1. Overview & Data Protection Commitment
Vendorl Technologies (“Vendorl”, “we”, “our”, or “us”) is dedicated to protecting the privacy of merchants who create stores with us (“Merchants”) and buyers who purchase items from their public storefronts (“Buyers”).
This Privacy Policy explains how we collect, process, store, and safeguard personal data in compliance with the Nigeria Data Protection Act 2023 (NDPA) and international data protection standards.
2. Information We Collect
We collect information in three categories depending on your role on the platform:
A. Merchant Account Information
When you register a store: full name, email address, password hash, business/store name, phone number, and physical store address. For bank settlement payouts: your 10-digit NUBAN bank account number, bank code, and resolved account name.
B. Buyer & Storefront Customer Information
When a customer places an order on a merchant’s online storefront: customer name, email address, phone number, delivery address, selected delivery option, and order item details.
C. Technical & Diagnostic Information
IP address, browser type, device identifiers, session cookies, and request logs used strictly for security monitoring, load balancing, and preventing DDoS attacks.
3. How We Use Your Data
We process personal data only on lawful grounds for the following specified purposes:
- To provide, operate, and maintain the Vendorl inventory and POS software.
- To host public online storefronts and render product catalogs to buyers.
- To send transactional emails (email confirmations, order approval links, payment receipts) via our verified email infrastructure partner.
- To configure payment subaccounts and direct settlement routing for customer sales.
- To detect, investigate, and prevent fraudulent transactions, unauthorized account access, or security violations.
4. Authorized Third-Party Service Providers (Subprocessors)
We do not sell, rent, or monetize your personal data. We disclose information only to vetted third-party service providers essential for platform operations:
| Provider | Role & Data Handled | Compliance Standard |
|---|---|---|
| Payment Processing Partners (e.g. Paystack, Monnify) | Card processing, NUBAN resolution, and direct split settlements. | CBN Licensed, PCI-DSS Level 1 |
| Supabase Inc. | Encrypted cloud database storage and authentication. | SOC2 Type II, PostgreSQL RLS |
| Zeptomail / Zoho | Transactional email dispatch (receipts, notifications). | ISO 27001, GDPR Compliant |
5. Data Security & Storage
We employ industry-standard technical and organizational security measures to protect data from unauthorized access, alteration, or disclosure:
- Encryption: All web traffic is encrypted in transit using Transport Layer Security (TLS 1.3/HTTPS). Sensitive database records are encrypted at rest.
- Row Level Security (RLS): Database tables strictly enforce tenant isolation, ensuring a merchant can never view or access another store’s private data, sales records, or staff accounts.
- No Raw Card Storage: Vendorl never receives, processes, or stores payment card numbers (PAN) or CVVs. All payment inputs occur directly within PCI-DSS Level 1 certified checkout environments.
6. Your Rights Under the NDPA 2023
Under the Nigeria Data Protection Act 2023, you have the following rights regarding your personal data:
- Right to Access: You can request an export of the personal information we hold about you.
- Right to Rectification: You can edit and update your store name, phone, address, and bank details anytime directly in Dashboard Settings.
- Right to Erasure (“Right to be Forgotten”): You can permanently delete your store and personal account from the Settings page. This purges your inventory, store data, and credentials from our active database.
- Right to Withdraw Consent: You may opt-out of marketing communications or deactivate your store at any time.
7. Data Retention
We retain personal data for as long as your account remains active. If you delete your account, your data is wiped within thirty (30) days, except where retention is strictly required by statutory tax obligations or financial reporting laws under Nigerian jurisprudence.
8. Contact our Data Protection Officer
To exercise your privacy rights, file a complaint, or inquire about our data practices, reach out to our compliance desk:
Data Protection Officer (DPO)
Email: [email protected]
Jurisdiction: Lagos, Nigeria
Regulatory Reference: NDPA 2023 Compliance Register