Privacy Policy

ConnectMarket Africa is operated by ConnectMarket Technologies Ltd., a technology company incorporated in Nigeria and operating across Africa. We operate an online marketplace platform that connects buyers and sellers of goods and services across Africa.

For the purposes of applicable data protection laws including the Nigeria Data Protection Regulation (NDPR) 2019 and its implementing regulations, ConnectMarket Technologies Ltd. is the Data Controller responsible for your personal data.

Our registered address is: Lagos, Nigeria
Data Protection Officer: dpo@connectmarket.africa

2.1 Account and registration data

• Full name, email address, phone number
• Username and password (stored as a bcrypt hash — never in plain text)
• Account type (buyer, seller, or both)
• Date and time of registration
• Profile photograph (optional)
• Biography and professional description (optional)

2.2 Identity verification data

• Government-issued ID document (NIN, passport, driver's license, voter's card)
• Facial photograph taken during verification (selfie)
• ID document number (stored as a one-way hash — not reversible)
• Verification status and date

Identity documents are stored encrypted, reviewed by authorised staff only, and permanently deleted from our servers within 90 days of your account being verified or closed.

2.3 Location data

• Country, state, LGA, neighbourhood (provided by you during registration)
• GPS coordinates (only if you grant permission — used to show nearby listings)
• IP address (used for security and fraud detection)

2.4 Transaction and payment data

• Order details, amounts, and timestamps
• Payment method type (card, bank transfer, wallet)
• Transaction reference numbers
• Escrow status and history

We do not store card numbers, CVV codes, or bank account details on our servers. All payment processing is handled by Paystack (Nigeria) and Stripe (global), who are PCI-DSS certified.

2.5 Communication data

• Messages sent between users (stored encrypted using AES-256)
• Support tickets and communications with our team
• Reviews and ratings you submit
• Reports you file against other users or listings

2.6 Technical and usage data

• Device type, operating system, browser type and version
• IP address and approximate location derived from IP
• Pages visited, features used, time spent on platform
• Search queries and browsing history within the platform
• Error logs and crash reports (via Sentry)

We use your data to:

• Provide the marketplace service — create and manage your account, show you relevant listings, process transactions, and facilitate communication between buyers and sellers
• Verify your identity — confirm you are a real person, prevent duplicate accounts, and award verification badges
• Process payments — hold escrow, release funds, process refunds, and maintain transaction records
• Personalise your experience — show listings near your location, recommend sellers based on your activity, and customise your feed
• Protect against fraud and scams — detect suspicious activity, flag potential scammers, enforce our policies, and ban bad actors
• Send important communications — account notifications, order updates, verification status, security alerts
• Improve the platform — analyse usage patterns, fix bugs, develop new features, and conduct research
• Comply with legal obligations — respond to lawful requests from Nigerian authorities, maintain financial records as required by law

We do NOT use your data to:

• Sell your personal data to any third party — ever
• Display third-party advertisements on our platform
• Build advertising profiles for external platforms
• Share your identity documents with other users
• Use your financial data for purposes beyond payment processing

Under the NDPR and GDPR-equivalent principles, we process your personal data on the following legal grounds:

• Contract performance — processing necessary to provide the marketplace service you signed up for (account management, order processing, payments)
• Legitimate interests — fraud detection, platform security, improving our service, and communicating about important platform changes
• Legal obligation — complying with Nigerian law, financial regulations, and lawful requests from law enforcement
• Consent — marketing communications, optional analytics, and where we specifically ask for your consent

We share your data only with service providers necessary to operate the platform. All third parties are bound by data processing agreements.

We may also disclose your data to law enforcement agencies, courts, or government bodies in Nigeria when required by law, or to protect the safety of our users or the public.

ConnectMarket requires sellers to verify their identity to protect buyers from fraud. This involves submitting a government-issued ID document and a live selfie photograph.

How we handle your ID documents:

• Documents are uploaded directly to Cloudinary over an encrypted connection
• Access is restricted to a small team of authorised verification reviewers
• Your ID number is stored as a one-way cryptographic hash — we cannot recover the original number
• The document image is permanently deleted from our servers within 90 days of verification approval or account closure
• We never share your ID documents with other users, third parties, or advertisers
• Documents are never used for any purpose beyond verifying your identity for platform access

Location is central to how ConnectMarket works — it helps buyers find sellers near them.

• Location you provide — your country, state, LGA, and neighbourhood are stored and used to show you relevant listings and make your profile discoverable to nearby buyers.
• GPS location — only collected if you explicitly grant permission. Used to show listings within your selected radius. You can revoke this permission at any time in your device settings.
• Approximate location from IP — used for fraud detection and security. Not displayed to other users.

Your precise GPS coordinates are never shared with other users. Other users see only your listed neighbourhood (e.g. "Lekki Phase 1, Lagos"), not your exact address or GPS coordinates.

ConnectMarket uses Paystack (for African users) and Stripe (for global users) to process all payments. We do not store your full card numbers, CVV codes, or bank account numbers on our servers.

What we store in our database:

• Order amounts and timestamps
• Payment status (pending, paid, refunded)
• Transaction reference numbers from Paystack or Stripe
• Escrow status and history

All payment card data is stored securely by Paystack or Stripe, both of which are PCI-DSS Level 1 certified — the highest standard in payment security.

We use the following types of cookies and similar tracking:

We do not use advertising cookies or sell data to ad networks. We do not use third-party trackers such as Facebook Pixel, Google Ads tags, or similar tracking scripts.

• All data transmitted over HTTPS/TLS 1.3 encryption
• Passwords hashed with bcrypt (cost factor 12) — never stored in plain text
• Chat messages encrypted at rest using AES-256
• Identity documents stored encrypted with restricted access
• JWT access tokens expire in 15 minutes
• Rate limiting on all authentication endpoints
• Automatic IP blocking after repeated suspicious activity
• Two-factor OTP required for sensitive operations
• Database access restricted by Row Level Security (RLS)
• Regular security audits and dependency scanning
• Sentry monitors for anomalous activity and errors in real time

Despite these measures, no system is 100% secure. If you believe your account has been compromised, contact us immediately at privacy@connectmarket.africa

Under the NDPR and equivalent data protection principles, you have the following rights regarding your personal data:

To exercise any of these rights, email dpo@connectmarket.africa with the subject "Data Rights Request" and your registered email address. We will respond within 30 days.

ConnectMarket Africa is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors. If we discover that a user under 18 has created an account, we will immediately suspend the account and delete all associated data.

If you believe a minor has created an account on our platform, please contact us at privacy@connectmarket.africa

As a pan-African platform, we use service providers located in various countries including the USA, EU, and Nigeria. When your data is transferred outside Nigeria, we ensure appropriate safeguards are in place:

• Data Processing Agreements with all service providers
• Standard Contractual Clauses for transfers to non-adequate countries
• Selection of GDPR-compliant and SOC2-certified providers where available
• Minimisation of data transferred internationally (only what each provider needs)

ConnectMarket Africa is committed to full compliance with the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act 2023.

• We have appointed a Data Protection Officer (DPO) reachable at dpo@connectmarket.africa
• We conduct annual Data Protection Impact Assessments (DPIA) for high-risk processing activities
• We maintain a Record of Processing Activities (ROPA) as required by NDPR Article 2.6
• We report data breaches to NITDA within 72 hours of discovery when required
• We engage only NDPR-compliant third-party processors or those with equivalent international standards

To report a data breach or compliance concern, contact: dpo@connectmarket.africa

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send you an email notification at your registered address
• Display an in-app banner prompting you to review the changes
• Where required by law, obtain your consent before the changes take effect

Continued use of ConnectMarket after the effective date of changes constitutes acceptance of the updated policy.

For any questions, concerns, or requests regarding this Privacy Policy or your personal data:

Postal address: ConnectMarket Technologies Ltd., Lagos, Nigeria

To lodge a formal complaint with the Nigerian data protection authority: National Information Technology Development Agency (NITDA) — nitda.gov.ng