Privacy

Version: 1.0

This Privacy Policy explains how Buyuma ("we," "us," "our," or "the Platform") collects, uses, stores, shares, and protects your personal information when you access or use our multi-vendor e-commerce marketplace at buyuma.com.

This Policy applies to all users of the Platform, including Customers, Vendors, Administrators, Support Agents, and any other individuals who interact with our services.

Buyuma is committed to protecting the privacy and security of your personal data. We process your information lawfully, fairly, and transparently in accordance with the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR), and other applicable data protection laws.

This Privacy Policy applies to:

• The Buyuma website (buyuma.com)
• Mobile applications (where available)
• APIs and backend services
• Real-time messaging via OrbitConnect
• All related services, tools, and features provided by Buyuma

This Policy does not apply to third-party websites, services, or platforms linked from Buyuma. We encourage you to review the privacy policies of any third-party services you interact with.

• "Personal Data" means any information relating to an identified or identifiable natural person
• "Processing" means any operation performed on personal data (collection, storage, use, sharing, deletion)
• "Data Subject" means any individual whose personal data is processed by Buyuma
• "Data Controller" means Buyuma, as the entity that determines the purposes and means of processing
• "Consent" means freely given, specific, informed, and unambiguous indication of agreement to data processing
• "OrbitConnect" means the third-party real-time messaging and notification service integrated into the Platform
• "Paystack" means the payment processing service used for transactions on the Platform

Buyuma (operating entity: [Insert registered company name])

[Insert registered business address, Nigeria]

• General Support: support@buyuma.com
• Website: buyuma.com

• Data Protection Officer: privacy@buyuma.com
• Legal Team: legal@buyuma.com
• Postal Address: [Insert postal address]

For all privacy-related inquiries, data access requests, or complaints, contact our Data Protection Officer at the email above.

When you create an account or use our Platform, we collect:

• Full Name: First name and last name (required for registration)
• Email Address: Used for account verification, login, notifications, and communication
• Phone Number: Used for account verification (OTP), delivery coordination, and SMS notifications
• Date of Birth: Collected optionally via user profile for age verification and personalization
• Profile Picture/Avatar: Uploaded voluntarily to personalize your account

• Password: Stored in encrypted (hashed) form only; we never store or have access to plaintext passwords
• Login History: Timestamps, IP addresses, and device information for each login session
• Session Data: Active sessions including device name, user agent, IP address, and last activity timestamp
• Two-Factor Authentication (2FA) Secret: Encrypted secret key for users who enable 2FA
• Login Attempts: Records of failed login attempts (email, IP address, timestamp) for security monitoring

Vendors are required to submit additional documentation for KYC verification:

• Government-Issued ID: National ID card, international passport, or driver's license
• Business Registration Documents: CAC registration certificate, business license
• Tax Information: Tax Identification Number (TIN), tax certificates
• Bank Statements: Recent bank statements for financial verification
• Business Details: Business name, business type (individual/company), registration number, address

• Shipping Addresses: Street address, city, state, postal code, country, and optional geolocation coordinates (latitude/longitude)
• Billing Addresses: May be the same as or different from shipping addresses
• Vendor Business Address: Store location and return address for order fulfillment
• Address Labels: User-defined labels (home, office, other) for convenience

• Wallet Transactions: Credits, debits, balances, and transaction history for Customer Refund Wallets and Vendor Earnings Wallets
• Refund Records: Refund amounts, reasons, associated order references, and processing status
• Payout Information: Vendor bank account details (bank name, account name, account number, bank code) for withdrawal processing via Paystack Transfer API
• Payment References: Transaction references, gateway responses, and payment verification records
• Withdrawal Requests: Amount, status, approval/rejection details, and payout references

We do not store complete credit/debit card numbers. Card payment processing is handled entirely by Paystack and Stripe.

• Orders Placed: Order numbers (BYM-YYYYMMDD-XXXXX format), items, quantities, prices, statuses, and timestamps
• Purchase History: Complete record of all orders including cancelled and refunded orders
• Returns: Return requests, reasons, evidence submitted (photos), and resolution outcomes
• Shipping Information: Tracking numbers, carrier details, shipment status history, and delivery confirmation
• Invoices: Auto-generated invoice records with order details

• Customer-Vendor Messages: Real-time messages sent through OrbitConnect between customers and vendors
• Customer-Support Messages: Conversations with Buyuma support agents via OrbitConnect
• Notifications: Push notifications, email notifications, SMS notifications, and in-app notification records
• Notification Preferences: Your channel and category preferences for receiving communications

• IP Address: Collected on every request for security, fraud detection, and analytics
• Browser Information: Browser type, version, and capabilities
• Device Information: Device type, operating system, screen resolution, and device identifiers
• User Agent String: Full user agent string for session tracking and security
• Cookies: Session cookies, authentication tokens, and preference cookies (see Section 8)
• Session Data: Session identifiers, creation time, and last activity timestamps

When you use the Platform, we automatically collect:

• Usage Data: Pages visited, features used, buttons clicked, time spent on pages, and navigation patterns
• Search History: Search queries entered on the Platform, search filters applied, and search results clicked
• Product Views: Products browsed, product detail pages visited, and time spent viewing products
• Click Activity: Links clicked, buttons pressed, and interaction patterns across the Platform
• Device Logs: Technical logs generated by your device during Platform use
• Error Logs: Application errors, crashes, and performance issues for debugging and improvement
• Security Logs: Audit trails of security-sensitive actions (login, password changes, wallet transactions, admin actions)
• Cart Activity: Items added to or removed from cart, abandoned carts, and checkout attempts
• Wishlist Activity: Products saved to wishlist

We collect personal information when you:

• Create a Customer account (name, email, phone, password)
• Register as a Vendor (business details, KYC documents, bank accounts)
• Complete your user profile (date of birth, gender, bio, avatar)
• Add or update addresses

During checkout, we collect:

• Selected shipping and billing addresses
• Payment method selection
• Coupon codes applied
• Order notes and special instructions

When vendors apply to sell on Buyuma, we collect:

• Store information (name, description, logo, banner)
• KYC documentation (business registration, ID, tax certificates)
• Bank account details for payouts
• Business address and contact information

When you contact support, we collect:

• The content of your messages and attachments
• Order references and account details shared during support
• Resolution outcomes and support ticket history

We collect usage data through:

• Server-side request logging
• Client-side analytics (page views, interactions)
• Performance monitoring tools
• Error tracking systems

We use cookies and similar technologies as described in Section 8 to collect technical and usage data automatically.

• Create and maintain user accounts
• Authenticate users via email/phone OTP and password
• Manage user profiles, preferences, and settings
• Enable Two-Factor Authentication (2FA)
• Track and manage active sessions
• Process account verification (email and phone)

• Process and fulfill customer orders
• Calculate order totals (subtotal, tax, shipping, discounts)
• Split multi-vendor orders and calculate vendor commissions
• Manage inventory reservations during checkout (15-minute hold)
• Generate unique order numbers and invoices
• Process refunds to Customer Wallets or original payment methods
• Credit vendor earnings after settlement period (7 days post-delivery)
• Process vendor withdrawal requests via Paystack Transfer API
• Manage flash deals, campaigns, and promotional pricing

• Respond to inquiries and resolve complaints via OrbitConnect
• Investigate order disputes between customers and vendors
• Process return and refund requests
• Provide account recovery assistance
• Escalate issues to appropriate teams

• Detect and prevent fraudulent transactions and accounts
• Monitor login attempts and enforce lockout policies (5 failed attempts = 15-minute lockout)
• Verify payment webhook signatures (Paystack, Stripe)
• Implement rate limiting on sensitive endpoints
• Detect duplicate accounts and coupon abuse
• Enforce inventory locking to prevent overselling
• Audit administrative actions

• Analyze Platform usage patterns to improve user experience
• Improve search relevance and product recommendations
• Monitor Platform performance and uptime
• Identify and fix technical issues
• Measure campaign effectiveness (impressions, clicks, conversions)

• Comply with Nigerian regulatory requirements (NDPA, tax laws, anti-money laundering)
• Respond to lawful requests from law enforcement and government authorities
• Maintain records required by tax and financial regulations
• Enforce our Terms and Conditions and platform policies
• Maintain audit logs for accountability

We process your personal data on the following legal bases:

• Marketing communications and promotional emails
• Non-essential cookies and analytics tracking
• Sharing data with third parties for advertising purposes
• Collection of optional profile information (date of birth, bio, avatar)

You may withdraw consent at any time through your account settings or by contacting us.

• Processing your orders and delivering purchased products
• Managing your account and providing Platform services
• Processing payments and wallet transactions
• Communicating order status updates and delivery notifications
• Providing customer support for order-related issues

• Maintaining financial transaction records as required by Nigerian tax law
• Responding to valid legal requests from authorities
• Implementing KYC verification for vendors (anti-money laundering compliance)
• Reporting suspicious financial activity
• Retaining audit logs as required by applicable regulations

• Platform security and fraud prevention
• Improving our services and user experience
• Enforcing our Terms and Conditions
• Protecting the rights, safety, and property of Buyuma and its users
• Internal analytics and business reporting
• Maintaining Platform integrity and preventing abuse

These cookies are necessary for the Platform to function and cannot be disabled:

• Authentication Cookies: Sanctum session tokens that keep you logged in
• Security Cookies: CSRF tokens that protect against cross-site request forgery
• Session Cookies: Track your active session for the duration of your visit

These cookies enhance your experience but are not strictly necessary:

• Preference Cookies: Remember your language, currency display, and notification settings
• Cart Cookies: Maintain your shopping cart across sessions (via Zustand + LocalStorage)
• Theme Cookies: Remember dark/light mode preferences

These cookies help us understand how you use the Platform:

• Platform Usage: Page views, feature usage, navigation patterns
• Performance Monitoring: Page load times, error rates, API response times
• Google Analytics: Aggregate usage statistics (if configured via platform settings)

Used to measure campaign and advertising effectiveness:

• Campaign Measurement: Track impressions, clicks, and conversions for Sponsored Products and Stores
• Facebook Pixel: Conversion tracking (if configured via platform settings)
• Marketing Performance: Measure effectiveness of promotional campaigns

You can manage cookies through:

• Browser Settings: Most browsers allow you to block or delete cookies
• Platform Settings: Manage notification and marketing preferences in your account
• Opt-Out: You may opt out of non-essential cookies; however, this may affect Platform functionality

Note: Blocking essential cookies will prevent you from using the Platform.

We share data with trusted service providers who process data on our behalf:

• Paystack: Payment processing, transaction verification, vendor payouts (bank account details, transaction amounts)
• Stripe: Alternative payment processing for applicable transactions
• OrbitConnect: Real-time messaging and push notification delivery (user identifiers, display names, avatars)
• Hosting Providers: Server infrastructure and data storage
• Email/SMS Providers: Delivery of transactional and marketing communications (email addresses, phone numbers)
• Analytics Providers: Platform usage analytics (anonymized where possible)

All service providers are bound by data processing agreements and may only use your data for the purposes we specify.

When you place an order, we share with the relevant vendor(s):

• Your name and shipping address (for delivery)
• Order details (products, quantities, variant selections)
• Your phone number (for delivery coordination, where necessary)
• Messages you send to the vendor via OrbitConnect

Vendors are prohibited from using your data for purposes outside of order fulfillment and customer service. See Section 15 for vendor privacy obligations.

When orders are shipped, we share with logistics/delivery partners:

• Recipient name and delivery address
• Contact phone number
• Package dimensions and weight (where applicable)
• Order reference number

We may disclose your information to government authorities when:

• Required by a valid court order or legal process
• Necessary to comply with Nigerian regulatory requirements
• Required for tax reporting or financial compliance
• Needed to prevent or investigate criminal activity
• Required by the Nigeria Data Protection Commission (NDPC)

We will notify you of such disclosures where legally permitted.

In the event of a merger, acquisition, reorganization, or sale of assets:

• Your personal data may be transferred as part of the transaction
• You will be notified of any such transfer and any changes to data processing
• The acquiring entity will be bound by this Privacy Policy until a new policy is communicated to you
• You will have the option to delete your account if you disagree with the new terms

Paystack is our primary payment processor. When you make a payment:

• You are redirected to Paystack's secure environment or use their inline checkout
• Card details are entered directly on Paystack's PCI-DSS compliant infrastructure
• Buyuma receives only a payment reference, amount, status, and limited metadata
• We do not have access to your full card number, CVV, or PIN

• All payments are verified via Paystack's verification API before orders are confirmed
• Webhook notifications are validated using cryptographic signature verification (HMAC-SHA256)
• Failed verifications result in order rejection; no charges are applied

• Payment processing uses HTTPS encryption
• Webhook signatures prevent unauthorized payment notifications
• Idempotent processing prevents duplicate charges
• Rate limiting protects against payment abuse (5 funding attempts per hour)

• Transactions are monitored for suspicious patterns
• Multiple failed payment attempts trigger security reviews
• IP-based analysis helps identify potentially fraudulent transactions
• Buyuma cooperates with Paystack's fraud prevention systems

We record all wallet transactions including:

• Transaction type (credit/debit)
• Category (refund, purchase, withdrawal, commission, earning, adjustment)
• Amount, balance before, and balance after
• Associated reference (order ID, withdrawal request ID)
• Timestamp of each transaction

• Customer Refund Wallet: Funded exclusively through refund credits and administrative adjustments
• Vendor Earnings Wallet: Funded through order earnings (net of commission) after 7-day settlement period
• All funding sources are traceable to specific orders or administrative actions

When refunds are processed:

• The refund amount, reason, and associated order are recorded
• Wallet credit transaction is logged with full audit trail
• Refund decisions and approvals are tracked for accountability

For vendor withdrawals, we record:

• Withdrawal request amount and destination bank account
• Approval/rejection status and reviewer identity
• Payout processing status via Paystack Transfer API
• Completion or failure records with timestamps
• Payout reference codes from the payment provider

Messages exchanged between customers and vendors via OrbitConnect:

• Are stored on OrbitConnect's servers for delivery and synchronization
• Are accessible to both parties in the conversation
• May be reviewed by Buyuma support when disputes are escalated
• Are subject to content moderation for prohibited communications

Messages with Buyuma support agents:

• Are stored for quality assurance and training purposes
• May be reviewed by supervisors for service improvement
• Are retained for the duration of the support relationship plus applicable retention periods
• Help us track resolution of issues and improve support processes

We process your data to deliver notifications through:

• Email: Order confirmations, shipping updates, account alerts
• SMS: OTP codes, urgent account notifications
• Push Notifications: Real-time updates via OrbitConnect WebSocket (no device tokens stored; delivered to active sessions)
• In-App Notifications: Stored in our database and accessible via your notification center

We monitor communications to detect and prevent:

• Spam and unsolicited advertising
• Harassment, threats, or abusive language
• Attempts to move transactions off-platform
• Phishing, scams, or malicious links
• Sharing of prohibited content

Monitoring may be automated (pattern detection) or manual (when reports are filed).

We retain your data for the following periods:

After retention periods expire, data is either permanently deleted or irreversibly anonymized.

Under the Nigeria Data Protection Act (NDPA) and applicable data protection laws, you have the following rights:

You have the right to request a copy of the personal data we hold about you. To exercise this right:

• Submit a request via email to privacy@buyuma.com
• We will verify your identity before processing the request
• We will respond within 30 days of receiving your verified request
• Data will be provided in a structured, commonly used format (JSON or CSV)

You have the right to request correction of inaccurate or incomplete personal data:

• Update most information directly through your account settings (profile, addresses, preferences)
• For data you cannot self-update, submit a correction request to our privacy team
• We will process corrections within 14 days

You have the right to request deletion of your personal data:

• Submit a deletion request via email to privacy@buyuma.com or through your account settings
• We will delete your data unless retention is required by law (e.g., financial records for 7 years)
• Active orders must be completed or cancelled before account deletion
• Vendor accounts with pending payouts must settle outstanding balances first
• Some anonymized data may be retained for analytics

You have the right to request restriction of processing in certain circumstances:

• When you contest the accuracy of your data (while we verify)
• When processing is unlawful but you prefer restriction over deletion
• When we no longer need the data but you need it for legal claims
• When you have objected to processing (pending verification of legitimate grounds)

You have the right to object to processing based on legitimate interests:

• Object to marketing communications at any time (via account settings or unsubscribe links)
• Object to profiling for personalization (via account settings)
• Object to analytics processing (via cookie preferences)
• We will cease processing unless we demonstrate compelling legitimate grounds

You have the right to receive your personal data in a portable format:

• Request your data in machine-readable format (JSON)
• Data includes: profile information, order history, addresses, wallet transactions, reviews
• We will provide the export within 30 days
• You may request transfer to another service provider where technically feasible

If you are dissatisfied with how we handle your data:

• Contact our Data Protection Officer at privacy@buyuma.com
• We will acknowledge your complaint within 48 hours and respond within 30 days
• If unsatisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC)
• You retain the right to seek judicial remedy through Nigerian courts

Vendors who receive customer data (names, addresses, phone numbers) through order fulfillment must:

• Use customer data solely for the purpose of fulfilling orders and providing customer service
• Not retain customer data longer than necessary for order completion
• Not use customer data for unsolicited marketing or communications outside the Platform
• Implement reasonable security measures to protect customer data in their possession

Vendors agree to:

• Treat all customer information as confidential
• Not disclose customer information to unauthorized third parties
• Not share customer data with other vendors or external services
• Ensure any staff who access customer data are bound by confidentiality

Vendors are strictly prohibited from:

• Building external mailing lists from Buyuma customer data
• Contacting customers outside the Platform for commercial purposes
• Selling, sharing, or transferring customer data to third parties
• Using customer data to create competing services or databases

Violations of vendor privacy obligations will result in account suspension or termination.

Buyuma is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children under 18 years of age.

If we become aware that we have collected data from a child under 18, we will:

• Promptly delete the data
• Terminate the associated account
• Notify the parent or guardian if contact information is available

If a parent or guardian becomes aware that their child has provided personal data to Buyuma without consent:

• Contact us immediately at privacy@buyuma.com
• We will take steps to delete the data within 48 hours of verification
• If a purchase was made, we will work with the parent/guardian to resolve the transaction

We implement comprehensive technical and organizational security measures:

• Encryption: All data transmitted between your device and our servers uses TLS/HTTPS encryption. Sensitive data at rest is encrypted where applicable.
• Password Security: Passwords are stored using industry-standard one-way hashing (bcrypt). We never store or have access to plaintext passwords.
• Access Controls: Role-based access control (RBAC) ensures only authorized personnel access specific data. Six distinct user roles with granular permissions.
• Authentication Controls: Sanctum token-based authentication, optional 2FA, automatic session expiry, and login attempt monitoring.
• Database Security: Row-level locking for financial transactions (wallet operations), transaction isolation for data integrity, and soft deletes to prevent accidental data loss.
• Webhook Security: Cryptographic signature verification (HMAC-SHA256) on all payment provider webhooks prevents unauthorized data injection.
• Monitoring Systems: Real-time monitoring for suspicious activity, automated alerts for security events, and comprehensive audit logging.
• Rate Limiting: Protection against brute force attacks, DDoS mitigation, and API abuse prevention.

Despite our security measures:

• No internet transmission or electronic storage method is 100% secure
• We cannot guarantee absolute security of your data during transmission over the internet
• You are responsible for maintaining the security of your account credentials
• You should use strong, unique passwords and enable 2FA where available
• Report any suspected security breaches to us immediately at security@buyuma.com

Your data may be processed in locations outside Nigeria when:

• Third-party service providers (payment processors, hosting, messaging) operate servers internationally
• Technical operations require data processing in other jurisdictions
• Backup and disaster recovery systems are located in other regions

The following third-party services may process data outside Nigeria:

• Paystack: Payment processing (servers in Nigeria and internationally)
• Stripe: Payment processing (servers in the United States and EU)
• OrbitConnect: Real-time messaging (server locations as per OrbitConnect's infrastructure)
• Hosting/Cloud Providers: Application hosting and data storage

When data is transferred internationally, we ensure:

• Adequate data protection through contractual clauses with service providers
• Service providers maintain security standards comparable to or exceeding Nigerian requirements
• Data processing agreements are in place with all third-party processors
• We assess the data protection laws of recipient countries
• Where necessary, we implement additional safeguards (encryption, pseudonymization)

Buyuma processes personal data in full compliance with the Nigeria Data Protection Act 2023. We:

• Process data lawfully, fairly, and transparently
• Collect data for specified, explicit, and legitimate purposes
• Limit data collection to what is necessary (data minimization)
• Ensure data accuracy and keep it up to date
• Retain data only as long as necessary
• Implement appropriate security measures
• Are accountable for demonstrating compliance

As detailed in Section 14, Nigerian data subjects have rights including:

• Right of access to personal data
• Right to rectification of inaccurate data
• Right to erasure (right to be forgotten)
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right not to be subject to solely automated decision-making

Our data processing adheres to the following principles:

• Lawfulness: Every processing activity has a valid legal basis
• Purpose Limitation: Data is used only for stated purposes
• Data Minimization: We collect only what is necessary
• Accuracy: We take reasonable steps to ensure data is correct
• Storage Limitation: Data is not kept longer than needed
• Integrity and Confidentiality: Appropriate security measures protect all data
• Accountability: We document and can demonstrate our compliance

The Platform may contain links to external websites, including:

• Vendor external websites and social media profiles
• Payment provider portals
• Logistics tracking pages
• Blog references and resources

We integrate with third-party platforms for functionality:

• Paystack/Stripe: Payment processing
• OrbitConnect: Messaging and notifications
• Social Login Providers (Google, Apple, Facebook): Authentication (if enabled)
• Analytics Services: Platform usage tracking

Buyuma is not responsible for the privacy practices, content, or security of third-party services. When you:

• Click a link to an external website
• Use a third-party payment portal
• Authenticate via a social login provider
• Interact with logistics tracking services

You are subject to that third party's privacy policy and terms. We encourage you to review their privacy practices before providing personal data.

Buyuma may update this Privacy Policy from time to time to reflect:

• Changes in our data processing practices
• New features or services that involve personal data
• Changes in applicable law or regulations
• Improvements to our security measures
• Feedback from users and regulatory bodies

When we make material changes to this Policy:

• We will update the "Effective Date" at the top of this document
• We will notify you via email to your registered email address
• We will display an in-app notification banner
• We will send an OrbitConnect push notification (for active users)
• Material changes will include a 30-day notice period before taking effect

For minor or clarifying changes that do not materially affect your rights, updates may take effect immediately upon posting.

Your continued use of the Platform after the effective date of changes constitutes acceptance of the updated Privacy Policy.

For general privacy inquiries:

• Email: privacy@buyuma.com
• Response Time: Within 5 business days

To exercise your data subject rights (access, correction, deletion, portability):

• Email: privacy@buyuma.com
• Subject Line: Include "Data Subject Request" and specify the right you wish to exercise
• Verification: We will verify your identity before processing any request
• Response Time: Within 30 days of verified request receipt

If you have concerns about how we handle your data:

• Internal Complaint: privacy@buyuma.com (responded to within 30 days)
• Regulatory Complaint: Nigeria Data Protection Commission (NDPC) — ndpc.gov.ng
• Judicial Remedy: You may seek relief through Nigerian courts

For legal matters, subpoenas, or formal data requests:

• Email: legal@buyuma.com
• Postal Address: Lagos, Nigeria.
• Response Time: Within timeframes required by applicable law

By using Buyuma, you acknowledge that you have read and understood this Privacy Policy. Your continued use of the Platform constitutes your agreement to the collection, use, and sharing of your information as described herein.

Last Updated: 06 June 2020

Document Version: 1.0