Privacy Policy
Last updated: April 05, 2026 · Compliant with the Nigeria Data Protection Regulation (NDPR) 2019
🔒 Orderer is committed to protecting your personal data in accordance with the Nigeria Data Protection Regulation (NDPR) and the Nigerian Data Protection Act 2023.
1. Who We Are
Orderer ("we", "us", "our") is an online marketplace platform headquartered in Lagos, Nigeria. We act as a Data Controller in respect of personal data collected through our Platform (website and mobile application).
Our Data Protection Officer can be reached at dpo@ordererweb.shop.
2. Data We Collect
2.1 Information You Provide
- Account data: name, email address, phone number, password (encrypted), date of birth;
- Seller data: business name, business address, CAC registration number, BVN or NIN (for KYC), bank account details;
- Listing data: product descriptions, images, videos, pricing;
- Transaction data: order details, delivery addresses, payment references;
- Communications: support tickets, messages, reviews, and ratings.
2.2 Automatically Collected Data
- IP address, browser type, operating system, device identifiers;
- Pages visited, time spent, click patterns, search queries;
- Cookie data (see Section 10).
2.3 Third-Party Data
We may receive data about you from payment processors, identity verification services, and fraud prevention providers.
3. How We Collect Data
- Directly from you during registration, checkout, and profile management;
- Automatically through cookies and similar tracking technologies;
- From payment and logistics partners processing your transactions;
- From identity verification providers during seller onboarding.
4. Why We Use Your Data
We process your personal data for the following purposes:
- To create and manage your account;
- To process orders, payments, and refunds;
- To verify your identity and prevent fraud (KYC/AML compliance);
- To send you transactional communications (order confirmations, shipping updates);
- To send marketing communications where you have given consent or where permitted by law;
- To personalise your experience and show relevant ads;
- To improve the Platform through analytics;
- To comply with Nigerian legal and regulatory obligations;
- To resolve disputes and enforce our Terms.
5. Legal Basis for Processing
Under the NDPR and Nigerian Data Protection Act 2023, we rely on the following lawful bases:
- Contract performance: processing necessary to fulfil our obligations to you;
- Legal obligation: where processing is required under Nigerian law (e.g., EFCC, CBN, FIRS regulations);
- Legitimate interests: fraud prevention, platform security, and analytics;
- Consent: marketing emails, cookies (you may withdraw consent at any time).
6. Who We Share Your Data With
We share your data only where necessary, with:
- Sellers: your delivery address and order details to fulfil your purchase;
- Buyers: seller business name and contact for order purposes;
- Payment Processors: Korapay, to facilitate transactions;
- Shipping Partners: Shipbubble and courier partners, for delivery fulfilment;
- Identity Verification: KYC providers as required for seller onboarding;
- Cloud Services: (media storage services), (email delivery systems);
- Analytics: anonymised data with analytics providers;
- Law Enforcement: Nigerian authorities (EFCC, NFIU, Police) where required by law.
We do not sell your personal data to third parties.
7. Data Retention
We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including:
- Active accounts: for the duration of your account plus 2 years after closure;
- Transaction records: 7 years, as required by FIRS and Nigerian tax law;
- KYC documents: 5 years after the end of the business relationship, per EFCC requirements;
- Marketing data: until you withdraw consent or 3 years of inactivity.
8. Data Security
We implement appropriate technical and organisational security measures including:
- TLS/HTTPS encryption for all data in transit;
- Bcrypt hashing for passwords;
- Role-based access controls limiting staff access to personal data;
- Regular security audits and penetration testing;
- Incident response procedures in compliance with NDPR breach notification requirements.
In the event of a data breach, we will notify affected users and the Nigeria Data Protection Commission (NDPC) within 72 hours where required.
9. Your Rights
Under the Nigerian Data Protection Act 2023, you have the following rights:
- Right of access: request a copy of personal data we hold about you;
- Right to rectification: correct inaccurate or incomplete data;
- Right to erasure: request deletion of your data (subject to legal obligations);
- Right to data portability: receive your data in a structured, machine-readable format;
- Right to object: object to processing based on legitimate interests;
- Right to withdraw consent: at any time, without affecting prior processing.
To exercise any of these rights, contact us at dpo@ordererweb.shop. We will respond within 30 days.
10. Cookies
We use cookies and similar technologies to enhance your experience. For full details, please see our Cookie Policy.
11. Children's Privacy
Our Platform is not directed at persons under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately at dpo@ordererweb.shop and we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of material changes via email or a prominent notice on the Platform. Continued use of the Platform after notification constitutes acceptance of the updated Policy.
For privacy queries or to exercise your rights, contact our Data Protection Officer:
If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
