Privacy Policy

1. What We Collect

• Phone number — required to create an account and log in via OTP
• Name, email, city, state — optional profile information
• BVN — collected only from vendors, encrypted, used solely for identity verification
• Bank account details — masked in all displays, used only for vendor payouts
• Device information — IMEI and photos submitted with listings
• Transaction history — purchases, sales, and escrow records
• GPS coordinates — collected only during rider pickup and delivery confirmation
• IP address and device information — used for security and fraud prevention
• Messages — sent through platform messaging between buyers and vendors

2. How We Use It

• Authenticating you via one-time password (OTP)
• Processing transactions and holding funds in escrow
• Verifying vendor identity (BVN, via Smile Identity)
• Coordinating rider pickup and delivery
• Investigating and resolving disputes
• Preventing fraud and abuse of the platform
• Sending you SMS and email communications about your account and orders
• Improving the platform through aggregated, anonymised analytics

3. Who We Share It With

We share the minimum data necessary with the following service providers, each bound by their own confidentiality and data protection obligations:

• Paystack — payment processing and escrow settlement
• Termii — SMS delivery for OTPs and order notifications
• Resend — transactional email delivery
• Smile Identity — BVN verification for vendors only
• Cloudinary — storage of listing and delivery evidence photos
• Approved delivery partners — receive only the name, phone number, and delivery address needed to complete a delivery
• Law enforcement or regulators — only when legally required, such as under a court order or statutory request

We do not sell your personal data to third parties.

4. Data Retention

• Account data — retained while your account is active
• Transaction records — retained for 7 years, as required by financial recordkeeping law
• BVN data — encrypted at rest and retained only for as long as regulatory compliance requires
• OTP codes — deleted within 24 hours of use or expiry
• Audit logs — retained for 2 years for security and compliance purposes

5. Your Rights Under NDPR

As a Nigerian data subject, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your account and associated personal data, subject to our legal retention obligations
• Portability — request your data in a structured, machine-readable format
• Object to certain uses of your data, such as marketing communications

To exercise any of these rights, email privacy@gadgetplace.ng. We will respond within a reasonable timeframe as required by law.

6. Security

• BVN is encrypted at rest using AES-256-CBC
• Bank account numbers are masked in every screen and receipt where they appear
• Login sessions use httpOnly, secure cookies that cannot be read by client-side scripts
• All data in transit is encrypted using HTTPS/TLS

7. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via SMS or email before they take effect.

8. Contact

For any privacy-related questions or requests, contact privacy@gadgetplace.ng