Privacy Policy

1. Introduction

OpenMarket is a product discovery marketplace that connects buyers with independent sellers in Nigeria. We do not process payments, checkout, or delivery on your behalf. Buyers contact sellers directly (for example by phone or WhatsApp).

This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use our website and related services. It is prepared with regard to the Nigeria Data Protection Act, 2023 (NDPA), administered by the Nigeria Data Protection Commission (NDPC), and other applicable Nigerian laws.

By using the Platform, you acknowledge that you have read this policy. Where we rely on consent, we will ask for it in a clear and specific way, and you may withdraw consent at any time.

2. Who is the data controller?

For personal data processed in connection with operating the Platform, OpenMarket acts as a data controller under the NDPA (where we determine the purposes and means of processing).

Contact for privacy matters:
Please use our Contact page and select a relevant subject (for example “Technical support” or “Other”), or write to us using the contact details published on the Platform.

Independent sellers who list products and communicate with buyers may also process personal data (for example phone numbers shared for contact). In those cases, the seller is typically a separate data controller for that communication. We encourage sellers to handle buyer information lawfully and securely.

3. Personal data we collect

Depending on how you use the Platform, we may process the following categories of personal data:

3.1 Visitors and buyers (no account required to browse)

• Technical data such as IP address, browser type, device information, and approximate location derived from IP
• Usage data such as pages viewed, search queries, product views, and referral source
• Information you voluntarily submit (for example via the contact form: name, email, phone, message)

3.2 Sellers and administrators (accounts required)

• Identity and account data: full name, store/business name, email address, phone and WhatsApp number
• Location data: address, city, state, country
• Authentication data: password hashes (we do not store plain-text passwords), login timestamps, IP addresses used at login
• Product and listing data linked to your account (product names, descriptions, prices, images, status)
• Security and audit data: failed login attempts, account status changes, and administrative action logs

3.3 Data we do not intentionally collect

• Payment card details (we do not process payments on the Platform)
• Sensitive personal data (as defined under the NDPA), unless you voluntarily provide it in free-text fields — please do not submit sensitive data unless necessary

4. How we collect personal data

• Directly from you — registration, profile updates, product listings, contact forms
• Automatically — when you browse or use the Platform (logs, cookies or similar technologies where used)
• From your device — technical and security-related signals needed to operate and protect the service

5. Lawful bases for processing (NDPA)

Under the NDPA, we process personal data only where a lawful basis applies. Depending on the activity, this may include:

• Consent — where you have given clear, informed, and freely given consent (for example certain optional communications)
• Contract — processing necessary to provide the Platform services you request (for example creating a seller account, publishing listings)
• Legitimate interests — such as securing the Platform, preventing fraud and abuse, improving product discovery, and basic analytics, balanced against your rights
• Legal obligation — where processing is necessary to comply with applicable Nigerian law or regulatory requirements

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Purposes of processing

We use personal data to:

• Operate and improve the marketplace (product discovery, search, categories, seller profiles)
• Create and manage seller and administrator accounts
• Display seller contact methods (phone / WhatsApp) so buyers can reach sellers directly
• Moderate listings and enforce Platform rules (including approval, rejection, or suspension where appropriate)
• Respond to enquiries and support requests
• Protect security, investigate abuse, and maintain service integrity
• Comply with legal obligations and respond to lawful requests by competent authorities
• Generate limited aggregated or anonymised statistics about Platform use

We do not sell your personal data. We do not use your data for purposes that are incompatible with those stated above without a valid lawful basis.

7. Sharing of personal data

We may share personal data only as needed for the purposes above, including with:

• The public / other users — information you choose to make public on listings and seller profiles (for example store name, city, product details, and published contact numbers)
• Service providers — hosting, infrastructure, email, or security providers who process data on our instructions and under appropriate safeguards
• Professional advisers and authorities — where required by law, or to establish, exercise, or defend legal claims

If data is transferred outside Nigeria, we will take steps consistent with the NDPA to ensure appropriate protection for personal data.

8. Cookies and similar technologies

We may use essential cookies or similar technologies required for the Platform to function (for example session and security cookies for logged-in sellers and administrators). Where we use non-essential cookies, we will provide appropriate notice and choices as required.

You can control cookies through your browser settings. Disabling essential cookies may affect login and security features.

9. Data retention

We retain personal data only for as long as necessary for the purposes described in this policy, or as required by law. Typical retention practices include:

• Account data — for the life of the account and a reasonable period afterwards for security, dispute resolution, and legal compliance
• Product listings and related content — while the listing is active and for a reasonable period after removal or account closure
• Contact form messages — for a period needed to respond and keep a support record
• Security logs — for a limited period to investigate incidents and protect the Platform

When data is no longer required, we will delete or anonymise it where reasonably practicable.

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration, consistent with the NDPA principles of integrity and confidentiality. These measures may include access controls, password hashing, secure transmission (HTTPS), input validation, and administrative logging.

No online service can guarantee absolute security. Please protect your account credentials and notify us promptly if you suspect unauthorised access.

11. Your rights under the NDPA

As a data subject in Nigeria, you have rights under the NDPA, which may include the right to:

• Be informed about how your personal data is processed (this policy forms part of that notice)
• Access personal data we hold about you
• Rectification of inaccurate or incomplete personal data
• Erasure of personal data in circumstances provided by law
• Restriction of processing in certain situations
• Object to processing based on legitimate interests, where applicable
• Withdraw consent where processing is based on consent
• Data portability, where applicable, to receive data in a structured, commonly used, machine-readable format
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to NDPA exceptions

To exercise these rights, contact us via the Contact page. We may need to verify your identity before fulfilling a request. We aim to respond without undue delay and within timeframes consistent with NDPC guidance.

Sellers can update much of their account information directly from the seller profile and settings pages.

12. Right to lodge a complaint with the NDPC

If you believe your data protection rights have been infringed, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC), the supervisory authority established under the NDPA.

Official information and contact channels for the NDPC are published on the Commission’s website (for example www.ndpc.gov.ng). We encourage you to contact us first so we can try to resolve your concern.

13. Children

The Platform is not directed at children. We do not knowingly collect personal data from children in a manner prohibited by applicable law. If you believe a child has provided personal data to us, please contact us so we can take appropriate steps.

14. Third-party links and seller communications

The Platform may link to third-party sites or services (including WhatsApp). Those services have their own privacy practices. We are not responsible for the privacy practices of third parties or of independent sellers once you contact them outside the Platform.

15. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or legal requirements. The “Last updated” date at the top will be revised when changes are made. Significant changes may be highlighted on the Platform where appropriate.

16. Contact us

For privacy requests, questions about this policy, or to exercise your rights under the NDPA, please use our Contact page.

Platform: OpenMarket