Privacy and Data Protection Policy

Introduction

Export Development Bank (“EDB”, “we”, “us”, or “our”) operates the Sadir Mobile Banking Application (“Sadir” or the “App”).

This Privacy and Data Protection Policy explains how EDB collects, accesses, uses, stores, protects, and discloses personal and financial information when you use Sadir and its related mobile banking services.

We are committed to protecting the confidentiality and security of customer information and to processing personal information only for legitimate banking, security, operational, regulatory, and customer-service purposes.

By using Sadir, you acknowledge that your information may be processed as described in this Policy and in accordance with applicable laws and regulations governing EDB and its banking services.

Our Privacy Commitment

• We protect customer information using appropriate technical, organizational, and security measures.
• We limit the collection and use of personal information to what is reasonably necessary for providing and securing our banking services.
• Access to customer information is restricted to authorized personnel and service providers who require access for legitimate business or operational purposes.
• We do not sell customer personal or financial information.
• We do not use customer personal or financial information for third-party advertising or independent third-party marketing.
• Where external service providers support the operation, security, infrastructure, or functionality of Sadir, we require them to handle information in accordance with applicable confidentiality and security requirements.
• We may disclose information when required or permitted by applicable law, regulation, court order, or lawful request from a competent authority.
• We continuously review our privacy and security practices to protect customer information.

Information We Collect

Sadir collects and processes personal and sensitive information that is necessary to provide secure mobile banking services, authenticate users, process transactions, protect customer accounts, prevent fraud, and comply with applicable legal and regulatory requirements.

Sadir does not intentionally collect personal or sensitive data beyond what is necessary for the specific banking service or feature being used.

Where access to a device feature is required, Sadir requests the relevant permission when needed and uses the accessed information only for the disclosed purpose.

Permissions and Device Access

Camera

The App may request access to the camera for supported functions such as identity-document capture, profile verification, QR scanning, or other banking features that require the camera.

Camera access is requested when the relevant feature is used.

Biometric Authentication

Where supported by your device, Sadir may allow you to use biometric authentication, such as fingerprint or other device-supported biometric authentication, to securely access the App or authorize supported actions.

Biometric authentication is handled through the security mechanisms provided by the device operating system. EDB does not use biometric information stored by your device for unrelated purposes.

Device Information

Sadir may process relevant device information necessary for device registration, authentication, security monitoring, fraud prevention, troubleshooting, and App functionality.

SMS Verification

Where SMS-based verification is enabled, Sadir may use SMS-related functionality to support secure device or transaction verification.

The App does not access unrelated SMS content for purposes unrelated to the disclosed banking or security function.

Any SMS-related permission is used only where required by the applicable feature and subject to Google Play permission requirements.

How We Use Your Information

• Verify your identity and eligibility for banking services.
• Register and authenticate your device and account.
• Secure your account and protect your banking information.
• Process transfers, payments, and other transactions you initiate.
• Provide account balances, transaction records, statements, and related banking services.
• Respond to customer-service requests, inquiries, complaints, and support needs.
• Detect, investigate, and prevent fraud, unauthorized access, security incidents, and other unlawful activity.
• Maintain, secure, troubleshoot, and improve the reliability and performance of Sadir.
• Meet banking, anti-money-laundering, regulatory, tax, audit, legal, and other applicable requirements.
• Communicate important service, security, or account-related information to you.
• Maintain and improve our internal systems, controls, and operational processes.

EDB does not use personal or financial information collected through Sadir for third-party advertising or unrelated commercial purposes.

How We Share Your Information

EDB does not sell your personal or financial information.

With Your Authorization

We may disclose information where you have provided appropriate authorization or consent.

Legal and Regulatory Requirements

We may disclose information where required or permitted by applicable law, regulation, court order, legal process, or lawful request from a competent governmental, regulatory, judicial, or law-enforcement authority.

Banking and Financial Services

Information may be shared with relevant financial institutions, payment networks, clearing systems, credit-reference services, or other regulated entities where necessary to process transactions, provide financial services, perform verification, manage financial risk, or meet applicable legal and regulatory requirements.

Technical and Service Providers

EDB may use carefully selected third-party service providers to support the infrastructure, security, maintenance, hosting, communications, authentication, or other technical operations of Sadir.

Such providers may process information only as necessary to perform their services and are required to maintain appropriate confidentiality and security measures.

EDB does not authorize third parties to use customer information for their own advertising or independent marketing purposes.

Sensitive Financial, Authentication, and Biometric Information

Because Sadir is a mobile banking application, it may process personal and sensitive information that is necessary to provide secure banking services.

• Financial and payment information, including account balances, transaction details, transfers, payments, and transaction history.
• Government-issued identification information required for customer identification and regulatory compliance.
• Authentication information, including PINs, passcodes, one-time passwords, and other authentication credentials.
• Biometric authentication used to confirm the user’s identity or authorize access to the App, where supported by the device and enabled by the user.
• Camera and document information where the user activates a feature requiring identity verification, document capture, QR scanning, or another camera-enabled function.

EDB uses this information only for legitimate banking, security, authentication, fraud prevention, customer-service, operational, and legal or regulatory purposes.

EDB does not sell personal or sensitive user data and does not use such information for third-party advertising or unrelated commercial purposes.

Data Security

EDB applies appropriate technical and organizational safeguards to protect personal and financial information against unauthorized access, alteration, disclosure, loss, destruction, or misuse.

• Encryption and secure transmission mechanisms.
• Access controls and authentication measures.
• Restricted access to customer information.
• Security monitoring and fraud-prevention controls.
• Employee confidentiality and security training.
• Technical and operational measures designed to protect the App and supporting systems.

No electronic transmission or storage system can be guaranteed to be completely secure. However, EDB continuously reviews and improves its safeguards to reduce security risks.

Data Retention

EDB retains personal and financial information only for as long as reasonably necessary for the purposes described in this Policy and for as long as required or permitted by applicable banking, legal, regulatory, tax, audit, security, fraud-prevention, or other obligations.

When information is no longer required, EDB will take appropriate steps to securely delete, destroy, or anonymize it, subject to any applicable legal or regulatory retention requirements.

Where information must be retained after an account or service is closed, such information will be retained only for the required purpose and period and will continue to be protected using appropriate security measures.

Account and Data Deletion

Where Sadir allows a user to create or register an account through the App, the user may request deletion of their Sadir account and associated personal data.

EDB will provide an account-deletion mechanism within the App and an external web-based method through an EDB-designated webpage.

When a valid deletion request is submitted, EDB will delete the personal data associated with the account, except where specific information must be retained to comply with applicable banking, financial, anti-money-laundering, fraud-prevention, tax, audit, security, or other legal or regulatory requirements.

Information retained for such purposes will be kept only for the period required by the applicable obligation and will remain subject to appropriate security and confidentiality protections.

Account deletion does not remove records that EDB is legally required to retain.

The external account-deletion webpage must clearly identify the Sadir service and provide users with a straightforward method for submitting a deletion request.

Your Rights and Choices

Access and Correction

You may request access to personal information held by EDB and request correction of inaccurate or incomplete information, subject to applicable legal and banking requirements.

Permission Controls

You may manage or revoke certain device permissions, such as camera or biometric-related permissions, through your device settings. Revoking a permission may prevent some App features from working.

Account and Data Deletion

Where applicable, you may request deletion of your Sadir account and associated personal information using the deletion mechanisms described in Section 10.

Communication Preferences

You may contact EDB to manage permitted communication preferences, subject to communications that EDB is required to provide for security, regulatory, legal, or service-related purposes.

Withdrawal of Consent

Where processing is based on your consent, you may withdraw that consent where permitted by law. Withdrawal of consent may affect EDB’s ability to provide a particular service or feature.

Some rights may be limited where EDB is required by law or regulation to retain or process certain information.

Children’s Privacy

Sadir is intended for individuals who meet the legal age and eligibility requirements for opening and maintaining a bank account under applicable Sudanese law.

Sadir is not designed or intended to knowingly collect personal information from children who are not eligible to use the App or the related banking services.

International Data Transfers

Certain technical services or infrastructure used to operate Sadir may involve processing or storing information outside Sudan.

Where personal information is processed by a service provider outside Sudan, EDB requires appropriate contractual, technical, and organizational safeguards consistent with applicable law and the confidentiality and security obligations described in this Policy.

Changes to This Privacy Policy

EDB may update this Privacy and Data Protection Policy from time to time to reflect changes in:

• Banking services and App functionality.
• Data processing practices.
• Security measures.
• Applicable laws or regulatory requirements.
• Technology and technical infrastructure.

When material changes are made, EDB may notify customers through the App, its website, or other appropriate communication channels.

The Last Updated date at the beginning of this Policy will indicate when the Policy was most recently revised.

Contact Us

If you have questions, concerns, complaints, or requests regarding this Privacy and Data Protection Policy or your personal information, please contact Export Development Bank through the following channels:

Regulatory and Privacy Compliance

EDB is committed to handling customer information responsibly and maintaining privacy, confidentiality, security, and data-protection practices appropriate to the banking services provided through Sadir.

This Policy is intended to provide clear and transparent information about the App’s handling of personal and sensitive user data.

Where applicable requirements of Google Play, Apple App Store, banking regulations, or other competent authorities impose additional obligations, EDB will take appropriate steps to comply with those requirements.