Privacy Policy

1. Who We Are

Tradefair Technologies Ltd is a company incorporated under the laws of the Federal Republic of Nigeria, operating a secure multi-vendor marketplace platform ("the Platform"). Our registered office is at 15 Akinola Cole Crescent, Lekki Phase 1, Lagos, Nigeria.

For all data protection enquiries, you may contact us at: support@tradefair.store

2. Information We Collect

We collect various types of information in order to provide and improve our services.

2.1 Information You Provide Directly

• Full legal name, email address, phone number, and residential or business address
• Date of birth and government-issued identification documents (for KYC/identity verification)
• Business registration information (for vendor accounts), including CAC registration number
• Bank account details and payment information for processing transactions
• Profile information including profile photos and product listings (vendors)
• Communications you submit via our support channels, dispute forms, or contact forms

2.2 KYC & Identity Verification Data

For all vendor accounts, we collect and process Know Your Customer (KYC) data as required by applicable financial regulations and our payment processing obligations. This includes:

• National Identity Number (NIN) or Bank Verification Number (BVN)
• Government-issued photo ID (National ID Card, Driver's Licence, International Passport)
• Biometric selfie for facial comparison during onboarding
• Proof of business address and utility bills
• Business registration certificates where applicable

2.3 Transaction & Payment Data

• Transaction history, amounts, timestamps, and counterparty information
• Escrow account status and payment confirmation records
• Dispute and refund processing records
• Payment method metadata (card type, issuing bank, last 4 digits) — no full card numbers are stored on our servers

2.4 Automatically Collected Data

• Device identifiers (Device ID, IMEI where applicable), operating system, and browser type
• IP address, geolocation data, and network information
• App usage data, click events, session duration, and navigation patterns
• Crash reports and diagnostic data to improve platform stability

3. How We Use Your Information

We use the personal information we collect for the following purposes:

• Account creation and authentication: To register and verify your identity on the Platform
• KYC compliance: To verify vendor identities in accordance with financial regulatory requirements
• Transaction processing: To execute, record, and manage payments and escrow transactions
• Dispute resolution: To investigate, mediate, and resolve disputes between buyers and vendors
• Fraud prevention and security: To detect, prevent, and investigate fraudulent activity and policy violations
• Customer support: To respond to enquiries, complaints, and technical support requests
• Service improvement: To analyse usage patterns and improve app functionality and user experience
• Legal compliance: To meet our obligations under Nigerian law, including the Nigeria Data Protection Regulation (NDPR) and CBN regulations
• Marketing communications: To send product updates and promotional content (you may opt out at any time)

4. Legal Basis for Processing

We process your personal data on the following legal bases under the Nigeria Data Protection Regulation (NDPR) 2019:

• Contractual necessity: Processing required to fulfil our obligations under your user agreement
• Legal obligation: Processing necessary to comply with applicable financial, tax, and AML regulations
• Legitimate interests: Processing for fraud prevention, security, and service improvement
• Consent: Processing for marketing communications and optional features, where consent has been obtained

5. Payment Processing

All payment transactions on the Tradefair platform are processed through licensed third-party payment processors operating in Nigeria and compliant with CBN regulations. We do not store full payment card numbers or sensitive authentication data on our servers.

Our escrow payment model requires us to temporarily hold funds on behalf of buyers pending delivery confirmation. These funds are held in a segregated account managed in accordance with applicable financial services regulations.

Our payment processors are bound by data processing agreements that require them to protect your payment information to standards at least as stringent as our own.

6. Data Sharing & Disclosure

We do not sell your personal data to third parties. We may share your information in the following limited circumstances:

• Payment processors: To execute and record financial transactions on the Platform
• KYC/identity verification providers: To fulfil our compliance obligations during onboarding
• Delivery and logistics partners: Order fulfilment information shared with delivery providers where applicable
• Legal and regulatory authorities: Where required by court order, regulatory enquiry, or applicable law
• Fraud prevention services: To detect and prevent fraudulent activity and policy violations
• Professional advisers: Including legal, accounting, and audit professionals under confidentiality obligations

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy or as required by law:

• Account and profile data: Retained for the duration of your account and up to 7 years after account closure
• KYC and identity documents: Retained for a minimum of 5 years in accordance with AML/CFT regulatory requirements
• Transaction records: Retained for 7 years in accordance with financial record-keeping obligations
• Support communications: Retained for 3 years after the last interaction

8. Data Protection & Security

We implement industry-standard technical and organisational measures to protect your data against unauthorised access, loss, or disclosure, including:

• AES-256 encryption for data at rest
• TLS 1.3 encryption for all data in transit
• Access controls and role-based permissions limiting internal access to personal data
• Regular security audits and penetration testing
• Incident response plans for data breach notification
• PCI-DSS compliant payment infrastructure

In the event of a data breach affecting your rights and freedoms, we will notify you and the relevant regulatory authority within 72 hours of becoming aware of the breach, as required by applicable law.

9. Your Rights

As a data subject under the Nigeria Data Protection Regulation (NDPR), you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete personal data
• Right to erasure: Request deletion of your data where there is no legitimate basis for continued processing
• Right to object: Object to processing based on our legitimate interests or for direct marketing
• Right to data portability: Request your data in a structured, machine-readable format
• Right to withdraw consent: Withdraw previously given consent without affecting prior lawful processing
• Right to lodge a complaint: File a complaint with the National Information Technology Development Agency (NITDA)

To exercise any of these rights, please contact us at support@tradefair.store. We will respond within 30 days of your request.

10. Cookies & Tracking Technologies

Our mobile application and website may use cookies, device identifiers, and similar tracking technologies to improve your experience and analyse usage patterns. You may control cookie settings through your device or browser preferences. Disabling cookies may affect the functionality of certain features.

11. Children's Privacy

Tradefair is not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a person under 18, we will take immediate steps to delete that data. If you believe we have collected data from a minor, please contact us at support@tradefair.store.

12. International Data Transfers

Your data is primarily stored and processed within Nigeria. Where we engage third-party service providers that process data outside Nigeria, we ensure that appropriate safeguards are in place, including contractual data protection clauses consistent with NDPR requirements.

13. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, services, or legal obligations. We will notify you of material changes by in-app notification or email at least 14 days before the changes take effect. Continued use of the Platform after the effective date constitutes acceptance of the updated policy.

14. Contact & Complaints

For any privacy-related questions, requests, or complaints, please contact our Data Protection Officer: