Country-Specific Privacy Rights Addendum

This Addendum supplements the Privacy and Data Protection Notice.

The Privacy Notice explains what information may be collected, where it comes from, why it is processed, how it may be shared, how it is secured and how long it may be retained.

This Addendum focuses on rights and procedures that vary according to applicable law.

Where an applicable law grants a mandatory right that is more specific or protective than the general Privacy Notice, that mandatory right will be preserved.

Where this Addendum provides a broader voluntary process than the law requires, 6membership may still apply reasonable identity, security, fraud-prevention and legal-retention controls.

A reference to a jurisdiction does not mean that its law governs every 6membership visitor or activity.

6membership will not represent that it is automatically subject to a law merely because a person can access the public website from that jurisdiction.

Jurisdiction, territorial scope and statutory thresholds will be assessed according to the relevant law.

A person does not waive a non-excludable privacy right by applying for membership, accepting the Membership Terms, paying a fee or using the website.

A consent checkbox will not be used to remove a right that applicable law makes mandatory.

A request should identify the person making it, the right being exercised and the relevant application, Flutterwave transaction, refund, chargeback or membership record where available.

The request should be submitted through the official privacy channel.

Where the request concerns a Flutterwave-held payment record, 6membership may use the transaction reference and its merchant records to locate the relevant processing and may direct or coordinate the request with Flutterwave where the provider acts independently.

The requester should not send passwords, complete payment-card details, banking credentials or unnecessary identity documents in the initial message.

6membership may generate a unique Privacy Request Reference to track the request.

The reference confirms that a request record exists. It does not by itself confirm identity, applicability of a particular law or the outcome of the request.

6membership will acknowledge and respond to a valid request within the period required by the applicable law.

Different jurisdictions may use different acknowledgement, response and extension periods.

Where additional time is legally permitted because of complexity, volume or verification difficulty, the requester will be informed as required.

Where a request is broad, unclear or relates to several independent records, 6membership may ask the requester to clarify its scope.

Clarification should be used to identify the requested information or action and not to obstruct a valid request.

Request methods should be reasonably accessible and appropriate to the way the person ordinarily interacts with 6membership.

Where applicable law requires more than one request method or a particular privacy link, 6membership will provide the required method when that law applies.

Before disclosing, correcting, deleting, exporting or restricting protected information, 6membership may take reasonable steps to confirm the requester’s identity.

Verification should be proportionate to the sensitivity of the information and the risk of acting on an unauthorised request.

A request involving identity documents, payment records, a private membership tier or another person’s information may require stronger verification than a request concerning an ordinary email preference.

Where reasonably possible, verification should use information already held by 6membership rather than collecting excessive new information.

The requester may be asked to confirm an Application Reference, Membership ID, registered email address, recent application activity or another record-specific fact.

Additional identity or authority evidence may be requested where the ordinary details do not provide sufficient confidence.

Any new document should be limited to what is reasonably necessary and handled according to the Application, Identity and Photograph Policy.

A person may use an authorised representative where applicable law permits it.

6membership may request written authority, proof of guardianship, a power of attorney or another legally sufficient authorisation.

6membership may also contact the individual directly where permitted to confirm identity and the representative’s authority.

A parent or guardian seeking to exercise rights for a younger applicant may be required to establish identity, relationship and legal authority.

The process should consider the younger person’s maturity, applicable law and whether the right can or should be exercised directly by the younger person.

Where 6membership cannot reasonably verify the requester, it may pause or deny the protected action to prevent unauthorised disclosure or destruction.

Where required, the requester will be informed of the reason and any available method for supplying additional evidence or challenging the decision.

Where applicable, an individual has the right to receive clear information about the collection and use of personal information.

The information may include the operator’s identity, processing purposes, lawful basis, information categories, recipients, retention, international transfers, rights and complaint methods.

This information may be provided through the Privacy Notice, this Addendum, a form notice, a consent interface or another context-specific notice.

Where applicable, an individual may request confirmation of whether 6membership processes personal information concerning them.

The individual may also request access to the information and legally required supplementary details.

The response may be delivered through a secure electronic copy, protected portal, structured export or another appropriate method.

An access response may include application details, contact information, consent records, membership status, Flutterwave transaction references, payment and refund statuses, chargeback records, communication history and other information within the applicable right.

6membership will not disclose or attempt to retrieve a complete card number, card security code, PIN, banking password or payment OTP that it does not hold as an ordinary membership record.

The response does not necessarily require disclosure of every internal document, system design, source code, legal privilege record, confidential fraud rule or information concerning another person.

Information may be redacted or withheld where disclosure would adversely affect another person’s rights, reveal protected legal advice, compromise security or violate another lawful restriction.

Where reasonably possible, 6membership will provide the remainder of the information rather than refusing the entire request.

The first copy may be provided without charge where applicable law requires it.

Where legally permitted, a reasonable fee may apply to additional, excessive or repeatedly duplicative copies.

Where applicable, an individual may request correction of personal information that is inaccurate.

A request should identify the disputed field, the proposed correction and supporting evidence where reasonably necessary.

An individual may request that materially incomplete information be completed where the applicable law grants that right.

Completion may be achieved by adding a supplementary statement where replacing the original historical record would make the record misleading.

A record that accurately reflects what was submitted or decided at an earlier time will not necessarily be rewritten merely because circumstances later changed.

6membership may preserve the original historical entry and add the corrected or updated information with a timestamp and audit record.

Where the accuracy of information is contested and cannot immediately be resolved, 6membership may restrict the disputed use or attach a note explaining that the information is challenged.

The response may explain the evidence relied upon and any available appeal or complaint process.

Where applicable and reasonably practicable, 6membership may notify relevant recipients of a completed correction.

The individual may be informed about those recipients where the applicable law requires it.

Where applicable, an individual may request deletion or erasure of personal information.

The request should identify the relevant application, membership, communication or other processing activity where possible.

Deletion may be available where information is no longer necessary, consent has been withdrawn and no other lawful basis applies, processing was unlawful, a valid objection prevails or deletion is otherwise required by applicable law.

Deletion is not absolute.

Information may remain where reasonably necessary for legal compliance, payment and accounting records, fraud prevention, security, defence of claims, complaint handling, regulatory cooperation, public-interest functions or another lawful exception.

6membership may also retain a minimal suppression record to ensure that deleted information is not unintentionally reintroduced or used for a prohibited purpose.

Deleting information required to review an application, verify payment, issue a membership card or maintain membership status may make the relevant service impossible to continue.

Where no other lawful basis supports the necessary processing, the application may be cancelled or the membership relationship may need to end.

The requester will be informed of this consequence before deletion where reasonably possible and legally appropriate.

Deletion from active systems may not immediately remove encrypted backup copies.

Backup copies may remain unavailable for ordinary use until they are overwritten or expire under controlled backup schedules.

Where a backup is restored, applicable deletion or suppression instructions should be reapplied.

Where required and reasonably practicable, relevant processors or recipients may be instructed to delete or restrict the affected information.

Flutterwave, a participating bank, card network or another independent controller may be required to assess part of the request under its own legal responsibilities.

Deletion from 6membership systems does not automatically require deletion of transaction, settlement, chargeback, fraud-prevention, tax or regulatory records that Flutterwave or a financial institution must lawfully retain.

Where applicable, an individual may request restriction of processing while accuracy, lawfulness, an objection or another qualifying issue is assessed.

Restricted information may remain stored while ordinary use, disclosure or alteration is limited.

Restricted information may still be processed with the individual’s consent or where necessary for legal claims, protection of another person, important public interests or another legally permitted ground.

Where applicable, an individual may object to processing based on legitimate interests, public-interest tasks or comparable lawful grounds.

The objection should explain the person’s particular situation where the law requires that explanation.

6membership may continue only where it demonstrates a legally sufficient overriding ground or the processing is required for legal claims or another applicable exception.

Where applicable, an individual may object to processing for direct marketing.

Once a valid objection applies, personal information will no longer be used for the covered direct-marketing purpose.

Necessary application, payment, membership, security and policy communications are not automatically treated as optional marketing.

Where applicable, the individual will be informed before a restriction is lifted and ordinary processing resumes.

Where applicable, an individual may request certain personal information in a structured, commonly used and machine-readable format.

The right ordinarily concerns information provided by the individual and processed through automated means on the basis specified by the applicable law.

An export may use JSON, CSV, PDF combined with structured files or another reasonably interoperable format appropriate to the information.

The format will be selected to balance usability, security, context and protection of third-party information.

Where applicable law grants the right and the transfer is technically feasible, an individual may request transfer directly to another controller.

6membership may require confirmation of the destination and use secure transfer methods.

Portability does not require disclosure of internal fraud models, proprietary analysis, another person’s information or information outside the right’s legal scope.

Receiving a portable copy does not automatically delete the original information.

Where consent is relied upon, it should be freely given, specific, informed and expressed through an appropriate affirmative action.

Consent for one purpose does not automatically authorise another unrelated purpose.

An individual may withdraw consent where processing relies on consent.

Withdrawal should be reasonably accessible and should not require substantially greater effort than giving consent.

Withdrawal does not make processing that occurred lawfully before withdrawal unlawful.

Information may also remain where another lawful basis independently requires or permits retention.

Withdrawing consent may end an optional feature that depends on that consent.

It will not automatically stop processing necessary for payment records, fraud prevention, legal obligations or another independent lawful basis.

Cookie consent, optional marketing consent, photograph-publication permission and another optional permission are separate choices unless the relevant notice clearly and lawfully combines them.

6membership may use technical tools to identify duplicate submissions, invalid formats, security threats, suspicious transactions, blocked devices or records requiring manual review.

A technical flag does not automatically establish fraud, ineligibility or wrongdoing.

Where applicable law restricts solely automated decisions producing legal or similarly significant effects, 6membership will apply the required safeguards.

A final approval, denial, suspension or revocation should not be based solely on an undisclosed automated result where meaningful human review is legally required.

Where applicable, an individual may request information about the use of qualifying automated decision-making, the relevant logic or factors and the significance or expected consequences.

The response may protect source code, confidential security controls, trade secrets and information concerning other persons while still providing meaningful information.

Where the applicable law provides the right, an individual may request human review, submit relevant information, express their position and challenge materially inaccurate inputs or an improper result.

Where an applicable jurisdiction grants a right to opt out of specified automated decision-making or profiling, 6membership will provide the legally required method when the covered processing is used.

This clause does not state that 6membership currently operates every form of automated decision-making described by privacy laws.

The Nigeria Data Protection Act 2023 forms the primary privacy framework for 6membership’s Nigerian operations.

The Nigeria Data Protection Act General Application and Implementation Directive 2025, together with applicable regulations, directives, guidance and binding decisions of the Nigeria Data Protection Commission, may further affect how rights are administered.

Rights described in this section are subject to the conditions, procedures and lawful limitations in the applicable Nigerian framework.

A Nigerian data subject may have the right to receive information about processing and to obtain confirmation and access to relevant personal data.

The response may include processing purposes, categories, recipients, retention, international transfers, available rights and other information required by the applicable framework.

Where the request concerns a Flutterwave transaction, the response may include the payment information held by 6membership and an explanation of any provider-held information that must be requested from Flutterwave or another independent financial participant.

A data subject may request correction of inaccurate or incomplete personal data.

A right to erasure may apply where the statutory conditions are satisfied, subject to lawful exceptions and retention obligations.

A data subject may have rights to object to qualifying processing and request restriction in circumstances recognised by Nigerian law.

Direct-marketing objections will be applied to the covered marketing processing.

Where the statutory conditions are satisfied, a data subject may request qualifying data in a structured, commonly used and machine-readable format and may request transmission where technically feasible.

A data subject may have protections against qualifying solely automated decisions and may be entitled to safeguards such as human intervention, an opportunity to express a view and a method to contest the decision.

A data subject may submit a complaint to the Nigeria Data Protection Commission where the Nigerian framework grants that right.

Using 6membership’s internal privacy process first may help resolve an issue, but it does not remove a mandatory regulatory complaint right.

Applicable Nigerian law may provide regulatory, administrative or judicial remedies.

Nothing in this Addendum restricts the lawful authority of the Commission or a court of competent jurisdiction.

This section applies only where the EU General Data Protection Regulation applies to the relevant processing.

Website accessibility from the EU or EEA does not by itself determine every territorial-scope question.

Subject to the applicable conditions and exceptions, an individual may have rights to information, access, rectification, erasure, restriction, portability and objection.

The individual may also have rights concerning consent and qualifying automated decision-making.

A valid request will be handled within the period required by the GDPR.

Where the GDPR permits additional time because of complexity or request volume, the individual will receive the required extension notice.

Where the GDPR applies, an individual may lodge a complaint with an applicable EU or EEA supervisory authority.

The appropriate authority may depend on habitual residence, place of work, the alleged infringement or another jurisdictional factor.

Where applicable, an individual may request information about relevant safeguards used for transfers outside the EU or EEA.

Where the GDPR requires 6membership to appoint an EU representative, the representative’s contact details will be published before or when that obligation applies.

This draft does not falsely identify a representative who has not yet been appointed.

This section applies only where United Kingdom data-protection law covers the relevant person, organisation and processing activity.

The applicable framework includes the UK GDPR and Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025 and relevant commencement instruments.

Subject to applicable conditions and exceptions, an individual may have rights to be informed, access, rectification, erasure, restriction, portability and objection.

An individual may also have rights concerning consent and qualifying automated decisions under the UK framework as amended.

The safeguards and scope for automated decision-making may differ from the EU GDPR and must be assessed under the current UK legislation rather than assumed to be identical.

A valid UK request will be handled within the period required by applicable UK law.

Any permitted extension will be communicated as required.

Where UK law applies, an individual may have the right to complain to the United Kingdom Information Commissioner’s Office.

An internal complaint may be submitted first but does not remove a mandatory right to contact the regulator.

Where UK law requires appointment of a United Kingdom representative, the representative’s contact information will be published when the obligation applies.

This section applies only where the California Consumer Privacy Act covers 6membership and the relevant processing.

The inclusion of this section does not state that 6membership currently satisfies every statutory threshold that determines whether a business is subject to the CCPA.

Where applicable, a California consumer may request information about categories and specific pieces of personal information collected, sources, purposes and relevant disclosures, sales or sharing.

Where applicable, a California consumer may request deletion of covered personal information and correction of inaccurate personal information.

Statutory exceptions may allow or require particular information to remain.

6membership does not intend to sell applicant or member information for money.

Where 6membership engages in an activity legally defined as sale or sharing under the CCPA, covered consumers will receive the required notice and opt-out method.

A recognised opt-out preference signal will be processed where and when California law requires it.

Where 6membership uses or discloses sensitive personal information beyond legally permitted purposes and the CCPA right applies, a California consumer may request that the use or disclosure be limited.

A limitation right does not prevent uses permitted by the statute and regulations for specified necessary purposes.

Where current California requirements apply to a qualifying use of automated decision-making technology, a consumer may receive required pre-use information and applicable access or opt-out rights.

6membership will not display an automated-decision opt-out merely to suggest that qualifying technology is used when it is not.

6membership will not unlawfully discriminate against a covered California consumer for exercising a CCPA right.

A feature may nevertheless be unavailable where the requested deletion or limitation makes that feature impossible and applicable law permits the resulting difference.

A California consumer may use an authorised agent where the CCPA permits it.

6membership may request legally permitted evidence of the agent’s authority and may verify the consumer directly where allowed.

A covered consumer may contact the California Privacy Protection Agency or another competent authority where California law provides that right.

This section applies where South Africa’s Protection of Personal Information Act covers the relevant processing.

6membership may be regarded as a responsible party for covered processing where it determines the purpose and means of that processing.

A data subject may have rights to receive information about processing and request confirmation and access to personal information.

Access may be subject to identity verification, applicable procedures, lawful grounds of refusal and permitted fees.

A data subject may request correction or deletion of personal information that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained.

A request may also concern destruction or deletion where 6membership is no longer authorised to retain the information.

Where POPIA permits it, a data subject may object on reasonable grounds relating to their particular situation.

A valid objection will be assessed against any lawful justification for continuing the processing.

A person may object to covered direct marketing and use applicable opt-out mechanisms.

Necessary membership, security, payment and legal notices are not automatically treated as unsolicited direct marketing.

Where POPIA applies, a data subject may submit a complaint to South Africa’s Information Regulator using the applicable procedure.

A person in another jurisdiction may have rights under a national, state, provincial or territorial privacy law.

6membership will assess a verified request according to the law applicable to the person, the service and the relevant processing.

Where no specific statutory right applies, 6membership may still consider a reasonable request for access, correction, deletion or preference changes.

Voluntary handling remains subject to identity verification, security, fraud prevention, legal retention and protection of other persons.

This section does not replace or reduce a stronger mandatory right granted by an applicable law.

6membership may add a dedicated jurisdictional section where operations, applicant volume or legal obligations make that section appropriate.

Material additions will be managed through the policy-update framework.

A privacy right may be limited where the applicable law contains an exception.

Possible grounds may concern legal obligations, fraud prevention, security, another person’s rights, legal privilege, regulatory functions, public interests, research, records required for claims or another recognised exception.

Where the applicable law permits it, 6membership may charge a reasonable fee or refuse a request that is manifestly unfounded, excessive or repeatedly duplicative.

The burden of establishing the permitted ground remains with 6membership where the law places that burden on the controller.

6membership will not disclose credentials, authentication secrets, protected security configurations or confidential fraud methods through an access request.

A requester may still receive meaningful information about personal data and a decision without receiving material that would enable abuse.

A response may be redacted where disclosure would reveal another person’s private information or adversely affect their rights and freedoms.

Where a request is refused or limited, the response will provide the information required by the applicable law.

This may include the reason, applicable exception and available complaint or appeal route.

A person may ask 6membership to review the handling or outcome of a privacy request.

The complaint should identify the Privacy Request Reference, disputed action and reason the person believes the response is incorrect.

Where reasonably possible, a complaint should be reviewed by a person who was not solely responsible for the original disputed decision.

A person may contact an applicable privacy or data-protection regulator where the relevant law provides that right.

6membership will not state that an internal complaint is mandatory where applicable law allows the person to approach the regulator directly.

Applicable law may provide access to courts, tribunals, administrative remedies, compensation or another enforcement procedure.

Nothing in this Addendum removes a remedy that cannot lawfully be excluded.

6membership may retain the request, Privacy Request Reference, requester details, verification steps, correspondence, decision, legal basis, completion date and relevant audit events.

Request records should contain enough information to demonstrate proper handling without unnecessarily duplicating identity documents or unrelated private information.

Privacy-request records may be retained for accountability, dispute handling, regulatory compliance, security and legal claims.

The applicable period depends on legal requirements, limitation periods, request type and associated risk.

Material administrative actions may be logged to identify who accessed, exported, corrected, restricted or deleted a protected record.

Audit records should not be alterable by an ordinary applicant or member.

Privacy laws, regulations, regulatory guidance and territorial-scope interpretations may change.

6membership may update this Addendum to reflect new rights, request methods, response obligations or jurisdictional requirements.

A material change affecting existing rights or processing may be communicated through the website, application flow, membership portal or registered email address where appropriate.

A policy update will not be used to retrospectively remove a mandatory right or validate processing that was unlawful when it occurred.

Privacy requests should be submitted to privacy@6membership.com.

Formal legal and regulatory correspondence may be sent to legal@6membership.com.

The requester should retain the Privacy Request Reference and relevant correspondence.

Version numbers, effective dates, change notices and renewed-acceptance requirements are governed by the Policy Updates, Effective Dates and Change Log.