At NICO Group, we take your privacy seriously. As Malawi's leading financial services provider, we are committed to protecting the personal information you entrust to us. This page explains how we collect, use, and safeguard your data in compliance with the Malawi Data Protection Act, 2024.
Legal Framework
The Malawi Data Protection Act, 2024, governs how we process personal data. The Act designates the Malawi Communications Regulatory Authority (MACRA) as the Data Protection Authority with powers to investigate potential contraventions and ensure compliance.
Under this Act, we are required to:
Process personal data lawfully, fairly, and transparently
Collect data only for specific, explicit, and legitimate purposes
Ensure data is adequate, relevant, and limited to what is necessary
Maintain accurate and up-to-date information
Implement appropriate security measures to protect your data
What Data We Collect
We collect personal data to provide and improve our services across the NICO Group. Depending on your interaction with us, we may collect:
Identity Information: Name, surname, identification numbers
Contact Details: Email address, telephone numbers, physical and postal addresses
Financial Information: Transaction history, credit information, banking details
Technical Data: IP address, browser type, device information, cookies
Sensitive Personal Data: Biometric data, health status, and other special categories as defined under the Act
We collect data when you:
Use our websites, apps, or digital platforms
Complete application forms or contact us
Request quotes, products, or services
Communicate with us through our Call Centre or WhatsApp channels
How We Use Your Data
We process your personal data for the following purposes:
Purpose | Description |
Service Delivery | To provide banking, insurance, pension, investment, and advisory services |
Customer Support | To respond to inquiries, process requests, and offer assistance |
Communication | To keep you informed about products, updates, and important notices |
Improvement | To analyze usage and enhance our websites, apps, and services |
Fraud Prevention | To detect and prevent fraudulent activities |
Regulatory Compliance | To meet legal and regulatory obligations |
Recruitment | To process job applications and candidate information |
How We Protect Your Data
We implement robust technical and organizational measures to safeguard your personal data against unauthorized access, loss, alteration, or disclosure:
Access Control: Data access is restricted to authorized employees who require it for their professional duties
Encryption: Data is encrypted both in transit and at rest where applicable
Data Minimization: We collect only what is necessary for specific purposes
Regular Assessment: We conduct periodic risk assessments and testing of our data processing systems
Restoration Procedures: We maintain procedures to restore data access in case of technical incidents
Data Sharing and Transfer
Information Sharing
We do not sell, trade, or transfer your personal information to third parties, except as required by law or regulation. We may share data:
With subsidiaries within the NICO Group to deliver seamless services
With service providers and partners who assist us in operations (under strict confidentiality)
When required by law, regulation, or court order
With credit reference bureaux as mandated for credit reporting
Cross-Border Transfers
The Data Protection Act restricts the transfer of personal data outside Malawi unless adequate protections are in place. We ensure any international data transfers comply with the Act's requirements, including:
Adequate protection mechanisms (binding corporate rules, contractual clauses, or certification mechanisms)
Assessment of the recipient jurisdiction's data protection standards
Your Rights as a Data Subject
Under the Malawi Data Protection Act, 2024, you have the following rights:
Right | Description |
Right to Access | Request information about the data we hold about you |
Right to Rectification | Request correction of inaccurate or incomplete data |
Right to Deletion | Request deletion of your data under certain circumstances ("right to be forgotten") |
Right to Restrict Processing | Request limitation of how your data is processed |
Right to Object | Object to processing in specific situations |
Right to Data Portability | Receive your data in a commonly used format and transfer it to another controller |
Right to Withdraw Consent | Withdraw consent at any time, where applicable |
Right to Complain | Lodge a complaint with MACRA if you believe your data has been mishandled |
Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and regulatory requirements. Where possible, we specify storage periods for different categories of data.
Data Breach Notification
In the event of a data breach, we are committed to notifying the Data Protection Authority and affected individuals within the timeframe required by the Act.
Contact Us
If you have questions about our data protection practices, wish to exercise your rights, or need to report a concern:
Channel | Contact |
Call Centre | Toll Free 323 |
+265 991 323 323 | |
Postal Address | P.O. Box 501, Blantyre |
Physical Address | Chibisa House, 19 Glyn Jones Road, Blantyre |
You also have the right to lodge a complaint with the Malawi Communications Regulatory Authority (MACRA), the designated Data Protection Authority under the Act.
NICO Group is committed to transparency, accountability, and the highest standards of data protection. Your privacy matters to us.