IN THE MATTER OF DATA PROTECTION AND PRIVACY ON THE GOODEALS E-COMMERCE PLATFORM
PRIVACY POLICY
Effective Date: 17 October 2025
ARTICLE 1: PREAMBLE AND OUR COMMITMENT
1.1. GOODEALS NIGERIA LTD. ("GOODEALS," "we," "us," or "our") is built on a foundation of trust. We are unequivocally committed to protecting the privacy and personal data of our Users ("you," "your").
1.2. This Privacy Policy constitutes a non-negotiable, standalone document that governs how we process your personal information. It is drafted in strict compliance with the Nigeria Data Protection Act (NDPA).
1.3. This Policy clearly sets forth what personal data we collect, our legal basis for processing it, how it is used, your rights as a data subject, and the security measures we employ. By using the GOODEALS Platform, you acknowledge that you have read and understood the terms of this Policy.
ARTICLE 2: THE DATA CONTROLLER
2.1. For the purpose of the NDPA, the Data Controller is: GOODEALS NIGERIA LTD. [Registered Address, Lagos, Nigeria] [Contact Email: legal@goodeals.com.ng]
ARTICLE 3: PERSONAL DATA WE COLLECT
We collect and process your personal data only as is necessary to provide our services and fulfill our legal obligations. The data includes:
3.1. Identity Data: Full legal name, username, date of birth. 3.2. Contact Data: Email address, telephone number(s), and physical delivery addresses. 3.3. Financial Data: Bank Verification Number (BVN) (for Vendor payout verification), bank account details, and payment card details (processed securely by our third-party payment gateway). 3.4. Transactional Data: Details about payments to and from you, and full details of the products and services you have purchased or sold on our Platform. 3.5. Technical Data: Internet Protocol (IP) address, login data, browser type and version, time zone setting and location, and other technology on the devices you use to access this Platform. 3.6. Profile Data: Your username and password, orders made by you, your interests, product preferences, and feedback/survey responses. 3.7. Usage Data: Information about how you use our website, products, and services.
ARTICLE 4: LEGAL BASIS FOR PROCESSING YOUR DATA
Our processing of your personal data is lawful and grounded on the following bases as defined by the NDPA:
4.1. Contract: We process your data where it is necessary for the performance of a contract with you (e.g., to process your order, deliver goods, or pay out funds to a Vendor). 4.2. Legal Obligation: We process your data where it is necessary for compliance with a legal obligation (e.g., tax law, fraud prevention, or responding to lawful requests from authorities). 4.3. Legitimate Interests: We process your data where it is necessary for our legitimate interests (e.g., to improve our Platform, prevent fraud, and secure our systems), provided your fundamental rights do not override those interests. 4.4. Consent: Where required by law (e.g., for direct marketing communications), we will process your data only after receiving your clear, specific, and unambiguous consent.
ARTICLE 5: HOW WE USE YOUR PERSONAL DATA
Your data is used exclusively for the following specified purposes:
a. To register you as a new User. b. To process and deliver your orders (this includes managing payments, fees, and charges). c. To manage our relationship with you (e.g., notifying you of policy changes, facilitating dispute resolution). d. To administer and protect our business and this Platform (including security, fraud prevention, troubleshooting, and data analysis). e. To deliver relevant website content and marketing communications to you (only where you have consented). f. To use data analytics to improve our Platform, services, marketing, and user experience. g. To comply with all relevant legal and regulatory obligations.
ARTICLE 6: DATA SHARING AND DISCLOSURE
We do not sell your personal data. We only share it in the following limited circumstances:
a. Vendors: To allow a Vendor to fulfill the order you placed with them. b. Logistics Partners: To our delivery partners for the sole purpose of delivering your order. c. Payment Processors: To our secure, third-party payment gateways to process your payments. d. Legal Authorities: To law enforcement or regulatory bodies when we are under a legal obligation to do so.
ARTICLE 7: DATA SECURITY MEASURES
7.1. We have instituted appropriate and robust technical and organizational security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way.
7.2. These measures include data encryption, access controls, secure server infrastructure, and regular security vulnerability assessments.
ARTICLE 8: DATA RETENTION
8.1. We will only retain your personal data for as long as is reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, or reporting requirements.
8.2. In general, transactional data will be held for a period of seven (7) years in compliance with Nigerian law.
ARTICLE 9: YOUR RIGHTS AS A DATA SUBJECT
Under the NDPA, you have the following inalienable rights, which you may exercise at any time:
a. The Right to Access: You may request a copy of the personal data we hold about you. b. The Right to Rectification: You may request the correction of any incomplete or inaccurate data we hold about you. c. The Right to Erasure: You may request that we delete your personal data where there is no compelling legal reason for us to continue processing it. d. The Right to Restrict Processing: You may request that we suspend the processing of your data in certain circumstances. e. The Right to Data Portability: You may request the transfer of your data to you or to a third party in a structured, machine-readable format. f. The Right to Object: You may object to our processing of your data where we are relying on a legitimate interest (or that of a third party). g. The Right to Withdraw Consent: Where we rely on your consent, you have the right to withdraw that consent at any time.
To exercise any ofthese rights, please contact our Data Protection Officer.
ARTICLE 10: CHILDREN'S PRIVACY
The GOODEALS Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children.
ARTICLE 11: POLICY AMENDMENTS
This Privacy Policy may be updated from time to time. We will notify you of any material changes by email or through a prominent notice on our Platform.
ARTICLE 12: CONTACT AND DATA PROTECTION OFFICER
To ask questions, raise concerns about this Policy, or exercise your data rights, please contact our Data Protection Officer (DPO) at:
Email: dpo@goodeals.com.ng Subject Line: Data Protection Inquiry