Privacy Policy

1. Introduction

[Company Legal Name]("MustardPrint", "we", "our", "us") operates the marketplace at mustardprint.com.ng (the "Platform"). This Privacy Policy explains what personal data we collect from buyers, vendors, professionals, and visitors ("you"), why we collect it, who we share it with, and the choices and rights you have.

We process personal data in accordance with the Nigeria Data Protection Act, 2023 ("NDPA") and its General Application and Implementation Directive, as enforced by the Nigeria Data Protection Commission ("NDPC"). For users accessing the Platform from outside Nigeria, we also aim to honor the principles of applicable data protection laws such as the EU/UK GDPR where they apply to you.

For NDPA purposes, [Company Legal Name] is the data controller for personal data processed through the Platform. Our contact details are in Section 11.

2. Information We Collect

• Account data: your name, email address, and/or Nigerian phone number, depending on whether you sign in with Google, email and password, or phone and one-time code (OTP); your profile photo if provided via Google.
• Order & transaction data: items and specifications in your cart or orders, delivery address, order status, and reviews you leave. We do not collect or store card or bank account numbers, as payment is arranged directly with the vendor (see Section 5).
• Vendor & professional data: business name, address, phone number, business registration details, uploaded logos/portfolio images, and staff members' account information, if you register a business or professional listing.
• Location data:if you use the "near me" search feature, we request your device's approximate location (via your browser, with your permission) to find nearby vendors and professionals. This is used only for that search and is not stored against your account.
• Usage & device data: pages visited, cart contents, browser type, and similar diagnostic data, collected through cookies and similar technologies (see Section 6).

3. How We Use Your Information

We use personal data to: create and secure your account; process and route your orders to vendors; verify your phone number via SMS OTP; operate the "near me" search; display your reviews; respond to support requests, reports, and disputes; improve the Platform; and comply with legal obligations.

Our legal bases under the NDPA for these activities are, depending on the activity: your consent (e.g., location access, marketing messages), performance of a contract with you (e.g., processing your order), and our legitimate interest in operating and securing the Platform, balanced against your rights.

4. Who We Share Data With

We share personal data only where necessary:

• Vendors & professionals: your name, phone number, and order details are shared with the vendor or professional you order from, so they can fulfil and deliver your order.
• Service providers: we use Supabase for authentication and database hosting, Cloudinary for image storage and delivery, and Termii/Kudi SMS for phone verification codes. These providers process data on our behalf and are contractually restricted from using it for their own purposes.
• Legal & safety: we may disclose data where required by Nigerian law, court order, or to a regulator such as the NDPC, or where necessary to investigate fraud or protect the safety of our users.

We do not sell your personal data to third parties.

5. Order & WhatsApp Processing

When you check out, your order details are packaged into a message that opens a WhatsApp conversation with the vendor or our order desk, so the order can be confirmed and payment/delivery arranged directly with you.

We do not collect, process, or store payment card or bank account details on the Platform. Once your order is routed to WhatsApp, that conversation is subject to WhatsApp's (Meta's) own privacy policy, which we encourage you to review.

6. Cookies & Similar Technologies

We use strictly necessary cookies to keep you signed in, remember your cart, and secure your session — these do not require consent under the NDPA's General Application and Implementation Directive (GAID) because the Platform cannot function without them.

[If MustardPrint adds analytics, advertising, or other non-essential cookies, a cookie consent banner offering Accept/Reject choices is required under the GAID before those cookies are set — this must be implemented separately from this policy text.]

7. Data Security & Retention

We use industry-standard measures to protect your data, including encrypted connections, access controls on our database, and secure token-based authentication rather than storing raw passwords.

We retain account and order data for as long as your account is active and for a reasonable period afterward to meet legal, tax, and dispute-resolution obligations, after which it is deleted or anonymized. If we experience a data breach affecting your personal data, we will notify the NDPC and affected users as required by the NDPA.

8. International Data Transfers

Some of our service providers (such as our cloud hosting and image storage providers) may store or process data outside Nigeria. Where this happens, we take steps intended to meet the NDPA's cross-border transfer requirements, such as confirming the receiving country or organization provides an adequate level of data protection, or relying on contractual safeguards with the provider.

9. Your Data Rights

Under the NDPA, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Request deletion of your data, subject to our legal retention obligations;
• Object to or restrict certain processing, and withdraw consent at any time where processing is based on consent;
• Request a copy of your data in a portable format;
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe we have mishandled your data.

To exercise any of these rights, contact us using the details in Section 11. We will respond within the timeframe required by the NDPA.

10. Children's Privacy

The Platform is not directed at children and is not intended for use by anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us so we can delete it.

11. Policy Updates & Contact

We may update this Privacy Policy as our features or legal obligations change. We will update the "Last updated" date above and, for material changes, notify you by email or an in-app notice.

To exercise your data rights or ask a question about this policy, contact our data privacy contact at [privacy/DPO email]. You may also contact the Nigeria Data Protection Commission at info@ndpc.gov.ng or via ndpc.gov.ng.