it.

• • Directly from you — when you register an account, register for an event, cast a vote, appoint a proxy, submit hackathon work, or contact support.
• • From Client Organizations — for example, a company or its registrar may upload a shareholder register to enable AGM voting, or an employer may register delegates for a General Client Event. Where such records already incorporate personal identifiers such as BVN or NIN, the Client Organization is responsible for having lawfully collected that data and for having an appropriate legal basis to share it with us. We process it solely to verify identity and administer the relevant event.
• • From identity verification providers — personal identifier matches (e.g BVN and NIN) are performed by licensed third-party verification providers. We receive a verification result and the minimum identifying data necessary, rather than broader banking or national-identity records.
• • Automatically — through use of Attend (device, log, and streaming data as described above).

We process your personal data only where we have a lawful basis for doing so and for purposes that are compatible with the operation of Attend. Depending on your use of Attend and the services you access, we may process your personal data for one or more of the following purposes:

Where we rely on your consent as the legal basis for processing your personal data, you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out before the consent was withdrawn and may affect our ability to provide certain services where the processing is necessary for those services.

Where, for any reason, we collect a sensitive identifier classified as special category data under the NDPA which requires heightened protection, we apply additional encryption, restricted internal access, and minimum-necessary transmission to verification providers for this data. Where an event captures health information (for example, dietary or accessibility requirements for an in-person hybrid component), that data is collected only with your explicit consent and used solely for the stated logistical purpose.

We support Nigerian shareholders, delegates, and other users who live outside Nigeria, including diaspora investors participating in an AGM or participants of any Hackathon Challenge from abroad. Where you access Attend from outside Nigeria, the following applies in addition to the rest of this Policy:

• • Verification: If you hold a BVN or NIN, the standard verification path in Section 4 applies regardless of where you live. If you do not hold either, for example, because you have never held a Nigerian bank account or National Identification Number, we or the relevant Client Organization will offer an alternative verification method, such as international passport verification or another form of identity check performed by a licensed verification provider, so that you are not excluded from participating solely because you live overseas.
• • Applicable law: Your personal data continues to be processed in accordance with the NDPA and GAID. Depending on where you are physically located when you use Attend, the data protection law of that jurisdiction (for example, UK GDPR or EU GDPR) may also apply to the processing of your data by us, independently of your Nigerian citizenship or shareholder status. Where another jurisdiction's law applies and offers you additional or different rights, we will honour those rights to the extent required by that law, without reducing the rights available to you under the NDPA.
• • Voting parity: Diaspora and overseas shareholders have the same electronic voting and proxy rights as shareholders resident in Nigeria. Residence outside Nigeria does not by itself limit your entitlement to vote, appoint a proxy, or access embargoed documents, subject to the Client organisation's governance processes and constitutional documents, applicable laws and the same verification and eligibility requirements that apply to all shareholders under Section 8 of the Terms of Use.
• • Communications and payments: Notifications may be sent to an international phone number or email address, and paid registrations as set by the Client Organisation may be processed in a foreign currency at the rate and fees set by our payment gateway or the Client Organisation. We are not responsible for currency conversion charges or delivery issues caused by your local network or mobile operator.

We retain your personal data only for as long as it is reasonably necessary or legally required to fulfil the purposes for which it was collected, to provide the Attend platform and our services, to comply with applicable legal and regulatory obligations, to resolve disputes, to enforce our agreements and to protect our legitimate business interests.

At the end of the applicable retention period, we will securely delete, anonymise or otherwise dispose of your personal data in accordance with our data retention and disposal procedures, unless we are required or permitted by applicable law or an ongoing legal, regulatory or dispute resolution process to retain it for a longer period.

• • Encryption of personal data in transit and at rest.
• • Multi-factor authentication for account access and, in particular, for AGM voting and proxy actions.
• • Role-based access control restricting internal staff and Client Organization administrators to the minimum data necessary for their role.
• • Vote-integrity controls, including tamper-evident audit logging, to detect and prevent duplicate, altered, or unauthorized votes.
• • Segregation of sensitive identifiers from general profile data, with restricted internal access.
• • Regular security testing and monitoring of Attend's API gateway, identity service, and data storage layers.
• • Documented incident-response procedures, including notification to the Nigeria Data Protection Commission and affected individuals within the timeframes required by the NDPA where a personal data breach poses a risk to your rights.

Subject to applicable exceptions under the NDPA (including exceptions necessary for AGM record integrity during an active voting period), you have the right to:

• a. Access the personal data we hold about you.
• b. Request correction of inaccurate or incomplete personal data.
• c. Request deletion of your personal data, where retention is not required by law (See Section 9 – Data Retention).
• d. Object to or restrict certain processing, including marketing communications.
• e. Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
• f. Request a portable copy of data you provided directly to us, in a structured, commonly used format.
• g. Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise these rights, contact our Data Protection Officer using the details in Section 15. We will respond within the timeframe required by the NDPA, generally within one month of a verified request.

Attend is not directed at children under 13. Specifically, the AGMs & Investor Relations module does not permit participation by minors under any circumstances, regardless of age, as shareholding, proxy appointment, and voting require legal capacity under applicable Nigerian law. Where a Hackathon & Innovation Challenge or similar module admits student participants or other participants who are minors under Nigerian law, we collect only the data necessary for participation and requires organizer confirmation of parental or guardian consent, in accordance with Section 31 of the NDPA regarding processing of a child's personal data.

We do not use fully automated decision-making that produces legal or similarly significant effects on you without human involvement. Vote counting, hackathon scoring aggregation, and identity-verification matching are automated processes. Attend produces the vote tally and audit log directly from votes as cast, without discretionary alteration. Official results and eligibility determinations are formally declared, confirmed and certified by the Client Organization's returning officer, registrar, or judging panel before is is treated as final.

We may update this Privacy Policy to reflect changes in our practices or in applicable law. Material changes will be notified through Attend or by email at least fourteen (14) days before they take effect, except where a shorter period is required by law or regulator direction.

Questions, requests, or complaints regarding this Privacy Policy or your personal data may be directed to our Data Protection Officer at dpo@experienceattend.com. You may also lodge a complaint directly with the Nigeria Data Protection Commission (NDPC).