Version 2026-10 · Effective 28 October 2026
Privacy Notice
1.Who we are
This notice is issued by TheSeven Capitals Holdings Ltd, trading as TheSeven Capitals (“TheSeven Capitals”, “we”, “us”), of Lagos, Nigeria. We are the data controller of the personal data described here, within the meaning of the Nigeria Data Protection Act 2023 (the “NDPA”).
It applies to our partners and investors, prospective investors, users of our investor portal and operating system, our staff and consultants (in their use of these systems), and anyone who contacts us. Where our funds or group companies act as separate controllers, they rely on this notice too.
Our Data Protection Officer can be reached at privacy@theseven.capital. For anything else, write to info@theseven.capital.
2.Personal data we collect
We collect only what we need to admit you as an investor, run your account and meet our legal obligations.
Most of this data comes from you. We also receive data from banks and payment processors (payment confirmations), from identity and bank-account verification services, and from public registers such as the Corporate Affairs Commission.
3.Why we use it and our lawful bases
Under section 25 of the NDPA we may process personal data only where a lawful basis applies. We rely on the following:
Where we rely on legitimate interests, we have balanced them against your rights and freedoms. Where we ask for your consent, you may withdraw it at any time without affecting processing that took place before. We do not sell personal data, and we do not use it for advertising. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
BVN, NIN and other government identifiers are sensitive. We collect them only to meet our KYC obligations, restrict them to authorised staff, and mask them wherever full numbers are not needed.
5.International transfers
Some processors above store or access data outside Nigeria. We transfer personal data out of Nigeria only in line with Part VIII of the NDPA: where the recipient country or organisation provides an adequate level of protection, or with appropriate safeguards in place such as contractual clauses that bind the recipient to standards equivalent to the NDPA, and where otherwise permitted by the NDPA. You may ask us for details of the safeguards that apply to your data.
6.How long we keep it
We keep personal data only for as long as we need it for the purposes above or as the law requires:
At the end of the period, we securely delete or anonymise the data, unless a legal claim, investigation or regulatory request requires us to keep it longer.
7.How we protect it
We use technical and organisational measures appropriate to the risk, including:
- encryption in transit (TLS) and at rest for the database and document storage;
- passwords stored only as salted hashes, optional or required two-factor authentication, and automatic sign-out;
- role-based access, so staff and investors see only what their role allows, and investors see only their own records;
- a tamper-evident audit log of sensitive actions, and maker-checker approval for distributions, large journals and administrator access;
- masking of bank account numbers and identifiers on screen, regular backups, and least-privilege access for our providers.
If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it and, where the risk is high, inform you without undue delay.
8.Your rights
Under the NDPA you have the right to:
- be informed about how we use your data (this notice);
- access your personal data and receive a copy of it;
- rectification of data that is inaccurate or incomplete;
- erasure of data we no longer need, subject to the retention duties above;
- restrict processing in certain circumstances;
- data portability: receive data you provided in a structured, commonly used, machine-readable format, or have it sent to another controller;
- object to processing based on legitimate interests, and to direct marketing at any time;
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects;
- withdraw consent where we rely on it.
How to exercise them
Email privacy@theseven.capital from the address we hold for you, or write to us at Lagos, Nigeria. Investors can also review and download their statements and documents in the portal. We may ask you to confirm your identity before acting. We respond within 30 days, free of charge, unless a request is manifestly unfounded or excessive. If we cannot meet a request in full, for example because the law requires us to keep KYC or financial records, we will explain why.
9.Complaints
If you are concerned about how we handle your data, please contact our Data Protection Officer first at privacy@theseven.capital so we can try to resolve it. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), the regulator under the NDPA, through its website at ndpc.gov.ng.
10.Children
Our services are intended for adults and for organisations. We do not knowingly collect personal data from anyone under 18. Where an investment is held for the benefit of a minor, we process the minor's data only with the consent of a parent or legal guardian and only as needed for KYC and the investment.
11.Changes to this notice
We review this notice regularly. This is version 2026-10. If we make material changes, we will update the version and date above and tell investors through the portal or by email before the changes take effect. See also our Terms of Use.