Sotibuy Privacy Policy

# Sotibuy Privacy Policy

*Last updated: September 2026*

Sotibuy ("Sotibuy", "we", "us", "our") respects your privacy. This Privacy Policy
explains what personal data we collect, why we collect it, how we use and share
it, the choices you have, and how to contact us. It applies to visitors, buyers,
sellers, riders, agents and other users of the Sotibuy website, mobile experience,
marketplace and related services (together, the "Platform").

By creating an account, using the Platform or otherwise providing us your personal
data, you agree to the practices described in this Privacy Policy. If you do not
agree, please do not use the Platform.

## 1. Who we are

Sotibuy operates an online marketplace that connects buyers with independent
sellers for the purchase and delivery of products, mainly in Nigeria. We process
personal data as a data controller (and, in limited cases, as a processor on
behalf of sellers) in accordance with the Nigeria Data Protection Act 2023 and the
Nigeria Data Protection Regulation (NDPR), and other applicable laws.

## 2. Personal data we collect

We collect personal data you give us directly, data we collect automatically when
you use the Platform, and data we receive from third parties.

### 2.1 Information you provide

- **Account and contact data:** your name, email address, phone number, password
  (stored as a secure hash), delivery and billing addresses, and profile
  preferences.
- **Seller data:** for sellers, business name, business registration details,
  proof of identity, bank and payout information, fulfilment location, licences
  and permits where required, and seller correspondence.
- **Transaction data:** order details, products purchased, delivery preferences,
  payment references and order history.
- **Communications:** messages you send through the Platform, support enquiries,
  dispute and report submissions, and records of your communications with us.
- **Proof of delivery:** where applicable, photographs or records confirming
  delivery of an order.

### 2.2 Information collected automatically

- **Device and usage data:** device type, operating system, browser, IP address,
  approximate location derived from your IP address, pages visited, referring
  URLs, timestamps and app usage.
- **Analytics and cookies:** we use cookies and similar technologies to
  understand how the Platform is used and to improve it. See our Cookie Policy.

### 2.3 Information from third parties

- **Payment providers:** to process payments, our payment partners may confirm
  whether a payment succeeded or failed and share limited transaction references
  with us. We do not see or store your full card or bank details.
- **Verification and identity partners:** where we verify sellers or buyers, we
  may receive confirmation from verification providers.
- **Auth and email providers:** our authentication and email providers
  (including our email service) process data necessary to create accounts, send
  confirmation and password-reset emails, and protect accounts.

## 3. How we use personal data

We use personal data for the following purposes:

- To **provide and operate the Platform**, including account creation, order
  placement, checkout, payment processing, delivery coordination, and seller
  management.
- To **authenticate and secure** accounts, protect against fraud and abuse, and
  investigate suspicious activity.
- To **communicate with you**, including order confirmations, delivery updates,
  account notifications, confirmation and password-reset emails, and responses
  to support enquiries.
- To **provide support**, handle returns, refunds, cancellations, disputes and
  complaints.
- To **improve the Platform**, including analytics, product development and
  troubleshooting.
- To **comply with legal obligations**, including tax, record-keeping and
  regulatory requirements, and to respond to lawful requests.
- To **enforce our agreements and policies** (such as the Buyer Terms and Seller
  Agreement) and protect our legal rights.

## 4. Lawful basis for processing

Where required by law, we process personal data on one or more of the following
bases:

- **Performance of a contract** — to provide the services you request (e.g.,
  processing an order).
- **Legitimate interests** — to operate and improve the Platform, prevent fraud,
  secure accounts and protect users, provided these interests are not
  overridden by your rights.
- **Consent** — for certain marketing and optional uses, which you may withdraw
  at any time.
- **Legal obligation** — where we must process data to comply with the law.

## 5. Sharing and disclosure

We do not sell your personal data. We share personal data only where necessary and
as described below:

- **With sellers:** to fulfil an order, we may share your name, delivery address,
  phone number and order details with the seller fulfilling that order so they
  can prepare and dispatch it.
- **With logistics and delivery partners:** to arrange and deliver orders.
- **With payment providers:** to process and complete payments.
- **With email, authentication and infrastructure providers:** including our
  email delivery provider (Resend) and our cloud/hosting providers, to send
  emails and operate the Platform. These providers process data on our behalf.
- **With professional advisers and authorities:** with our legal, accounting and
  professional advisers, and with courts, regulators, law enforcement or other
  authorities where required or permitted by law.
- **In connection with a business transfer:** if we are involved in a merger,
  sale, acquisition or reorganisation, your data may be transferred as part of
  that transaction, subject to appropriate safeguards.
- **With your consent:** where you have given your consent, or where you direct
  us to share data.

## 6. Cookies and similar technologies

We use cookies and similar technologies for security, functionality, analytics
and (with consent) advertising. For full details, please see our Cookie Policy.

## 7. Data security

We implement reasonable technical and organisational measures to protect personal
data, including encryption of data in transit, secure storage of passwords and
access controls. However, no method of transmission or storage is completely
secure. We cannot guarantee absolute security. If you suspect a breach involving
your data or account, contact us immediately.

## 8. Data retention

We retain personal data only as long as necessary for the purposes described in
this Policy, to meet legal, tax, accounting and regulatory obligations, and to
resolve disputes and enforce agreements. When data is no longer needed, we delete
or anonymise it.

## 9. Your rights

Depending on your location and applicable law, you may have the right to:

- **Access** the personal data we hold about you.
- **Correct** inaccurate or incomplete personal data.
- **Delete** your personal data, subject to legal and contractual limits.
- **Restrict or object** to certain processing.
- **Data portability** — receive your personal data in a structured, commonly
  used format.
- **Withdraw consent** where processing is based on consent.
- **Lodge a complaint** with the relevant data protection authority, such as the
  Nigeria Data Protection Commission (NDPC).

To exercise any of these rights, contact us using the details below. Where
required by law, we may verify your identity and ask for additional information
before responding. We aim to respond within the timeframes required by applicable
law.

## 10. Children's privacy

The Platform is intended for users who are at least 18 years old, or the age of
majority in their jurisdiction. We do not knowingly collect personal data from
children under the age of 18. If you believe a child has provided us personal
data, contact us and we will delete it where required.

## 11. International data transfers

We and our service providers, including our email provider and cloud
infrastructure providers, may process personal data in Nigeria and in other
countries where our providers operate. Where personal data is transferred
internationally, we rely on appropriate safeguards to protect it as required by
applicable law.

## 12. Third-party links

The Platform may contain links to third-party websites or services. This Privacy
Policy does not apply to those third parties. We are not responsible for the
privacy practices of third-party services, including payment providers. Please
review their privacy policies.

## 13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of
material changes by posting a clear notice on the Platform, sending an email, or
otherwise as required by law. The "Last updated" date at the top of this Policy
indicates when it was last revised. Your continued use of the Platform after
changes take effect constitutes acceptance of the updated Policy.

## 14. Contact us

If you have questions, concerns or requests about this Privacy Policy or your
personal data, please contact us at:

- **Email:** support@sotibuy.com
- **Privacy enquiries:** privacy@sotibuy.com

We will respond to your enquiry in accordance with applicable law.