Guidance Note on Handling Requests for Information (RFIs) from Law Enforcement and Competent Authorities
Introduction
Cardtonic is committed to safeguarding the privacy and security of our users while ensuring full compliance with applicable laws, regulatory directives, and international cooperation standards.This Guidance Note outlines the process, requirements, and principles governing the receipt, assessment, and fulfilment of Requests for Information (RFIs) from law enforcement agencies, regulators, and other competent authorities.
1. Legal Basis for Disclosure
Cardtonic will only disclose user data when:A valid legal instrument has been issued under applicable laws and regulations (e.g., court order, subpoena, regulatory notice, or statutory directive).• The request originates from a competent authority acting within its lawful mandate.• The scope of the request is specific, proportionate, and necessary to achieve its stated objective.• Disclosure is required to meet obligations under Anti-Money Laundering (AML) Regulations, Counter-Terrorist Financing (CTF) Regulations, Cybersecurity and Cybercrime Laws, Data Protection Legislation, including the Nigeria Data Protection Act (NDPA) and, where applicable, the EU General Data Protection Regulation (GDPR).
2. Submission Requirements
All RFIs must be formally submitted via the authorised channel - legal@cardtonic.com and Subject line: Law Enforcement Request – [Agency Name]Each request must:i. Be on official letterhead of the requesting agency.ii. Include the full name, designation, official identification number (if applicable), and contact details of the requesting officer.iii. Cite the specific legal authority under which the request is made.iv. Clearly describe the exact category of information sought (e.g., KYC records, transaction logs, IP addresses).v. Provide sufficient identifiers of the subject/user (e.g., registered email, transaction reference, wallet address).vi. Indicate deadlines or statutory timelines for compliance, where applicable.
3. Verification and Processing
Upon receipt, Cardtonic will:• Authenticate the identity and authority of the requesting entity.• Validate the legal basis and statutory compliance of the request.• Review the request to ensure proportionality and necessity.• Respond within the stipulated legal timeframe using secure communication channels.• Seek clarification if the scope, basis, or details of the request are unclear or incomplete.
4. User Notification Policy
Cardtonic may notify affected users prior to disclosure unless:• Prohibited by law, including cases involving gag orders, secrecy obligations, or confidentiality directives.• Notification may compromise an active investigation, impede enforcement actions, or present a material risk to persons or property.
5. International & Cross-Border Requests
Requests from foreign law enforcement agencies outside Nigeria, Ghana must be channelled through recognised & competent authorities, in line with the Administration of Criminal Justice Acts/Laws, Mutual Legal Assistance Treaties (MLATs), or other applicable international frameworks/instruments.In Nigeria, recognised competent authorities include:• Office of the Attorney-General of the Federation• Nigeria National Central Bureau of INTERPOL• Nigeria Police Force (relevant investigative units)• Economic and Financial Crimes Commission (EFCC) or NFIU• Other authorised national enforcement or regulatory agenciesIn Ghana, recognised authorities include:• Office of the Attorney-General & Ministry of Justice.• Ghana National Central Bureau of INTERPOL• Criminal Investigations Department (CID) of the Ghana Police Service.• Economic and Organized Crime Office (EOCO)• Other authorised national enforcement or regulatory agenciesPlease be informed that direct submissions from foreign agencies that are not routed through such authorities will not be processed, to ensure compliance with due process and applicable data protection laws.
6. Data Preservation Orders
Cardtonic shall retain and preserve all data, RFIs, supporting documents, and responses for not more than five (5) years.If immediate disclosure is not possible, Cardtonic may, upon receipt of a valid and lawful preservation request, securely retain the specified data for the legally prescribed retention period pending receipt of the complete formal request.
7. Data Minimisation
In line with the Nigeria Data Protection Act (NDPA) and applicable international privacy laws, Cardtonic will disclose only the minimum amount of personal data necessary to comply with the legal request. Unrelated personal data shall be redacted or withheld.
8. Secure Transmission
All data disclosed in response to RFIs will be transmitted via secure, encrypted communication channels approved by the Compliance and IT Security teams. No personal data will be transmitted over unsecured networks or via unencrypted formats.
9. Jurisdictional Limitations
Cardtonic will not respond to RFIs from authorities outside its operational jurisdiction unless the request complies with applicable international cooperation frameworks, treaties, and mutual legal assistance protocols.
10. Contact for RFIs and Legal Inquiries
For all RFI submissions, status updates, or clarifications, please contact:legal@cardtonic.com
Disclaimer
Cardtonic will not act on requests that fail to comply with applicable laws/regulations in relevant jurisdictions or that do not meet the requirements outlined in this Guidance Note. All disclosures are handled in accordance with the Nigeria Data Protection Act (NDPA), Ghana Data Protection Act, 2012, applicable AML/CFT regulations, GDPR where applicable, and other relevant regulatory frameworks.Effective Date: 4th day of September, 2025.