This policy explains what personal information Koilemi collects, why we collect it, who we share it with and the choices you have. We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and the guidance of the Nigeria Data Protection Commission (NDPC).
1. Who is responsible for your data
Koilemi, Block 13A Covel Plaza, Opposite Beechwood Estate, Imalate, Ibeju Lekki, is the data controller for personal data collected through this website. For privacy questions or requests, email support@koilemi.com with “Privacy” in the subject line.
2. What we collect
From buyers
- Name, email address, phone number and password (stored encrypted).
- Delivery addresses, site contact names and phone numbers, and delivery instructions.
- Orders, payments, delivery records, delivery confirmations, issue reports and photos you upload, reviews and support messages.
- For corporate accounts: company name, registration details, billing contacts and the details you provide to apply for corporate buying.
From suppliers
- Business name, owner and contact details, business address and store profile.
- Verification documents, such as CAC registration, tax identification and identity documents.
- Bank account details for payouts. These are passed to Paystack to set up settlement.
- Driver names and phone numbers, proof-of-delivery photos and delivery updates.
Collected automatically
- IP address, browser type, device information, pages visited and the time of each visit, kept in server logs for security.
- Cookies and similar technologies, described in our Cookie Policy.
3. How we use it, and our legal basis
- To provide Koilemi (performance of a contract): creating your account, taking payment, holding funds under escrow, passing delivery details to the supplier, tracking deliveries, refunds and support.
- To keep Koilemi safe (legitimate interests and legal obligation): verifying suppliers, preventing fraud, investigating disputes and keeping security logs.
- To meet the law (legal obligation): keeping financial and tax records and responding to lawful requests from authorities.
- To keep you informed (legitimate interests): order, delivery, payout and account emails, and WhatsApp messages from our team about your orders or store.
- Marketing (consent): newsletters and offers, only if you sign up. Every newsletter has an unsubscribe link.
4. Payments
Card, bank transfer and USSD payments are processed by Paystack. Your card details go directly to Paystack and are never stored by Koilemi. We receive confirmation of the payment, the amount, a reference and limited card information, such as the last four digits, to match payments to orders.
5. Who we share it with
- Suppliers receive what they need to fulfil your order: your name, delivery address, site contact and phone number, and the items ordered. Suppliers may only use this information to deliver your order.
- Buyers see a supplier’s business name, store profile and delivery driver details for their order.
- Service providers who work for us: Paystack (payments), our hosting provider, our email delivery provider and WhatsApp for messages our team sends. They may only use the data to provide their service to Koilemi.
- Authorities, when the law requires it, or to protect the rights, property or safety of Koilemi, our users or the public.
- If Koilemi is reorganised or sold, data may pass to the new owner, who must continue to protect it.
We do not sell your personal data.
6. Transfers outside Nigeria
Some of our service providers store or process data outside Nigeria. When this happens, we rely on the safeguards allowed under the NDPA, such as adequacy decisions, contractual protections or your consent, so that your data stays protected to a standard equivalent to Nigerian law.
7. How long we keep it
- Account data: while your account is open, and for up to two years after it is closed, unless you ask us to delete it sooner and we have no legal reason to keep it.
- Order, payment, payout and tax records: at least six years, as required for accounting and tax purposes.
- Supplier verification documents: while the store is active, and for six years after it closes.
- Security logs: up to 12 months.
- Newsletter: until you unsubscribe.
8. How we protect it
We use encrypted connections (HTTPS), encrypted passwords, access controls so staff only see what they need, and regular backups. If a personal data breach puts your rights at risk, we will notify the NDPC within 72 hours and tell you without undue delay.
9. Your rights
Under the NDPA you have the right to:
- be told how your data is used (this policy);
- get a copy of your personal data;
- have inaccurate data corrected;
- have your data deleted, where we have no legal reason to keep it;
- restrict or object to some uses of your data, including direct marketing;
- receive your data in a commonly used format, or have it sent to another provider;
- withdraw consent at any time, where we rely on consent;
- complain to the Nigeria Data Protection Commission.
To make a request, email support@koilemi.com. We may need to confirm your identity first. We will respond within 30 days.
10. Children
Koilemi is for adults buying and selling building materials. We do not knowingly collect data from anyone under 18.
11. Changes to this policy
We will update this page when our practices change and show the date of the latest update at the top. If a change is significant, we will tell registered users by email.
