Privacy Policy

Vayva Technologies Ltd Privacy Policy

Vayva Technologies Ltd ("Vayva," "we," "us," or "our"), BN9089966, with its registered office at 19 Princess Bola Kazem, Shangisha, Lagos, Nigeria, is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, disclose, retain, and protect your personal information when you use our B2B commerce platform at https://vayva.ng (the "Platform"). This policy complies with the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR) 2019, and other applicable data protection laws.

The Platform operates as a B2B commerce enablement platform where merchants create and operate digital storefronts. Given this dual nature, data controller and processor roles under the NDPA 2023 are allocated as follows:

• aMerchant Account Data — Vayva as Data Controller: Vayva Technologies Ltd is the data controller for personal data collected in connection with merchant account registration, KYC verification, billing and subscription management, and direct communications between Vayva and its merchants. This includes identity data (name, NIN, BVN, government-issued ID), contact data (email, phone, business address), financial data (bank account details, transaction history with Vayva), and business data (CAC registration, tax identification). As data controller, Vayva determines the purposes and means of processing this data and bears full responsibility for compliance with the NDPA 2023 in respect of such processing. We are registered with the Nigeria Data Protection Commission (NDPC) and have appointed a Data Protection Officer (DPO) who can be reached at privacy@vayva.ng.

• bStorefront Customer Data — Merchant as Data Controller; Vayva as Data Processor: When a merchant's storefront collects personal data from its end-customers — including during checkout, account creation, newsletter signups, or any other interaction with the merchant's store — the merchant (not Vayva) is the data controller for that personal data. In this capacity, the merchant determines the purposes and means of processing such data. Vayva acts solely as a data processor, processing storefront customer data on behalf of the merchant in accordance with the merchant's instructions as documented in our Data Processing Agreement (DPA). Storefront customer data includes end-customer names, email addresses, phone numbers, delivery addresses, order histories, and any other personal data submitted through a merchant's storefront.

• cMerchant Responsibilities as Data Controller: Merchants, as data controllers for their storefront customer data, are responsible for: publishing and maintaining a clear privacy notice directed at their end-customers that identifies the merchant as the data controller and discloses Vayva's role as data processor; obtaining all necessary consents from their end-customers for the collection and processing of personal data in compliance with the NDPA 2023; responding to data subject access requests, deletion requests, and other rights exercisable by their end-customers within the timelines mandated by the NDPR 2019; ensuring that the personal data they collect through their storefronts is accurate, complete, and processed lawfully; and complying with all obligations imposed on data controllers under the NDPA 2023 and any subsidiary legislation.

• dVayva's Obligations as Data Processor: In its role as data processor for storefront customer data, Vayva shall: process such data only on the documented instructions of the merchant (as conveyed through the Platform's functionality); implement and maintain appropriate technical and organizational security measures; assist merchants in responding to data subject requests; notify merchants of data breaches in accordance with the DPA; and delete or return personal data upon termination of services as set out in the DPA. The full terms governing Vayva's processing of storefront customer data are set out in our Data Processing Agreement.

We collect the following categories of personal data: Identity Data including full name, date of birth, government-issued ID numbers (NIN, BVN, international passport), and photograph; Contact Data including email address, phone number, and business address; Financial Data including bank account details, transaction history, and payment card information (processed securely via Paystack); Business Data including CAC registration number, tax identification number, business type, and trade references; Technical Data including IP address, browser type and version, device identifiers, operating system, and screen resolution; Usage Data including pages visited, features used, session duration, click patterns, and search queries; and Marketing Data including communication preferences, survey responses, and engagement history.

We process your personal data under the following legal bases as defined by the NDPA 2023: Contract Performance — processing necessary to fulfill our service agreement with you, including account management, payment processing, and order fulfillment; Legal Obligation — processing required to comply with Nigerian laws including CBN regulations, tax obligations, KYC/AML requirements, and law enforcement requests; Legitimate Interests — processing for purposes such as platform security, fraud prevention, service improvement, and business analytics, provided your rights are not overridden; and Consent — where you have provided explicit consent for specific processing activities such as marketing communications, which you may withdraw at any time.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected: Transaction records are retained for a minimum of seven (7) years in accordance with CBN financial record-keeping requirements and the Companies and Allied Matters Act (CAMA). Account and identity data is retained for the duration of your account plus three (3) years after closure. Marketing and communication data is retained until you withdraw consent. Technical and security logs are retained for two (2) years for security monitoring and incident investigation. Upon expiry of the retention period, data is securely deleted or anonymized.

As a data subject, you have the following rights: Right of Access — obtain a copy of your personal data we hold; Right to Rectification — correct inaccurate or incomplete data; Right to Erasure — request deletion of your data where no overriding legal basis for retention exists; Right to Restrict Processing — limit how we use your data; Right to Data Portability — receive your data in a structured, machine-readable format; Right to Object — object to processing based on legitimate interests; and Right to Withdraw Consent — at any time, without affecting the lawfulness of prior processing. We respond to all data subject requests within 30 days as required by the NDPR 2019.

We do not sell your personal data. We share data only with: payment processors (Paystack) for transaction execution; delivery partners for order fulfillment; cloud infrastructure providers (AWS, Cloudflare) under strict data processing agreements; regulatory authorities when legally required; and professional advisors (legal, accounting) under confidentiality obligations. You acknowledge and agree that: (a) all third-party service providers are independently responsible for their own data protection practices; (b) Vayva shall not be liable for data breaches caused by third-party providers outside our reasonable control; (c) you are responsible for ensuring that any data you provide to merchants through their storefronts is shared with their explicit consent; and (d) Vayva may disclose your data to law enforcement or regulatory authorities when required by law, court order, or government regulation without prior notice to you.

Where personal data is transferred outside Nigeria, we ensure adequate protection through NDPC-approved safeguards including Standard Contractual Clauses, adequacy decisions, or binding corporate rules.

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you are under 18, you may not use the Platform. If we become aware that we have collected personal data from a child under 18, we will delete such information immediately. Merchants are solely responsible for ensuring that their storefronts comply with age restriction requirements and do not collect data from minors. Vayva shall not be liable for any merchant's failure to comply with age verification requirements.

In the event of a confirmed data breach involving your personal data, Vayva shall: (a) notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, as required by the NDPA 2023; (b) notify affected data subjects without undue delay where the breach is likely to result in high risk to their rights and freedoms; (c) provide information about the nature of the breach, the categories and approximate number of data subjects affected, and the measures taken or proposed to address the breach; and (d) cooperate with regulatory authorities in their investigation. Vayva shall not be liable for delays in notification caused by: (i) the need to investigate the scope and impact of the breach; (ii) law enforcement requests to delay notification; or (iii) technical constraints beyond our reasonable control.

Vayva conducts Data Protection Impact Assessments for processing activities that are likely to result in high risk to data subjects, as required by the NDPA 2023. DPIAs are conducted for: AI-powered features that process personal data; large-scale processing of sensitive data; systematic monitoring of publicly accessible areas; and new technologies or processing methods that may impact data subject rights. DPIA reports are available for review by the NDPC and may be shared with data subjects upon request.

The Platform uses automated decision-making and profiling in connection with: fraud detection and prevention; transaction risk assessment; AI-powered analytics and recommendations; and creditworthiness assessments (where applicable). You have the right to: (a) be informed about the existence of automated decision-making; (b) obtain meaningful information about the logic involved; (c) understand the significance and envisaged consequences of such processing; and (d) obtain human intervention, express your point of view, and contest the decision. To exercise these rights, contact our DPO at privacy@vayva.ng.

Where processing is based on consent, you may withdraw consent at any time by: updating your account settings; contacting our DPO at privacy@vayva.ng; or using the unsubscribe link in marketing communications. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. If you withdraw consent, we may not be able to provide certain products or services to you. We will notify you if this is the case.

Where personal data is transferred outside Nigeria, we ensure adequate protection through: (a) NDPC-approved Standard Contractual Clauses; (b) adequacy decisions recognizing the recipient country's data protection standards; (c) binding corporate rules for intra-group transfers; or (d) explicit consent after informing you of the risks. You acknowledge that data transfers to countries without adequate data protection laws may involve risks. Vayva shall not be liable for unauthorized access to data caused by security breaches at third-party providers outside our control.

You are responsible for: (a) providing accurate and complete personal data; (b) keeping your account credentials secure; (c) notifying Vayva immediately of any unauthorized access or data breach; (d) ensuring that any data you provide to merchants is shared with appropriate consent; (e) complying with applicable data protection laws when using the Platform; and (f) maintaining the confidentiality of any personal data you access through the Platform. Vayva shall not be liable for any loss or damage arising from your failure to comply with these responsibilities.

We may update this Privacy Policy periodically to reflect changes in technology, legislation, or our data processing practices. Material changes will be communicated via email and/or a prominent notice on the Platform at least 30 days before taking effect. Your continued use of the Platform after the effective date of changes constitutes acceptance of the updated policy. If you do not agree with the changes, you must stop using the Platform and request deletion of your data.

To the maximum extent permitted by the NDPA 2023 and applicable law, Vayva shall not be liable for: (a) data breaches caused by third-party providers outside our reasonable control; (b) loss of data resulting from your failure to maintain appropriate backups; (c) unauthorized access caused by your failure to secure your account credentials; (d) data processing by merchants in their capacity as data controllers; or (e) any indirect, incidental, or consequential damages arising from data processing activities. Vayva's total liability for data protection violations shall not exceed the greater of: (i) the actual damages proven; or (ii) the maximum amount permitted by the NDPA 2023.

Data Protection Officer: privacy@vayva.ng | Privacy inquiries: privacy@vayva.ng | Phone: +234 913 700 0140 | Address: Vayva Technologies Ltd, 19 Princess Bola Kazem, Shangisha, Lagos, Nigeria. We aim to respond to all privacy inquiries within 5 business days.