Privacy policy

LEGAL & POLICY

Overview

Cartehub Africa ("we", "us", "our") operates the online marketplace at cartehubafrica.com. This Privacy Policy applies to all users of our platform — buyers, vendors, and visitors — and covers data collected through our website, mobile experience, and any related services.

We comply with the Nigeria Data Protection Regulation (NDPR) 2019, the Nigeria Data Protection Act 2023, the EU General Data Protection Regulation (GDPR) where applicable to users in the European Economic Area, and the UK GDPR for users in the United Kingdom.

By accessing or using Cartehub Africa, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of our services.

Data Controller

The data controller responsible for your personal information is:

Entity nameCartehub Africa Websitecartehubafrica.com Country of incorporationFederal Republic of Nigeria Privacy enquiries[email protected] General support[email protected]

For any data protection matters, you may also contact our Data Protection Officer (DPO) at [email protected].

Data We Collect

We collect personal data in three ways: information you provide directly, information generated by your use of the platform, and information from third parties.

Information you provide:

  • Account registration: name, email address, password (hashed), phone number, country of residence
  • Profile information: profile photo, delivery addresses, communication preferences
  • Order information: billing address, shipping address, order history, product reviews and ratings
  • Payment information: payment method type, last four digits of card; full card data is processed by our payment processor and never stored on our servers
  • Vendor information (sellers only): business name, business address, bank account details for payouts, business registration documents, national ID or BVN for verification
  • Communications: messages sent to vendors or our support team, dispute records, survey responses
  • Identity verification: government-issued ID documents, where required for high-value transactions or vendor onboarding

Information generated automatically:

  • IP address, browser type and version, operating system, device identifiers
  • Pages visited, time and duration of visits, links clicked, search queries on our platform
  • Referral source (which website or link brought you to us)
  • Cookie and session data (see Section 7)
  • Log data and error reports

Information from third parties:

  • Payment processors (transaction status, fraud signals)
  • Logistics and delivery partners (delivery confirmation, address validation)
  • Social login providers (if you sign in with Google or similar — name and email only)
  • Identity verification services (for vendor KYC compliance)

Sensitive dataWe do not intentionally collect sensitive personal data (racial or ethnic origin, religious beliefs, health data, sexual orientation). Please do not submit such information through our platform. Identity documents collected for vendor KYC are handled with additional safeguards and deleted once verification is complete

How We Use Your Data

We use your personal data for the following purposes:

Order fulfilmentProcessing payments, coordinating delivery, communicating order status, handling returns and disputes Account managementCreating and maintaining your account, authenticating logins, resetting passwords Customer supportResponding to enquiries, resolving disputes between buyers and vendors, investigating complaints Platform improvementAnalysing usage patterns to improve search, product recommendations, and the overall shopping experience Safety & fraud preventionDetecting and preventing fraudulent transactions, counterfeit goods, and prohibited listings; complying with legal obligations Marketing (with consent)Sending newsletters, promotional offers, and product recommendations — only where you have opted in Legal complianceMeeting obligations under Nigerian law, FIRS tax requirements, anti-money laundering regulations, and responding to lawful requests from government authorities Vendor payoutsProcessing earnings disbursements to vendor bank accounts and providing transaction records

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

Legal Basis for Processing

Under the NDPR 2019, Nigeria Data Protection Act 2023, and GDPR (where applicable), we process your personal data on one or more of the following legal bases:

  • Contract performance: Processing necessary to fulfil your orders, manage your account, and provide our marketplace services.
  • Legitimate interests: Fraud prevention, platform security, improving our services, and communicating relevant service updates — where these interests do not override your rights.
  • Consent: Marketing communications and non-essential cookies — where you have given clear, informed consent that you can withdraw at any time.
  • Legal obligation: Retaining transaction records for tax purposes, responding to court orders, and complying with anti-money laundering regulations.
  • Vital interests: In rare circumstances where processing is necessary to protect someone's life.

Sharing Your Data

We share your personal data only where necessary and under appropriate data protection agreements. The parties we share data with include:

Vendors (sellers): When you place an order, the relevant vendor receives your shipping name, delivery address, and contact number to fulfil the shipment. Vendors are bound by our Vendor Agreement, which includes data protection obligations, and may not use buyer data for any purpose other than order fulfilment.

Payment processors: We use regulated, PCI-DSS-compliant payment processors to handle card transactions and mobile payments. They receive payment data directly and return only a transaction reference to us. Current processors may include Paystack, Flutterwave, and bank transfer services.

Logistics & courier partners: Your name, address, and phone number are shared with the delivery carrier handling your shipment, solely for delivery purposes.

Technology service providers: Our hosting, email delivery, analytics, and customer support tools are operated by third-party providers who process data on our behalf under data processing agreements.

Legal and regulatory bodies: We may disclose personal data to law enforcement, regulators, or courts when required by Nigerian law, a valid court order, or to defend legal claims.

Business transfers: If Cartehub Africa is acquired, merged, or transfers assets, your data may be transferred as part of that transaction. We will notify you before your data is subject to a materially different privacy policy.

No data salesWe do not sell, rent, or trade your personal data to any third party for commercial or marketing purposes, and we never will.

Cookies & Tracking Technologies

We use cookies and similar technologies to operate the platform and improve your experience. A cookie is a small text file placed on your device. We use the following categories:

Strictly necessaryEssential for the platform to function — session management, cart contents, login state, security tokens. Cannot be disabled. FunctionalRemember your preferences — language, currency, recently viewed products, search history. Disabled if you opt out. AnalyticsAggregate, anonymised data about how visitors use the site — which pages are popular, where users drop off. Requires consent. MarketingUsed to deliver relevant adverts and measure campaign effectiveness. Only placed with your explicit consent.

You can manage your cookie preferences at any time via the cookie settings link in the website footer. Most browsers also allow you to control cookies through their settings. Note that disabling essential cookies will impair the function of the platform.

We may also use local storage for non-personal preference data (e.g. recently viewed products, search term history) to improve your browsing experience without requiring a login.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes set out in this policy, comply with legal obligations, resolve disputes, and enforce agreements.

Active account dataRetained for the lifetime of your account Order records7 years from the date of transaction (Nigerian tax law requirement) Payment records7 years (financial regulations) Customer support messages3 years from resolution of the enquiry Dispute records5 years from resolution, or as required by law Vendor KYC documents5 years from vendor account closure (AML regulation requirement) Marketing dataUntil you withdraw consent or unsubscribe Website analytics26 months in aggregated, anonymised form

When your account is closed, we anonymise or delete personal data that is no longer required, retaining only what is legally necessary in a manner that cannot be linked back to you.

Your Rights

Under the NDPR, Nigeria Data Protection Act 2023, and GDPR (where applicable), you have the following rights with respect to your personal data:

Right to Access Request a copy of the personal data we hold about you and how it is being used.

Right to Rectification Ask us to correct inaccurate or incomplete personal data. You can also update most information directly in your account settings.

Right to Erasure Request deletion of your personal data where it is no longer necessary, where you withdraw consent, or where processing is unlawful. Subject to legal retention obligations.

Right to Restriction Ask us to pause processing of your data — for example, while you contest its accuracy or object to our use of it.

Right to Portability Receive a copy of your data in a structured, machine-readable format (JSON or CSV) to transfer to another service.

Right to Object Object to processing based on legitimate interests, including profiling, and to direct marketing at any time.

Right to Withdraw Consent Withdraw consent for marketing or non-essential cookies at any time — without affecting the lawfulness of prior processing.

Right to Lodge a Complaint File a complaint with the Nigeria Data Protection Commission (NDPC) or your local data protection authority (e.g. ICO in the UK).

How to exercise your rightsEmail [email protected] with your name, registered email address, and a description of your request. We will respond within30 daysin line with NDPR requirements. Complex requests may take up to 60 days — we will notify you of any extension within the initial 30-day period.

International Data Transfers

Cartehub Africa is based in Nigeria and primarily processes data within Nigeria. However, some of our third-party service providers (cloud infrastructure, analytics, email platforms) may process data in other countries, including the United States and EU member states.

Where data is transferred outside Nigeria or the EEA, we ensure appropriate safeguards are in place, which may include:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • Transfers to countries deemed adequate by the NDPC or European Commission
  • Binding Corporate Rules (BCRs) where the processor has them in place
  • Your explicit consent for specific transfers, where required

You may request details of the specific safeguards applicable to any transfer by contacting [email protected].

Children's Privacy

Cartehub Africa is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. Our Terms of Service require all users to confirm they are at least 18 years of age to register an account or make purchases.

If we become aware that we have collected personal data from a child under 18 without verified parental consent, we will delete that data promptly. If you believe we may have inadvertently collected information from a child, please contact [email protected] immediately.

Security Measures

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or alteration. Our measures include:

  • TLS/SSL encryption for all data in transit between your browser and our servers
  • Encryption of sensitive data at rest (passwords hashed using bcrypt; payment tokens stored encrypted)
  • Role-based access controls — staff access to personal data is limited to what is necessary for their role
  • Regular security assessments and penetration testing
  • Two-factor authentication available for all user accounts
  • PCI-DSS-compliant payment processing (card data never touches our servers)
  • Incident response procedures and breach notification protocols

Data breach notificationIn the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours and, where required, affected individuals without undue delay.

While we strive to use commercially acceptable means to protect your data, no method of internet transmission or electronic storage is 100% secure. You are also responsible for keeping your account password confidential and for any activities under your account.

NDPR & Nigerian Law Compliance

Cartehub Africa complies with the Nigeria Data Protection Regulation (NDPR) 2019 issued by NITDA and the Nigeria Data Protection Act (NDPA) 2023. Our specific compliance measures include:

  • Appointment of a Data Protection Officer (DPO)
  • Conducting Data Protection Impact Assessments (DPIAs) for high-risk processing activities
  • Maintaining a Record of Processing Activities (ROPA)
  • Ensuring all third-party processors have signed Data Processing Agreements (DPAs)
  • Annual audit and compliance reporting as required under the NDPR
  • Staff training on data protection obligations

You have the right to file a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data protection rights have been violated. Contact the NDPC at ndpc.gov.ng.

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. The effective date at the top of this page shows when it was last revised.

For material changes that significantly affect your rights or how we use your data, we will notify you by email (to your registered address) and/or by displaying a prominent notice on the website at least 30 days before the changes take effect.

Your continued use of Cartehub Africa after the effective date of any revised policy constitutes your acceptance of the changes. We encourage you to review this page periodically.

Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a concern, please get in touch:

Privacy enquiries - [email protected] 
Data Protection Officer - [email protected]
General support - [email protected]
Response time - Within 30 days of receipt of your request
Regulatory authority - Nigeria Data Protection Commission (NDPC) — ndpc.gov.ng