Privacy Policy

1. Who We Are

Marketplaza Technology Ltd is incorporated in Nigeria (RC: [Pending CAC Registration]) with its registered office in Victoria Island, Benin City, Nigeria. We operate a social commerce and fintech platform that connects buyers, sellers, resellers, and builders through a secure escrow-based transaction engine.

For the purposes of NDPR, Marketplaza is the data controller of your personal information.

Data Protection Officer (DPO) Contact: privacy@marketplaza.app

2. Data We Collect

Depending on how you interact with Marketplaza, we may collect the following categories of personal data:

Identity & Contact Data

• Full legal name, username, and profile photo
• Email address and phone number
• Date of birth (for age verification)
• BVN (Bank Verification Number) and NIN (National Identification Number) — for KYC verification; never stored in plain text

Financial Data

• Bank account details (for payouts — NUBAN account number and bank name only)
• Transaction history within the Marketplaza platform
• Wallet balance and escrow transaction records
• 4-digit transaction PIN — stored only as Argon2id hash; never recoverable

Business & Merchant Data

• CAC registration number and business name (for Genesis Shield™ verification)
• Store name, description, logo, and product listings
• Physical market location and stall details

Technical & Usage Data

• Device type, operating system, and browser information
• IP address and approximate location
• App session logs, feature usage patterns, and click/scroll behaviour
• Push notification tokens (for mobile alerts)

Communications Data

• Messages sent via the in-app dispute mediation system
• Support ticket history and contact form submissions

3. How We Collect Your Data

• Directly from you — when you register, complete your profile, submit the waitlist form, make a transaction, or contact us
• Automated collection — through cookies, server logs, and analytics tools when you use our platform
• Third-party partners — from payment processors (Paystack, Wema Bank, Moniepoint) when you fund your wallet or initiate payouts; from identity verification providers when we verify BVN/NIN
• Public records — from the Corporate Affairs Commission (CAC) when verifying business registration for Genesis Shield™

4. Why We Use Your Data

We process your personal data for the following purposes:

• Account creation & authentication — to register you, verify your identity, and secure your account
• Transaction processing — to execute escrow deposits, releases, and refunds; generate your virtual NUBAN account; process payouts to your bank
• KYC compliance — to verify BVN/NIN as required by CBN guidelines for fintech platforms handling financial transactions
• Platform security & fraud prevention — to detect suspicious activity, enforce transaction rate limits, and protect all users
• Customer support — to respond to your enquiries and resolve disputes through our mediation system
• Product improvement — to analyse usage patterns and improve the platform (using aggregated, anonymised data where possible)
• Legal obligations — to comply with CBN, NDPR, and other applicable Nigerian laws
• Marketing communications — to send you platform updates, waitlist notifications, and news (only with your explicit consent; you may opt out at any time)

5. Legal Basis for Processing

Under the NDPR, we process your personal data on the following legal bases:

• Consent — where you have expressly agreed (e.g., marketing emails, waitlist sign-up)
• Contractual necessity — where processing is required to fulfil a transaction or service you have requested
• Legal obligation — where we are required to process your data to comply with Nigerian law (e.g., CBN KYC requirements)
• Legitimate interests — where processing is necessary for our legitimate business interests (e.g., fraud detection, security monitoring) and does not override your rights

6. Data Sharing & Third Parties

We do not sell your personal data. We share data only in the following circumstances:

• Payment processors — Paystack, Wema Bank, and Moniepoint receive the minimum data required to process financial transactions (account number, transaction amount). Their processing is governed by their own privacy policies.
• Identity verification — BVN/NIN verification is performed through licensed Nigerian verification partners. We receive only a verified/not-verified status; we do not store raw BVN/NIN values.
• Logistics/courier partners — Order dispatch details (name, delivery address, phone) are shared with courier services only for confirmed orders.
• Regulatory authorities — We will disclose data to the CBN, NITDA, law enforcement, or courts where required by applicable Nigerian law or a valid court order.
• Service providers — Cloud infrastructure (hosting, databases, CDN) and analytics tools operate under strict data processing agreements that prohibit them from using your data for their own purposes.

7. Data Retention

• Account data — retained for the duration of your account and for 5 years after account deletion (for legal and regulatory purposes)
• Transaction records — retained for 7 years as required by Nigerian financial regulations
• KYC verification results — retained for 5 years post-account closure
• Marketing consent records — retained until you withdraw consent
• Waitlist data — retained until you register or request deletion, whichever comes first
• Technical logs — retained for 90 days, then automatically deleted

8. Security Measures

We implement technical and organisational measures to protect your personal data:

• Encryption at rest and in transit — all data is encrypted using industry-standard AES-256 at rest and TLS 1.3 in transit
• PIN hashing — transaction PINs are hashed with Argon2id and unique per-user salts; they cannot be recovered or read by any Marketplaza employee
• No plain-text sensitive data — BVN, NIN, debit card numbers, and PINs are never stored in plain text anywhere in our systems
• Webhook security — payment webhook events are verified with HMAC-SHA512 signature verification before processing
• Database-level transaction integrity — all financial mutations use PostgreSQL SERIALIZABLE isolation level with row-level locking to prevent race conditions and double-spend
• Access controls — production database access is restricted to authorised personnel with multi-factor authentication and full audit logging
• Security review — we conduct regular security reviews and penetration tests prior to public launch

9. Your Rights Under NDPR

As a data subject under the NDPR, you have the following rights:

• Right to access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your data, subject to our legal retention obligations
• Right to restriction — request that we restrict processing of your data in certain circumstances
• Right to data portability — receive your data in a machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — withdraw any consent you have given at any time, without affecting prior lawful processing

To exercise any of these rights, email us at privacy@marketplaza.app. We will respond within 30 days. Identity verification may be required before we process your request.

10. Cookies & Tracking

Our website uses the following types of cookies:

• Essential cookies — required for site functionality (session management, CSRF protection). Cannot be disabled.
• Analytics cookies — aggregate, anonymised data on site traffic and feature usage. You may opt out.
• Preference cookies — remember your settings (e.g., language preference). Deleted on session end unless you consent to persistence.

We do not use advertising or cross-site tracking cookies. You can manage cookie preferences through your browser settings. Disabling essential cookies may impair platform functionality.

11. Children's Privacy

Marketplaza is not intended for use by persons under the age of 18 years. We do not knowingly collect personal data from children. If you believe a minor has created an account on our platform, please contact us immediately at privacy@marketplaza.app and we will delete the account and associated data promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (if you are a registered user) and post a prominent notice on our website at least 14 days before the changes take effect. Your continued use of Marketplaza after that period constitutes acceptance of the updated policy.

We keep prior versions of this policy accessible upon request to privacy@marketplaza.app.

13. Contact Us