Effective Date: 17 June 2026 | Last Updated: 15 September 2026
Data Controller: BringitHome Premier Solutions Limited, RC 8477018
DPO Contact: privacy@bringithome.ng
1. INTRODUCTION
BringItHome operates as a Data Controller under the Nigeria Data Protection Act 2023 (NDPA) . This Policy explains how we collect, use, share, and protect your personal data, and your rights as a data subject.
2. DATA WE COLLECT
| Data Type | Who | Why | Legal Basis |
|---|---|---|---|
| Email address | Buyers, Shoppers, Managers | Authentication, communications | Performance of Contract |
| Full name | All | Account identity | Performance of Contract |
| Phone / WhatsApp number | All | OTP, delivery coordination | Performance of Contract |
| Delivery address | Buyers | Order fulfillment | Performance of Contract |
| BVN (encrypted) | Shoppers, Managers | CBN KYC compliance, payment service provider setup | Legal Obligation |
| Bank account number | Shoppers, Managers | Payout processing | Performance of Contract |
| Order history | Buyers | Service provision, dispute resolution | Performance of Contract |
| Ratings and reviews | All | Platform quality | Legitimate Interest |
| Device/session data | All | Security, fraud prevention | Legitimate Interest |
| Beneficiary name, phone, delivery address (SendIt only) | Beneficiaries | Gift delivery coordination and fulfillment | Legitimate Interest / Performance of Contract |
Beneficiaries are a distinct category of data subject under this Policy: individuals a Buyer designates to receive a SendIt gift delivery. A Beneficiary is not a BringItHome account holder. Their name, phone number, and delivery address are collected from the Buyer who saves them, not directly from the Beneficiary. The legal basis for this processing is the Buyer's legitimate interest in coordinating a gift delivery and BringItHome's performance of the resulting delivery contract. At the point of saving a Beneficiary, the Buyer must confirm they have that person's permission to share these details with BringItHome. A Beneficiary's data is retained for as long as the Buyer's account that saved it remains active, or until the Buyer deletes the Beneficiary record, and is otherwise subject to the same retention periods as order/transaction records (see Section 6). BringItHome does not contact a Beneficiary directly except where necessary for delivery coordination (e.g. an optional "gift is on its way" email, if the Buyer provides the Beneficiary's email address).
3. HOW WE USE YOUR DATA
We use your data to:
- Provide and improve the BringItHome service
- Process payments via our payment service provider(s) and release funds to Sellers
- Verify Shopper identity for CBN compliance
- Resolve disputes and investigate reports
- Send transactional notifications (order updates, OTPs)
- Send market day alerts, where you have consented (see below)
- Comply with Nigerian legal obligations
We do not use your data for unsolicited marketing without your explicit consent.
Marketing communications (market day alerts)
Where you have agreed, we send promotional messages called "market day alerts" by email, push notification, and in the in-app notification feed. They tell you when it is market day at a market you can shop from, or at a market you have joined the waitlist for, and about sending gifts through SendIt to people in and around that market. These messages are different from transactional notifications (order updates, OTPs, payment and delivery messages), which we send to run the service.
- Legal basis: your consent. You can give it by ticking the market day alerts box when you join a waitlist, or by turning market day alerts on in your profile settings. Joining a waitlist does not, on its own, subscribe you to market day alerts.
- Existing customers: if you have already paid for an order, we may start sending you market day alerts as an existing customer of a related service. We will tell you in the app first, give you time to opt out before the first alert, and you can opt out at any time.
- Withdrawing consent: turn off market day alerts under Notifications in your profile, or use the unsubscribe link in any promotional email. It takes effect immediately and does not affect transactional messages. If you mark one of our promotional emails as spam, we treat that as withdrawal of your consent.
- Records: we keep a record of when and how you gave or withdrew consent (including the date, the wording version, and your device's IP address and user agent) so that we can demonstrate compliance.
- Service providers: our email delivery provider and push notification services process your contact details only to deliver these messages for us.
4. PUBLIC PROFILE DISPLAY
For Sellers (Freelance Shoppers and Managers), your username, avatar, rating, and aggregate performance metrics are displayed publicly on the platform to Buyers as part of the core marketplace service.
5. DATA SHARING
- Shoppers, Market Managers, and Dispatch Riders: Delivery addresses and contact numbers are shared with our employees (Market Managers) and independent contractors (Shoppers and Dispatch Riders) strictly for the purpose of order fulfillment. For SendIt gift deliveries, this includes the Beneficiary's name, phone number, and delivery address, shared strictly for the purpose of delivering that specific gift.
- Payment Service Provider(s): Licensed third-party payment processor(s), for payment processing and KYC verification. The identity of our current payment service provider is available on request.
- Cloudflare Inc.: For CDN, WAF, and DDoS protection.
- Regulatory Authorities: NFIU, EFCC, police, or courts where legally required. Unauthorized use of data by Data Processors (Shoppers) will result in immediate NDPC reporting.
- No data sales: We do not sell your personal data to any third party.
6. DATA RETENTION
- Account data: Duration of account + 1 year after deletion
- Order/transaction records: 5 years
- Financial/ledger records: 7 years
- BVN (encrypted): 7 years after account closure, per CBN data retention requirements
- Support/dispute records: 3 years
- Waitlist entries: an entry that has not led to a notification is deleted after 12 months. Once we have notified you, your contact details (email, phone number, and any link to your account) are removed from the entry after 90 days; we keep only the city and market it was for, so we know where demand is.
- Market day alert sign-ups (without an account): deleted when your last waitlist entry for that email address is removed. A record that you unsubscribed is kept, so that we keep honouring it.
- Market day alert delivery records: 90 days.
7. YOUR RIGHTS UNDER NDPA 2023
You have the right to Access, Rectification, Erasure, Portability, Objection, and Withdrawal of Consent.
To exercise these rights, please contact our dedicated channels:
- Data requests & deletions: privacy@bringithome.ng
- Legal notices:legal@bringithome.ng
- General help: support@bringithome.ng
We will respond within 30 days .
8. DATA SECURITY
All data is transmitted securely via TLS 1.3. Sensitive fields (BVN) are field-encrypted at rest using AES-256. We maintain immutable audit logs for data access.
9. COOKIES AND SESSION STORAGE
We use browser session storage to maintain your shopping list state during checkout and remember your delivery preferences. We do not use tracking or advertising cookies.
9.1 Push Notifications
If you grant push notification permission, we register a browser or device push token with our notification infrastructure. This token is used solely to deliver order status updates and security alerts. You can revoke push notification permission at any time through your browser or device settings. We do not share push tokens with advertisers.