Karevault Ltd. Privacy Policy
Welcome to Karevault privacy policy
Karevault Ltd. Privacy Policy
Welcome to Karevault privacy policy
Karevault Ltd. ("Karevault", "we", "us", or "our") is an insurtech company operating in Nigeria. We are committed to protecting the privacy and personal data of our users, customers, and website visitors ("data subjects"). This Privacy Policy outlines how we collect, use, disclose, store, and protect your personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation 2019 (NDPR).
By using our services, website, or mobile application, you consent to the collection, use, and disclosure of your personal data as described in this Privacy Policy.
Personal Data: Any information relating to an identified or identifiable natural person ('Data Subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. This includes, but is not limited to, names, addresses, email addresses, phone numbers, financial details, and health information.
Sensitive Personal Data: Data relating to religious or other beliefs, sexual orientation, health, race, ethnicity, political views, trade union membership, criminal records, or any other sensitive personal information.
Data Subject: Any person who can be identified, directly or indirectly, by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity.
Data Controller: A person who either alone, jointly with other persons or in common with other persons or a statutory body determines the purposes for and the manner in which Personal Data is processed or is to be processed.
Data Processor: A person who processes data on behalf of the Data Controller.
Processing: Any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Karevault adheres to the following principles when processing personal data, as mandated by the NDPR:
a) Lawfulness, Fairness, and Transparency: Personal Data is collected and processed in accordance with specific, legitimate, and lawful purposes consented to by the Data Subject. Processing is conducted fairly and transparently.
b) Purpose Limitation: Personal Data is collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
c) Data Minimization: Personal Data collected is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.
d) Accuracy: Personal Data is accurate and, where necessary, kept up to date. Every reasonable step is taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.
e) Storage Limitation: Personal Data is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
f) Integrity and Confidentiality (Security): Personal Data is processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures.
g) Accountability: Karevault, as the Data Controller, is responsible for and must be able to demonstrate compliance with the principles of data processing.
We collect various types of personal data depending on your interaction with Karevault. This may include:
Identification and Contact Information: Name, address, email address, telephone number, date of birth, gender, marital status, national identification number, passport number, and other valid means of identification.
Financial Information: Bank account details, payment card details, and other financial information necessary for processing insurance premiums and claims.
Insurance-Related Information: Details about your insurance policies, claims history, risk assessment information, and information relevant to underwriting and policy administration.
Health Information: Sensitive personal data related to your health, medical history, and pre-existing conditions, collected only when necessary for providing insurance products and processing claims, with your explicit consent.
Usage Data: Information about how you use our website and mobile application, including IP address, browser type, operating system, pages viewed, and access times. This may be collected through cookies and similar technologies.
Communication Data: Records of your communications with us, including emails, chat transcripts, and telephone call recordings.
Third-Party Data: Information received from third parties, such as insurance brokers, medical professionals, and publicly available sources, where permitted by law and with appropriate consent.
We use your personal data for the following purposes:
To Provide Insurance Services: To process your insurance applications, underwrite policies, administer your insurance policies, process claims, and provide customer support.
To Communicate with You: To send you important information about your policies, updates, marketing communications (with your consent), and respond to your inquiries.
To Improve Our Services: To analyze usage patterns, conduct research, and develop new products and services to enhance your experience.
For Legal and Regulatory Compliance: To comply with applicable laws, regulations, and industry standards, including anti-money laundering (AML) and know-your-customer (KYC) obligations.
For Fraud Prevention and Security: To detect and prevent fraud, unauthorized access, and other illegal activities, and to ensure the security of our systems and data.
For Marketing and Promotions: To send you promotional materials and offers about our products and services that may be of interest to you, where you have provided consent.
We may disclose your personal data to the following categories of recipients:
Affiliates and Subsidiaries: To other companies within the Karevault group for business operations and service delivery.
Insurance Partners: To insurance underwriters, co-insurers, and re-insurers for the purpose of underwriting and managing insurance policies.
Service Providers: To third-party service providers who assist us in our operations, such as IT service providers, cloud hosting providers, payment processors, and marketing agencies. These providers are contractually obligated to protect your data and use it only for the purposes for which it was disclosed.
Medical Professionals and Healthcare Providers: In the context of health insurance claims, with your explicit consent.
Regulatory and Law Enforcement Authorities: To comply with legal obligations, respond to lawful requests, and protect our rights and interests.
Business Transfers: In connection with a merger, acquisition, or sale of all or a portion of our assets, your personal data may be transferred to the acquiring entity.
We will not sell your personal data to third parties.
Your personal data may be transferred to, and stored at, a destination outside of Nigeria. This may occur if our service providers or partners are located in other countries. When we transfer your personal data internationally, we will take all reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy and applicable data protection laws, including implementing appropriate safeguards such as standard contractual clauses.
Under the NDPA and NDPR, you have the following rights regarding your personal data:
Right to be Informed: The right to be informed about the collection and use of your personal data.
Right of Access: The right to request access to your personal data that we hold.
Right to Rectification: The right to request that inaccurate or incomplete personal data be corrected or updated.
Right to Erasure (Right to be Forgotten): The right to request the deletion or removal of your personal data under certain circumstances.
Right to Restrict Processing: The right to request the restriction of processing of your personal data under certain conditions.
Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
Right to Object: The right to object to the processing of your personal data, including for direct marketing purposes.
Rights in Relation to Automated Decision Making and Profiling: The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
To exercise any of these rights, please contact us using the details provided in Section 9.
Karevault implements appropriate technical and organizational measures to protect your personal data from unauthorized access, disclosure, alteration, and destruction. These measures include:
Encryption: Encrypting data in transit and at rest where appropriate.
Access Controls: Implementing strict access controls to ensure that only authorized personnel have access to personal data.
Regular Security Audits: Conducting regular security audits and vulnerability assessments.
Employee Training: Providing data protection and security training to our employees.
Incident Response Plan: Maintaining a robust incident response plan to address any potential data breaches.
While we strive to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure. Therefore, we cannot guarantee absolute security.
If you have any questions about this Privacy Policy or our data protection practices, or if you wish to exercise your data protection rights, please contact our Data Protection Officer at:
Karevault Ltd.
16a, Alhaji Jimoh St, Ogba 101233, Ikeja, Lagos Nigeria.
Email: support@karevault.com
Phone: +234 9069496210
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any significant changes by posting the updated policy on our website and, where appropriate, by other means of communication. We encourage you to review this Privacy Policy periodically.
This Privacy Policy was last updated on 08/08/2025.
This Privacy Policy is effective as of 08/08/2025.