Effective date: [INSERT DATE]. Operated by [LEGAL ENTITY NAME], Nigeria ("Karabby", "we", "us").
1. Introduction
This Privacy Policy explains how Karabby collects, uses, shares, and protects personal data when you use the Platform at karabby.com. It is prepared with regard to the Nigeria Data Protection Act, 2023 (NDPA) and other applicable law.
Karabby is the data controller for data we collect to operate the Platform. Where a Seller collects personal data from Buyers to fulfil their own orders, the Seller is an independent controller responsible for its own compliance.
2. Data we collect
- Data you provide: account details (name, email, hashed password), seller details (storefront, bank account for payouts), order and billing data (name, email, phone, and — for physical products — delivery address), and content such as reviews and support messages.
- Data collected automatically: usage and analytics (pages and products viewed, clicks, device type, approximate country), and technical data (IP address, cookies).
- Data from third parties: payment confirmation and status from payment providers (we do not receive full card numbers), and authentication data if you use a third-party sign-in.
3. How we use data
- To create and manage accounts and storefronts.
- To process orders, payments, payouts, refunds, and chargebacks.
- To deliver digital products, issue tickets, and enable Sellers to fulfil physical orders.
- To provide analytics to Sellers and to operate, secure, and improve the Platform.
- To send transactional emails (receipts, delivery, payout updates) and, where permitted, marketing you can opt out of.
- To prevent fraud, enforce our Terms, and comply with legal obligations.
4. Legal bases
We process data on the bases of performance of a contract, your consent (e.g. optional marketing), our legitimate interests (security, improvement, fraud prevention), and compliance with legal obligations.
5. Sharing of data
- With Sellers: order and (for physical goods) delivery information they need to fulfil and support your order; the Seller then acts as an independent controller.
- With payment providers (Paystack, Flutterwave, Stripe, PayPal) to process payments and payouts.
- With service providers (hosting, email, analytics) under confidentiality obligations.
- Where required by law or to protect rights, safety, and property; and in a business transfer.
We do not sell your personal data.
6. Cookies
We use cookies and similar technologies to keep you signed in, remember preferences (such as currency and theme), secure the Platform, and understand usage. You can control cookies in your browser; disabling some may affect functionality.
7. Retention and security
We retain personal data for as long as needed to provide the Platform and for legitimate business, accounting, tax, and legal purposes, then delete or anonymise it. We apply reasonable technical and organisational measures (encryption in transit, hashed passwords, access controls), but no method is completely secure.
8. Your rights
Subject to law, you may request access to, correction of, deletion of, or a copy of your data; object to or restrict certain processing; and withdraw consent. Contact [email protected]. You may also complain to the Nigeria Data Protection Commission.
9. Children, transfers, and changes
The Platform is not directed to children under 18 and we do not knowingly collect their data. Some providers may process data outside your country with appropriate safeguards. We may update this Policy; the effective date shows the latest version. Contact: [email protected].