Privacy Policy

OJAWA TECHNOLOGIES LIMITED (RC 9526897) is the Data Controller for personal data processed through Ojawa. We are a private company limited by shares, incorporated in Nigeria, with our registered office at Units 55, Banuso Shopping Complex, Ereja, Ilesa, Osun State, Nigeria.

We are registered with the Nigeria Data Protection Commission as a Data Controller and Processor of Major Importance under Section 44 of the Nigeria Data Protection Act 2023. Our registration number is NDPC/DCP/13941.

2.1 Data you give us

Creating an account

• If you sign up by phone: your phone number, verified by a one-time code sent over WhatsApp or SMS
• If you sign up by email: your email address and a password, which we store only in encrypted form
• If you sign up with Google: your name, email address and profile picture, as released to us by Google
• Your display name, profile photo, and the general area you are in

Applying to become a seller

• Information about what you intend to sell and how you trade
• Any identity information you choose to provide voluntarily to speed up review

Using the marketplace

• Listings: titles, descriptions, prices, condition, photographs, and the area an item is in
• Messages and offers exchanged with other users through the app
• Bids placed in auctions
• Deal records: agreed and confirmed prices, and confirmation timestamps
• Reviews you write and reviews written about you
• Reports you submit and correspondence with our support team

2.2 Data collected automatically

• Device and technical data: device type, operating system, browser, IP address, app version
• Usage data: listings viewed and saved, searches performed, pages visited, and how you move through the app
• Approximate location, where you permit it, so we can show listings near you
• Cookies and similar technologies — see Section 9

2.3 Data from third parties

• Where you sign in with Google, the profile information Google releases to us
• Payment confirmation data from our payment processor when you buy a boost or advertising — never your card details

2.4 What we do not collect

We do not collect sensitive personal data — information revealing health, genetic or biometric data, racial or ethnic origin, religious or political beliefs, trade union membership, or sexual orientation. Please do not include such information in listings, messages, or your profile.

We do not collect or store payment card details. Those go directly to our payment processor.

We do not currently collect National Identification Numbers (NIN) or Bank Verification Numbers (BVN). If we introduce identity verification in future, we will update this policy and our regulatory registration before collecting any such information.

When a buyer and seller agree a price, we generate two one-time codes and show each party their own code in the app. If you have turned on WhatsApp notifications, we may also tell you on WhatsApp when there is an update on your deal, but the code itself stays in the app.

• Codes are stored only as cryptographic hashes. We cannot read your code, and it is never sent to the other party.
• We record when each code was entered and whether verification succeeded, so both parties have a record of the handover.
• We record failed attempts, to detect fraud and to enforce the lockout described in our Community Guidelines.

The Deal Code confirms that two people met and completed a handover. It is not a payment mechanism, and it does not tell us anything about the item or whether either party was satisfied.

We do not sell your personal data.

5.1 Other users

• Public: your display name, profile photo, general area, seller rating, review history, and your listings
• Private: your phone number and email address are never shown to other users. Messages stay inside the app.
• When a deal is confirmed, the other party can see that confirmation and leave a review

5.2 Service providers

These providers process data on our instructions, under written terms:

5.3 Legal and protective disclosures

• Where required by law, court order, or a lawful request from a regulator or law enforcement agency
• Where necessary to investigate suspected fraud or to protect the safety of any person
• In connection with a merger, acquisition or sale of assets, subject to this policy continuing to apply

Our database and hosting infrastructure are located in Ireland, in the European Union. Your personal data is therefore transferred outside Nigeria for storage and processing.

Ireland is subject to the European Union data protection framework, which provides protections comparable to those required under the Nigeria Data Protection Act. We rely on that level of protection, together with contractual safeguards agreed with our providers.

Some providers may process limited data in other countries. Where that happens, we require appropriate safeguards by contract.

We keep your data while your account is active and for as long as we need it to run the service. After that, everything we hold falls into one of two buckets.

Bucket 1 — Operational data: 12 months

• Inactive basic profiles (no sign-in or marketplace activity for 12 months)
• Expired item listings
• Unaccepted offers
• Abandoned carts — checkouts started but never paid, and deals that expired or were cancelled before confirmation
• Search logs
• Non-transactional marketing metrics, such as advertising impression and click counts

These are kept for 12 months from the date they became inactive, expired or were last updated, and are then permanently deleted or anonymised. An inactive profile is anonymised rather than deleted outright where it is linked to a record in Bucket 2, so that record stays intact.

Bucket 2 — Legal & financial archive: 6 years

• Invoices
• Payout logs
• Payment gateway receipts
• Dispute arbitration records
• Deal confirmation records — the evidence of a completed handover used to resolve disputes
• Customer identification (KYC) logs

These records are moved into a restricted, read-only archive. Only our finance and legal teams can access it, and every access is logged. Records in the archive cannot be edited, and are permanently deleted 6 years after they were created, as required for accounting, tax and limitation purposes.

Reviews are part of a seller’s public history and are kept while the reviewed account exists. We may keep specific data longer where the law requires it, or where it is needed for an open investigation or legal claim.

We maintain technical and organisational measures appropriate to the risk, consistent with our NDPC registration.

8.1 Technical measures

• Encryption of data in transit, with HTTPS enforced across the platform
• Network security and firewalls on managed infrastructure
• Access control and authentication, with database-level rules restricting each user’s data to that user
• Deal Codes stored only as cryptographic hashes, never in readable form
• Audit logging of administrative actions and deal events
• Regular backups and tested recovery procedures
• Data minimisation — we collect only what the service requires

8.2 Organisational measures

• A designated Data Protection Officer
• Documented data protection and retention policies
• Incident response and breach notification procedures
• Publication of your rights, in this policy
• An active complaints and reporting mechanism
• Cookie consent
• Assessment of vendors, with written data processing terms
• Role-based administrative access on a least-privilege basis

8.3 If something goes wrong

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and will inform affected users without undue delay where the risk is high.

8.4 An honest note

No online service can be entirely secure. While we take the measures described above, we cannot guarantee absolute security. Please protect your account credentials and your Deal Codes, and tell us promptly if you suspect your account has been accessed by someone else.

• Essential cookies keep you signed in and keep the platform secure. These cannot be switched off.
• Functional cookies remember preferences such as your area and search filters.
• Analytics cookies help us understand how the platform is used so we can improve it.

Where required, we ask for your consent before setting non-essential cookies, and you can change your choice at any time.

Under the Nigeria Data Protection Act 2023 you have the right to:

• Be informed about how your data is used — this policy serves that purpose
• Access the personal data we hold about you, and receive a copy
• Have inaccurate or incomplete data corrected
• Have your data erased, where there is no overriding legal or legitimate reason to keep it
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests, and to direct marketing at any time
• Receive your data in a structured, commonly used, machine-readable format
• Withdraw consent at any time, where processing is based on consent
• Complain to the Nigeria Data Protection Commission

To exercise any right, contact info@ojawa.app. We will respond within 30 days. We may need to verify your identity first. Exercising your rights is free, though we may charge a reasonable fee for requests that are manifestly unfounded or excessive.

Some data is kept even after an account is deleted — for example transaction records required for tax purposes, and records needed to prevent fraud or to protect other users. See Section 7.

Ojawa is not intended for anyone under 18, and you must be at least 18 to use it. We do not knowingly collect personal data from children. If we learn that we have, we will delete it promptly. If you believe a child has provided us with personal data, contact info@ojawa.app.

We may update this policy from time to time. We will publish the updated version with a revised date and, where changes are material, notify you through the platform before they take effect.

If you are unhappy with how we handle your personal data, contact our Data Protection Officer at info@ojawa.app. You also have the right to complain directly to the Nigeria Data Protection Commission at ndpc.gov.ng.

OJAWA TECHNOLOGIES LIMITED (RC 9526897)
Units 55, Banuso Shopping Complex, Ereja, Ilesa, Osun State, Nigeria
info@ojawa.app

See also our Terms of Service and Community Guidelines.