Privacy policy

Who we are

ShopBudMall is a business-to-business marketplace operating in Nigeria. When you buy through us we are the data controller for the information described below. We process personal data under the Nigeria Data Protection Act 2023.

What we collect

Your account

Your name, email address and phone number. If you sign in with Google we receive your Google account identifier and email address, and we only link it to an existing account when Google tells us the address is verified. We never receive your Google password.

Your business

Trading name, registered name, registration and tax numbers, address, and the people you invite onto the account. For higher transaction limits we also collect verification documents — certificates of incorporation, identity documents and proof of address. These are held in restricted storage and are readable only by staff whose role grants it.

What you do here

Orders, baskets, quotations, payments, shipments, support tickets and disputes. We record pages viewed and actions taken on the shop so we can see where the service is failing people — that record is tied to a session rather than to your name unless you are signed in.

Payments

We do not store card numbers or bank credentials. Payments are handled by our payment provider, who receives the amount, a reference and your contact details in order to process the transaction. We keep the reference, the amount and the outcome.

Why we hold it

• To run your orders — taking payment, arranging delivery, and handling returns and disputes.
• Because the law requires it — verification checks, tax records, and anti-money-laundering obligations.
• To keep the platform safe — every privileged action taken by our staff is recorded with who did it and when, so decisions about your account can be explained afterwards.
• To tell you what is happening — order updates, payment confirmations and delivery notices.

How long we keep it

• Order, payment and dispute records — kept for as long as tax and accounting law requires, because they are financial records rather than marketing data.
• Verification documents — kept while your account is active and for the period our obligations require afterwards.
• Data extracts — when a member of our staff exports a dataset, the file is deleted automatically after 48 hours. The record of who asked for it, and what they asked for, is kept.
• Operational logs — background job history is kept for 30 days.

Who else sees it

Our payment provider, the carriers who deliver to you, and the infrastructure providers who host the service. Manufacturers listed here see performance figures about their own products — order counts, delivery timeliness and upheld claims — but not your name, your contact details or what you paid.

We do not sell personal data, and we do not share it for advertising.

Cookies

We use cookies that the service cannot work without: one that keeps you signed in, one that lets a basket survive between visits before you have an account, and a short-lived one that protects the Google sign-in flow from interference. We do not use advertising cookies.

What you can ask for

• A copy of the personal data we hold about you.
• Correction of anything that is wrong.
• Deletion of data we no longer have a legal reason to keep. Records we are required to retain — chiefly financial ones — cannot be deleted on request.
• That we stop sending you messages that are not about an order.

Write to [email protected]. We will respond within 30 days. If you are not satisfied you may complain to the Nigeria Data Protection Commission.

Changes

When this policy changes we update the date at the top. If a change materially affects how we use your data, we will tell you directly rather than relying on you re-reading this page.