1. Introduction

Welcome to MarketRada ("we", "us", or "our"). MarketRada is a marketplace intelligence and commerce platform that enables users to compare product prices, discover services, and transact with vendors across Nigeria.

This Privacy Policy explains how we collect, use, store, disclose, and protect your personal data when you use the MarketRada platform (website, mobile applications, and APIs). By using our platform you agree to the practices described herein.

2. Data Controller Information

The data controller for your personal data is MarketRada, a company registered in the Federal Republic of Nigeria. For data protection enquiries, contact us at privacy@marketrada.com .

3. What Personal Data We Collect

Data Field	Purpose	Lawful Basis
Name (first & last)	Account personalisation	Contract
Email address	Account creation, notifications	Contract
Phone number	OTP verification, SMS alerts	Contract
BVN / NIN (encrypted)	KYC / vendor identity verification	Legal obligation
GPS location	Nearby price comparison, delivery estimates	Consent
Device fingerprint	Fraud prevention, session security	Legitimate interest
Payment data	Transaction processing via Paystack (Moniepoint not yet available for wallet top-ups)	Contract
Browsing behaviour	Product recommendations, analytics	Legitimate interest

4. Why We Collect Your Data (Purposes)

Account management and authentication
Know Your Customer (KYC) and identity verification
Order processing and fulfilment
Price alerts and product notifications
Fraud prevention and platform security
Analytics to improve platform experience
Marketing communications (opt-in only)

5. Lawful Basis for Processing

We process personal data under one or more of the following lawful bases as defined by the NDPA:

Consent — you have given clear, affirmative consent for a specific purpose (e.g. location access, marketing emails).
Contract — processing is necessary for the performance of a contract you have entered into (e.g. creating an account, placing an order).
Legal Obligation — processing is required to comply with Nigerian law (e.g. KYC requirements, tax records).
Legitimate Interest — processing is necessary for our legitimate business interests and does not override your rights (e.g. fraud prevention, analytics).

7. International Data Transfers

Your data is primarily stored on servers in AWS Africa (Cape Town) region (af-south-1). Where data is transferred outside Nigeria, we ensure compliance with the NDPA adequacy provisions and rely on Standard Contractual Clauses or other lawful transfer mechanisms.

8. Data Retention

Data Type	Retention Period
Active account data	Retained while account is active
Deleted account data	Anonymised within 30 days of deletion
Payment & transaction records	7 years (FIRS statutory requirement)
Server logs	7 days

9. Your Rights Under the NDPA

Under the Nigeria Data Protection Act, you have the right to:

Be informed about how your data is processed
Access the personal data we hold about you
Rectify inaccurate or incomplete data
Request erasure of your data ("right to be forgotten")
Restrict processing under certain circumstances
Data portability — receive your data in a structured, machine-readable format
Object to processing based on legitimate interests or direct marketing
Not be subject to automated decision-making or profiling with legal effects

10. Cookies and Tracking

We use essential cookies for authentication and session management. We do not use third-party advertising trackers on platform-served pages. You can manage your cookie preferences through your browser settings.

11. Children’s Privacy

MarketRada is intended for users aged 18 and above. We do not knowingly collect personal data from children under 18. If we become aware that a minor has provided personal data, we will take steps to delete it promptly.

12. Security Measures

Encryption at rest using AES-256
TLS encryption for all data in transit
Passwords hashed with bcrypt
Regular security audits and vulnerability assessments
Role-based access control with the principle of least privilege

13. Data Breach Notification

In the event of a personal data breach, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach. Affected users will be notified within 7 working days with details of the breach and recommended protective actions.

14. How to Exercise Your Rights

To exercise any of your data protection rights, contact us at privacy@marketrada.com. You may also delete your account directly from your account settings. We will respond to your request within 30 days. You may also delete your account directly from your account settings .

15. Updates to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email and an in-app notification. The "Last Updated" date at the top of this page will be revised accordingly.

16. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices:

Data Protection Officer: privacy@marketrada.com
Postal Address: MarketRada, Lagos, Nigeria
NDPC Complaints: ndpc.gov.ng

17. Contraband Check Data

When you create a product listing, service profile, or "Looking For" request, MarketRada automatically screens the submitted text against our contraband database — a curated list of prohibited item names and aliases maintained by our Trust & Safety team.

Screening is performed server-side; no data is sent to third parties during this check.
Results of each scan (pass / fail) are logged to our internal audit trail and retained for 90 days.
If a flagged item is borderline (restricted but not banned), your content may be held for human review — you will be notified within 24 hours.
You may appeal a contraband flag by emailing safety@marketrada.com with supporting documentation.

18. "Looking For" Broadcasts

A "Looking For" request is semi-public: it is shared with nearby vendors who match your item category and location radius. By submitting a request you consent to:

Your item name, description, price range, and desired location being shown to vendors within your selected radius.
Your first name and avatar being visible to vendors who receive the broadcast.
The request remaining active (visible to vendors) for up to 30 days or until you mark it as fulfilled or delete it.
Expired requests being archived (not publicly visible) and permanently deleted after 90 days.

Vendors may not use your request data for any purpose other than responding to your item inquiry. Vendor misuse may be reported through our dispute system.

19. KYC Extended Verification

Vendors and professional service providers must complete Know-Your-Customer (KYC) verification. Extended KYC applies to high-value sellers and professional service categories (medical, legal, financial).

Standard KYC: BVN and/or NIN — verified via Dojah. Your BVN and NIN are transmitted directly to the verification provider over TLS and are never stored in plain text by MarketRada.
Extended KYC: Professional certificate or government-issued licence. Documents are uploaded securely, reviewed by our team within 48 hours, and stored in encrypted object storage with access restricted to compliance staff.
KYC records are retained for the lifetime of your account plus 5 years as required by FCCPC and CBN guidelines.
You may request deletion of KYC documents after account closure subject to statutory retention obligations.