Privacy Policy | 7feastr

7feastr Technologies Ltd (“7feastr”, “we”, “us”, or “our”) is the data controller responsible for personal data processed through the 7feastr marketplace and through 7feastr Logistics. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, and the rights available to you under the Nigeria Data Protection Act, 2023 (the “NDPA”).

This Policy applies to customers, vendors, agents, and merchants who hold an account with us. It also explains, in Section 4, how we handle personal data that a merchant submits about a shipment recipient who does not hold an account with us.

1. Information We Collect

Account information. Name, email address, phone number, and password when you register.

Order and shipment information. Pickup and delivery addresses, order or shipment history, package weight and description, payment method, and any notes you provide.

Business verification information. For vendors and merchants, business name, business registration documents, a valid means of identification for the business owner or an authorised representative, proof of address, and bank account details used for settlement.

Location data. With your permission, we collect device location to show nearby vendors, to enable live order and shipment tracking, and to route delivery agents.

Device and usage information. IP address, browser type, operating system, device identifiers, and general usage data, collected for security, fraud prevention, and analytics.

API and integration data. For merchants, requests made to the 7feastr Logistics API, including timestamps, API key identifiers, and request metadata, are logged for security, billing, and support purposes.

Communications. Messages you send to our support team, and correspondence relating to a dispute.

2. Legal Basis for Processing

We process personal data on one or more of the following legal bases recognised under the NDPA: performance of a contract with you, such as fulfilling an order or a shipment; compliance with a legal obligation, such as tax and financial record keeping; our legitimate interests, such as preventing fraud and keeping the Platform secure, balanced against your rights; and your consent, such as sending promotional communications, which you may withdraw at any time.

3. How We Use Your Information

To process and fulfil orders and shipments
To provide real-time order and shipment tracking
To verify the identity of vendors and merchants before granting production access to 7feastr Logistics
To communicate with you about your account, orders, and shipments
To calculate pricing, process payments, and manage wallet balances
To detect and prevent fraud, abuse, and unauthorised access
To comply with tax, anti-money laundering, and other legal obligations
To improve the Platform and our customer experience
To send you promotional communications, where you have consented to receive them

4. Shipment Recipient Data

When a merchant creates a shipment, the merchant supplies the name, phone number, and delivery address of the recipient. In respect of that data, 7feastr acts as a data processor on the merchant's instructions, and the merchant is responsible, as data controller, for ensuring it has a lawful basis to share the recipient's information with us for the purpose of delivery. We use recipient data solely to complete the delivery, to provide public tracking by tracking code, and to resolve a dispute relating to that shipment, and we retain it only for as long as necessary for those purposes and any applicable legal retention requirement.

5. Sharing of Information

We do not sell personal data. We share personal data only where necessary, and only with the following categories of recipient:

Vendors: a customer's name, delivery address, and order details, to fulfil an order.
Delivery and logistics agents: the name, phone number, and delivery address needed to complete a delivery.
Merchants: shipment status and tracking information relating to shipments they have created.
Payment service providers: transaction data necessary to process a payment or a wallet top-up.
Mapping and address verification providers: address text necessary to geocode a location and calculate a route.
Service providers: cloud hosting, email and messaging delivery, and customer support tooling, engaged under contractual confidentiality and data protection obligations.
Regulators and law enforcement: where required by applicable Nigerian law, a court order, or a lawful request from the Nigeria Data Protection Commission or another competent authority.
A successor entity: in connection with a merger, acquisition, or sale of assets, subject to that entity being bound by terms materially equivalent to this Policy.

6. International Transfers

Some of our service providers, including cloud hosting infrastructure, may process data outside Nigeria. Where personal data is transferred outside Nigeria, we take steps required under the NDPA to ensure the data remains protected, including entering into data processing agreements that impose safeguards equivalent to those required under Nigerian law.

7. Data Retention

We retain account data for as long as your account remains active and for a reasonable period afterward to address any dispute or legal claim. Order and shipment records, including the financial records associated with them, are retained for at least six years to satisfy tax and other statutory record keeping obligations. Business verification documents are retained for as long as a vendor or merchant account remains active, and for a reasonable period afterward as required by applicable anti-money laundering guidance. You may request deletion of your personal data at any time, subject to these retention obligations.

8. Security

We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the data we hold, including encryption of data in transit, hashed password storage, access controls limiting staff access on a need-to-know basis, and API key authentication for programmatic access. We do not store full payment card details. Card and bank transfer payments are handled directly by our payment service providers, which are subject to the Payment Card Industry Data Security Standard.

9. Your Rights

Subject to the exceptions and conditions set out in the NDPA, you have the right to:

be informed of how your personal data is processed
access the personal data we hold about you
request correction of inaccurate or incomplete data
request erasure of your personal data
request restriction of, or object to, certain processing, including processing for direct marketing
request a portable copy of data you have provided to us, where technically feasible
withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal
lodge a complaint with the Nigeria Data Protection Commission if you believe your rights have been infringed

To exercise any of these rights, contact us at support@7feastr.com. We will respond within the time limits set out in the NDPA. We may ask you to verify your identity before acting on a request.

10. Cookies and Similar Technologies

We use essential cookies to keep you signed in and to maintain the security of your session, and functional cookies to remember your preferences, such as your chosen theme. We do not use third-party advertising cookies. You can control cookies through your browser settings, though disabling essential cookies may prevent parts of the Platform from working correctly.

11. Children's Privacy

The Platform is not directed at, and we do not knowingly collect personal data from, individuals under the age of 18. If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete it.

12. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or in applicable law. We will notify you of a material change by email or in-app notice before it takes effect. Continued use of the Platform after a change takes effect constitutes acceptance of the updated Policy.

13. Contact Us

For privacy related questions or to exercise your rights, contact support@7feastr.com, or write to 7feastr Technologies Ltd, Lagos, Nigeria. You may also lodge a complaint directly with the Nigeria Data Protection Commission.