Fuzu Privacy Policy — Nigeria Addendum

This Nigeria Addendum ("Addendum") forms part of the Fuzu Privacy Policy (the "Global Policy") and applies to the processing of personal data of individuals who access or use the Service from Nigeria, individuals whose personal data Fuzu processes in connection with Nigerian operations, and any other processing that falls within the scope of Nigerian data-protection law.

The Global Policy applies in full to data subjects in Nigeria. Where there is a conflict between the Global Policy and this Addendum on a matter specifically addressed in this Addendum, this Addendum prevails.

In respect of personal data of data subjects in Nigeria processed in connection with Nigerian operations of the Service, the data controller is:

• Fuzu Nigeria Ltd, a company registered in Nigeria with the Corporate Affairs Commission under registration number 1857957, with its registered office at 48, Awolowo Road, Ikoyi, Lagos State, Nigeria.

Fuzu Ltd, the Finnish parent company (business ID FI25462252), continues to act as a controller in respect of group-level processing carried out outside Nigeria and may act as a joint controller with Fuzu Nigeria Ltd in respect of certain group-level activities (such as common platform infrastructure, shared analytics, and AI/ML development). Where Fuzu and Fuzu Nigeria Ltd act as joint controllers, the allocation of responsibilities is described in the joint-controller arrangement made available on the joint controllers page.

Registration status with the Nigeria Data Protection Commission ("NDPC"):

• Fuzu Nigeria Ltd: registration in progress. Registration number to be added upon completion of registration.
• Where required by the Nigeria DPA, Fuzu Nigeria Ltd engages a licensed Data Protection Compliance Organisation ("DPCO").

Fuzu Nigeria Ltd has appointed a Data Protection Officer ("DPO") for Nigeria. The DPO may be contacted at:

• Email: privacy@fuzu.com
• Through your account: account chatline or phone number

Group-level questions may also be directed to the Fuzu group DPO using the contact details in Section 17 of the Global Policy.

Where Fuzu processes personal data of individuals in Nigeria or processes personal data in the course of operating in Nigeria, Fuzu (whether Fuzu Nigeria Ltd or Fuzu Ltd) complies with the Nigeria Data Protection Act, 2023 (the "Nigeria DPA"), the Nigeria Data Protection Regulation, 2019 (to the extent it remains in force), and the standards, guidance, and directives issued by the NDPC.

The lawful bases on which Fuzu processes personal data under the Nigeria DPA correspond to the lawful bases described in Section 5 of the Global Policy and include:

• Performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract;
• Compliance with a legal obligation to which Fuzu is subject;
• Protection of your vital interests or those of another individual;
• Performance of a task carried out in the public interest or in the exercise of official authority;
• Legitimate interests pursued by Fuzu or a third party, except where overridden by your interests, rights, or freedoms; and
• Your consent, which must be freely given, specific, informed, and unambiguous, and which you may withdraw at any time.

For processing of sensitive personal data within the meaning of section 30 of the Nigeria DPA, Fuzu relies on your explicit consent or another lawful basis permitted by the Nigeria DPA.

Sensitive personal data under the Nigeria DPA includes personal data revealing racial or ethnic origin, religious or similar beliefs (such as those reflecting conscience or philosophical beliefs), health or sex life, political opinions or affiliations, trade-union memberships, criminal records or convictions, genetic and biometric data processed for the purpose of uniquely identifying a natural person, and any other personal data prescribed as sensitive personal data by the NDPC.

Fuzu does not ordinarily require sensitive personal data to provide the Service. Where you choose to share such data, you do so voluntarily, and Fuzu processes it only to the extent necessary for the purposes for which you have shared it and on the basis of your explicit consent or another lawful basis permitted by the Nigeria DPA.

As a data subject in Nigeria, you have the rights set out in Part VI of the Nigeria DPA, which broadly correspond to the rights described in Section 13 of the Global Policy:

• The right to information about the processing of your personal data;
• The right of access to your personal data held by Fuzu;
• The right to rectification of inaccurate or misleading personal data;
• The right to erasure of personal data in certain circumstances;
• The right to restriction of processing in certain circumstances;
• The right to data portability where applicable;
• The right to object to processing of your personal data;
• The right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to the exceptions set out in the Nigeria DPA; and
• The right to withdraw consent where processing is based on consent.

You may exercise these rights by contacting the Nigeria DPO using the details in Section 3 above. Many of these rights can also be exercised directly through your account settings.

Personal data of data subjects in Nigeria may be transferred outside Nigeria, including to Finland and other countries of the European Economic Area, the United Kingdom, the United States, and other countries where Fuzu, its affiliates, or its service providers operate.

Such transfers are carried out in accordance with Part IX of the Nigeria DPA (in particular sections 41 to 43) and the NDPC's directives on cross-border data transfers. Fuzu relies on one or more of the following bases for cross-border transfers:

• An NDPC determination that the destination country provides an adequate level of protection;
• Appropriate safeguards, such as standard contractual clauses, binding corporate rules, an approved code of conduct, or a certification mechanism, supplemented where required by Fuzu's transfer-impact assessment;
• Your explicit consent to the transfer, after being informed of the possible risks;
• The transfer is necessary for the performance of a contract between you and Fuzu, or for the implementation of pre-contractual measures taken at your request;
• The transfer is necessary for the conclusion or performance of a contract concluded in your interest between Fuzu and another natural or legal person;
• The transfer is necessary for important reasons of public interest, the establishment, exercise, or defence of legal claims, or to protect your vital interests.

Fuzu maintains a register of cross-border transfers and the safeguards relied upon, available to the NDPC on request.

Data subjects in Nigeria have the right to lodge a complaint with the Nigeria Data Protection Commission. Complaints may be submitted via ndpc.gov.ng or to the NDPC at its current registered address. Data subjects are encouraged to contact Fuzu first using the contact details in Section 3 above so that Fuzu may attempt to address the matter directly.

Where the Service is used to facilitate recruitment or placement of Nigerian Candidates, Fuzu Nigeria Ltd and the relevant Employer or workforce client share personal data in the manner described in Sections 9.1 and 9.4 of the Global Policy. Employers and workforce clients are independent controllers and are responsible for their own compliance with the Nigeria DPA. Where the Service is used to facilitate the placement of Nigerian Users in employment outside Nigeria, additional personal data (such as identity, work-authorisation, and tax information) may be processed in accordance with the Nigeria DPA and any other applicable Nigerian legislation governing overseas placements.

For Nigeria-specific questions about this Privacy Policy or about the processing of your personal data by Fuzu, please contact the Nigeria DPO using the details in Section 3 above.