IN THE MATTER OF DATA PROTECTION AND PRIVACY ON THE GOODEALS E-COMMERCE PLATFORM
PRIVACY POLICY
Version: 2.1.0 | Effective Date: 05 August 2026
ARTICLE 1: PREAMBLE AND OUR COMMITMENT
1.1. GOODEALS, a business operating in the Federal Republic of Nigeria whose incorporation with the Corporate Affairs Commission is currently in progress ("GOODEALS," "we," "us," or "our") is built on a foundation of trust. We are unequivocally committed to protecting the privacy and personal data of our Users ("you," "your").
1.2. This Privacy Policy constitutes a non-negotiable, standalone document that governs how we process your personal information. It is drafted in strict compliance with the Nigeria Data Protection Act (NDPA).
1.3. This Policy clearly sets forth what personal data we collect, our legal basis for processing it, how it is used, your rights as a data subject, and the security measures we employ.
1.4. How this Policy is presented, and what we record. When you create an account you are shown this Policy and asked to tick a box confirming that you have read it. We record which version you were shown, together with the date and time, so that we can later demonstrate what you were told. You may ask us for that record at any time.
1.5. Acknowledgement is not consent, and consent is not the only basis. Ticking that box records that this Policy was presented to you. It is not, by itself, your consent to any particular processing. Most of our processing rests on the bases set out in Article 4 — performance of a contract, a legal obligation, or a legitimate interest — none of which requires your consent. Where we do rely on consent, such as for direct marketing or non-essential cookies, we ask for it separately, at the point we rely on it, and you may withdraw it as easily as you gave it.
1.6. You do not waive anything by acknowledging this Policy. Your rights under the NDPA, set out in Article 9, apply in full regardless of what you have ticked, and cannot be signed away.
ARTICLE 2: THE DATA CONTROLLER
2.1. For the purpose of the NDPA, the Data Controller is:
- Entity: GOODEALS
- Registration: Registration in progress
- Registered address: Registered office address will be published upon completion of incorporation.
- Contact for data protection matters: privacy@goodeals.com.ng
2.2. Where this Policy states that registration or an address is pending, that reflects our actual status at the effective date above. We will publish the completed particulars, and notify Users in accordance with Article 11, once registration concludes.
ARTICLE 3: PERSONAL DATA WE COLLECT
We collect and process your personal data only as is necessary to provide our services and fulfill our legal obligations. The data includes:
3.1. Identity Data: Full legal name, username, date of birth.
3.2. Contact Data: Email address, telephone number(s), and physical delivery addresses.
3.3. Financial Data: Bank account details supplied by Vendors and Affiliates for payout purposes. Payment card details are entered directly with our payment processor, Paystack Payments Limited, and are never collected, transmitted, or stored by GOODEALS.
3.4. We do NOT collect Bank Verification Numbers (BVN). Should payout verification ever require BVN collection, we will amend this Policy and obtain a lawful basis before any such collection begins.
3.5. Transactional Data: Details about payments to and from you, and full details of the products and services you have purchased or sold on our Platform.
3.6. Technical Data: Internet Protocol (IP) address, login data, browser type and version, time zone setting and location, and other technology on the devices you use to access this Platform.
3.7. Profile Data: Your username and password, orders made by you, your interests, product preferences, and feedback/survey responses.
3.8. Usage Data: Information about how you use our website, products, and services.
3.9. AI Interaction Data: Where you use our AI assistant features, the messages you send, and any audio you submit for voice input, together with a record of the assistant's responses. See Article 6A.
ARTICLE 4: LEGAL BASIS FOR PROCESSING YOUR DATA
Our processing of your personal data is lawful and grounded on the following bases as defined by the NDPA:
4.1. Contract: We process your data where it is necessary for the performance of a contract with you (e.g., to process your order, deliver goods, or pay out funds to a Vendor).
4.2. Legal Obligation: We process your data where it is necessary for compliance with a legal obligation (e.g., tax law, fraud prevention, or responding to lawful requests from authorities).
4.3. Legitimate Interests: We process your data where it is necessary for our legitimate interests (e.g., to improve our Platform, prevent fraud, and secure our systems), provided your fundamental rights do not override those interests.
4.4. Consent: Where required by law (e.g., for direct marketing communications), we will process your data only after receiving your clear, specific, and unambiguous consent.
ARTICLE 5: HOW WE USE YOUR PERSONAL DATA
Your data is used exclusively for the following specified purposes:
a. To register you as a new User. b. To process and deliver your orders (this includes managing payments, fees, and charges). c. To manage our relationship with you (e.g., notifying you of policy changes, facilitating dispute resolution). d. To administer and protect our business and this Platform (including security, fraud prevention, troubleshooting, and data analysis). e. To deliver relevant website content and marketing communications to you (only where you have consented). f. To use data analytics to improve our Platform, services, marketing, and user experience. g. To comply with all relevant legal and regulatory obligations.
ARTICLE 6: DATA SHARING AND DISCLOSURE
We do not sell your personal data. We only share it in the following limited circumstances:
a. Vendors: To allow a Vendor to fulfill the order you placed with them. b. Logistics Partners: To our delivery partners for the sole purpose of delivering your order. c. Payment Processors: To Paystack Payments Limited, our licensed payment service provider, to process your payments and to hold funds in transit between Buyer and Vendor. GOODEALS does not itself hold or take custody of Buyer funds. d. Legal Authorities: To law enforcement or regulatory bodies when we are under a legal obligation to do so. e. Infrastructure and Service Providers: To the hosting, storage, error monitoring, and AI providers described in Articles 6A and 6B, acting as our processors under contract.
ARTICLE 6A: ARTIFICIAL INTELLIGENCE FEATURES
6A.1. The Platform offers AI-assisted features, including shopping assistance, product discovery, support chat, and voice input.
6A.2. What is processed: the content of your messages to the assistant, audio you submit for voice transcription, and context about your account necessary to answer your request (for example, your recent orders when you ask about them).
6A.3. Third-party AI processors: your inputs are transmitted to Google (Gemini) and OpenAI for processing. These providers operate outside Nigeria — see Article 6B.
6A.4. Retention: AI conversation records, including transcripts, are retained for audit, safety, and dispute-resolution purposes and are deleted in accordance with Article 8.
6A.5. Personalisation: we may derive preference and interest profiles from your browsing and purchase activity to rank and recommend products. This is profiling. It does not produce legal effects concerning you and does not determine pricing. You may object under Article 9(f).
6A.6. No solely automated decisions: we do not make decisions producing legal or similarly significant effects concerning you based solely on automated processing, without human involvement.
6A.7. Please do not enter payment card details, passwords, or another person's personal data into the AI assistant.
ARTICLE 6B: INTERNATIONAL TRANSFER OF PERSONAL DATA
6B.1. The Platform is operated using infrastructure located outside the Federal Republic of Nigeria. Your personal data is therefore transferred to, and processed in, other countries — principally the United States and the European Union.
6B.2. Categories of recipient: application and database hosting, object storage, error and performance monitoring, and the AI providers named in Article 6A.
6B.3. Safeguards: each such transfer is made to a recipient bound by a written data processing agreement imposing confidentiality, security, purpose limitation, and sub-processor controls, on the basis permitted under Part IX of the NDPA.
6B.4. You may request details of the recipients and the safeguards applied by contacting our privacy team at privacy@goodeals.com.ng.
ARTICLE 7: DATA SECURITY MEASURES
7.1. We have instituted appropriate and robust technical and organizational security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way.
7.2. These measures include data encryption in transit, access controls, secure server infrastructure, and security vulnerability assessment.
7.3. Personal Data Breaches: where a breach of personal data occurs that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to you, we will also notify you directly and without undue delay, describing what happened, the likely consequences, and the steps we are taking.
7.4. No method of transmission or storage is completely secure. We do not claim that the Platform is immune to compromise; we claim that we take reasonable and appropriate measures, and that we will tell you promptly if something goes wrong.
ARTICLE 8: DATA RETENTION
8.1. We will only retain your personal data for as long as is reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, or reporting requirements.
8.2. In general, transactional data will be held for a period of 7 years in compliance with Nigerian law.
ARTICLE 9: YOUR RIGHTS AS A DATA SUBJECT
Under the NDPA, you have the following rights. Some are qualified rather than absolute — for example, we may be required to retain transaction records for tax purposes even after an erasure request. Where we cannot give full effect to a request, we will tell you why.
a. The Right to Access: You may request a copy of the personal data we hold about you. b. The Right to Rectification: You may request the correction of any incomplete or inaccurate data we hold about you. c. The Right to Erasure: You may request that we delete your personal data where there is no compelling legal reason for us to continue processing it. d. The Right to Restrict Processing: You may request that we suspend the processing of your data in certain circumstances. e. The Right to Data Portability: You may request the transfer of your data to you or to a third party in a structured, machine-readable format. f. The Right to Object: You may object to our processing of your data where we are relying on a legitimate interest (or that of a third party). g. The Right to Withdraw Consent: Where we rely on your consent, you have the right to withdraw that consent at any time.
h. The Right to Lodge a Complaint: you may complain to the Nigeria Data Protection Commission (NDPC) at any time. Nothing in this Policy requires you to contact us first.
To exercise any of these rights, please contact our privacy team at privacy@goodeals.com.ng. We will respond within the period required by the NDPA.
ARTICLE 10: CHILDREN'S PRIVACY
The GOODEALS Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children.
ARTICLE 11: POLICY AMENDMENTS
11.1. This Privacy Policy may be updated from time to time. Each version carries a version number and effective date at the head of this document.
11.2. We will notify you of any material change by email or through a prominent notice on the Platform before it takes effect.
ARTICLE 12: HOW TO CONTACT US
12.1. To ask questions, raise concerns about this Policy, or exercise your data rights, contact our privacy team at privacy@goodeals.com.ng, using the subject line "Data Protection Inquiry".
12.2. Where a Data Protection Officer is required under the NDPA and has been appointed, that officer's contact details will be published in this Article. Until then, requests are handled by the privacy contact above and are subject to the same statutory response deadlines.
12.3. You may also contact the Nigeria Data Protection Commission directly.