Privacy Policy
This Privacy Policy explains how SHUP8 Technologies collects, uses, shares and protects personal data when you use SHUP8. We handle personal data in line with the Nigeria Data Protection Act 2023 (“NDPA”) and applicable regulations.
1. Our two roles
- Controller for your account. For data about you as a SHUP8 user (merchants, staff, visitors to our sites), we decide why and how it is used.
- Processor for your shop’s customers. When a merchant collects data from their own customers (names, phone numbers, addresses, orders), the merchant is the controller and SHUP8 processes it on their instructions under our Data Processing Terms. If you bought from a SHUP8 shop, read that shop’s own privacy notice and contact the merchant first about your data.
2. Data we collect
- Account data: name, email, phone number, password (stored hashed), business name, address, shop name and domain.
- Verification and payment data: information needed by our Payment Provider for KYC and payouts. Card details are handled by the provider; we do not store full card numbers.
- Shop data: products, images, orders, customer records and messages you place on the platform.
- Usage and device data: IP address, browser and device type, pages visited, log and security events, cookies.
- Support data: messages you send us and our replies.
3. Why we use it, and our lawful bases
- Provide, secure and support the Service (performance of a contract).
- Billing, fees and fraud prevention (contract, legal obligation, legitimate interest).
- Comply with law, respond to lawful requests and enforce our Terms (legal obligation, legitimate interest).
- Improve the product and measure performance (legitimate interest).
- Send service notices, and send marketing only where you have consented or the law allows; you can opt out at any time (consent).
4. Who we share data with
We do not sell personal data. We share it only with: payment providers (such as Paystack); hosting, storage, email and SMS providers that process data for us; professional advisers; and authorities where required by law or to protect rights and safety. Each provider is bound by contract to protect the data. If SHUP8 is sold or merged, data may transfer to the new owner under this policy.
5. International transfers
Some providers store or process data outside Nigeria. Where we transfer personal data abroad we use safeguards the NDPA allows, such as adequacy, contractual clauses or your consent.
6. How long we keep it
We keep account data while your account is active and for up to [12] months after closure, unless the law requires longer (for example tax and accounting records). Shop data is available for export for [30] days after closure and is then deleted or anonymised. Backups are overwritten on a rolling cycle.
7. Security
We use encryption in transit, access controls, hashed passwords, backups and monitoring. No system is perfectly secure. If a breach likely puts people at risk, we will notify the Nigeria Data Protection Commission and affected people within the time the law requires, and notify merchants without undue delay.
8. Your rights
Subject to the law, you may ask to access your data, correct it, delete it, restrict or object to its use, receive a portable copy, and withdraw consent at any time. You may also object to automated decisions that significantly affect you. Contact us at [email protected]; we will respond within the period the law requires. You also have the right to complain to the Nigeria Data Protection Commission.
9. Cookies
We use essential cookies to keep you signed in and secure, and, where you agree, analytics cookies to understand usage. You can control cookies in your browser; disabling essential cookies may break the Service.
10. Children
SHUP8 is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
11. Changes
We will post updates here and notify you of material changes by email or in your admin panel before they apply.
12. Contact
SHUP8 Technologies (RC 8792739), Ikeja, Lagos, Nigeria. Privacy and data protection enquiries: [email protected]. Data protection contact: [name / role].