KASUMART.NG — PRIVACY POLICY

Effective Date: 11 October 2026
Last Updated: 11 October 2026

1. Introduction

Kasumart (“Kasumart,” “we,” “our,” or “us”) is a multi-vendor online marketplace that enables customers to discover and purchase products from independent sellers through our website, mobile applications, and related services.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when you visit Kasumart.ng, create an account, browse products, place an order, register as a seller, communicate with us, or otherwise use our services.

We are committed to handling personal data responsibly and in accordance with applicable Nigerian data protection laws, including the Nigeria Data Protection Act 2023 (NDPA), where applicable.

By using our services, you acknowledge that you have read this Privacy Policy. Where applicable law requires consent for a particular processing activity, we will seek that consent separately. Using our services does not automatically constitute consent to every type of data processing.

2. Who We Are

The organisation responsible for your personal data is:

Business/Platform Name: Kasumart
Legal Entity: Kasumart Ltd
Website: https://kasumart.ng
Business Address: Kano State, Nigeria
Privacy Contact: [email protected]
Customer Support: [email protected]

In this Policy, “Kasumart” refers to the legal entity operating the marketplace, once identified above.

Depending on the activity involved, Kasumart may act as a data controller, determining why and how personal data is processed, or engage authorised service providers to process data on our behalf.

Independent sellers, payment providers, and other third parties may have separate responsibilities for personal data they process under their own arrangements.

3. Scope of This Policy

This Policy applies to:

Customers who browse or purchase products.
Sellers and vendors who list or sell products.
Individuals who register for an account.
Visitors to our website and mobile applications.
People who contact our support team.
Individuals who participate in promotions, surveys, or marketplace activities.
Representatives of business customers and seller organisations, where applicable.

This Policy does not automatically govern third-party websites, applications, or services that have their own privacy notices.

4. Personal Data We Collect

The information we collect depends on how you interact with Kasumart.

4.1 Identity and Account Information

We may collect:

Full name.
Mobile phone number.
Email address.
Account identifier.
Account type, such as customer or seller.
Profile photograph, if provided.
Account preferences and settings.

4.2 Phone Number and OTP Authentication

If Kasumart uses passwordless authentication, we may process your phone number, one-time verification codes (OTPs), verification status, authentication timestamps, and related security records to register accounts, verify identities, and secure access.

OTP values should be handled securely and should not be retained in readable form longer than operationally necessary.

We may record unsuccessful login attempts, device information, and security events to detect suspicious activity and prevent account abuse.

4.3 Order and Transaction Information

When you place an order, we may collect:

Products purchased and quantities.
Order numbers and order history.
Product prices, discounts, delivery charges, and applicable fees.
Order status and transaction references.
Billing and delivery information.
Refund, return, cancellation, and complaint records.
Payment status and relevant payment-provider references.

Payment card details and other sensitive payment credentials should generally be handled by the relevant payment provider. We will not claim to store or process such details directly unless our actual payment architecture requires it.

4.4 Delivery Information

To fulfil orders, we may collect delivery recipient names, phone numbers, delivery addresses, delivery instructions, and delivery status information.

Where necessary, relevant delivery details may be shared with the seller, courier, or logistics provider responsible for fulfilling an order.

4.5 Seller and Business Information

If you register as a seller, we may collect:

Business or trading name.
Seller contact details.
Business address.
Product listings, descriptions, photographs, and prices.
Bank account or payout information.
Business registration information, where required.
Tax or identity verification information, where legally necessary.
Seller performance, order fulfilment, dispute, and compliance records.

We will request additional verification documents only where reasonably necessary for marketplace operations, fraud prevention, contractual requirements, or legal compliance.

4.6 Communications and Customer Support

We may process messages, emails, support requests, complaints, feedback, and other information you choose to provide when communicating with us.

We may retain relevant communications to resolve disputes, improve support, and maintain records of our interactions.

4.7 Device, Technical, and Usage Information

When you access our website or applications, we may collect technical information such as:

IP address.
Browser type and version.
Device type and operating system.
Application version.
Pages, screens, or features accessed.
Referring pages and interaction timestamps.
Diagnostic logs, crash reports, and performance information.
Cookie identifiers and similar technologies, where used.

We use this information for security, troubleshooting, performance monitoring, analytics, and service improvement, subject to applicable law and your privacy choices.

4.8 Location Information

We may process a delivery address or approximate location that you provide to support delivery, identify relevant services, or improve marketplace functionality.

We will only access precise device location where the feature requires it, the necessary permission has been obtained, and the processing is otherwise lawful.

4.9 Promotions and Marketing Preferences

We may collect your communication preferences, campaign interactions, promotion eligibility, and records of marketing consent or opt-out requests.

You may receive essential transactional communications even if you opt out of promotional messages.

4.10 Information From Other Sources

Where lawful and necessary, we may receive information from payment providers, delivery partners, seller verification services, fraud-prevention providers, or other authorised partners.

We will handle such information in accordance with applicable data protection requirements.

5. How We Use Personal Data

Kasumart may use personal data for the following purposes:

Account creation and management: To register users, verify phone numbers, maintain accounts, and provide account support.
Order processing: To manage shopping carts, confirm orders, coordinate fulfilment, and provide order updates.
Payments and refunds: To facilitate payments, reconcile transactions, process refunds, and administer seller payouts.
Delivery: To arrange delivery and communicate necessary fulfilment information.
Seller operations: To review seller registrations, manage listings, administer marketplace commissions, and support vendors.
Customer service: To respond to questions, complaints, returns, and disputes.
Security and fraud prevention: To detect suspicious activity, protect accounts, investigate abuse, and safeguard the marketplace.
Personalisation: To remember preferences and improve the relevance of products or services, where permitted.
Analytics and improvement: To understand marketplace usage, diagnose technical problems, and improve functionality.
Marketing: To send promotional messages where legally permitted and, where required, with your consent.
Legal compliance: To comply with applicable laws, lawful requests, tax obligations, regulatory requirements, and court orders.
Business administration: To maintain records, enforce our terms, manage risks, and protect our legal rights.
Dispute resolution: To investigate complaints and determine appropriate remedies.
Service development: To test and improve existing features and develop new services using appropriate safeguards.

We will not use personal data for purposes that are incompatible with the purposes explained to you unless we have a lawful basis to do so.

6. Lawful Bases for Processing

Under applicable data protection law, we will rely on an appropriate lawful basis for each relevant processing activity.

Depending on the circumstances, these bases may include:

6.1 Contractual Necessity

Processing may be necessary to create your account, fulfil an order, administer a seller relationship, or provide a service you have requested.

6.2 Legal Obligation

We may process information where necessary to comply with applicable laws, regulatory obligations, tax requirements, or lawful orders.

6.3 Legitimate Interests

We may process certain information for legitimate purposes, such as preventing fraud, protecting platform security, improving our services, and managing disputes, provided applicable legal requirements are satisfied and your rights are appropriately considered.

6.4 Consent

We will seek consent when required by law, including for applicable optional marketing or tracking activities where consent is the appropriate lawful basis.

Where processing relies on consent, you may withdraw it at any time. Withdrawal does not invalidate processing that occurred lawfully before withdrawal.

6.5 Vital Interests and Other Lawful Grounds

Where applicable, we may rely on another lawful basis recognised under Nigerian law.

The lawful basis depends on the specific processing activity. We will not treat consent as the automatic basis for all processing.

7. How We Share Personal Data

We do not sell personal data to third parties as a business practice. However, we may disclose information where necessary for the purposes described in this Policy.

7.1 Sellers and Vendors

When you purchase a product, relevant order information may be shared with the seller responsible for fulfilling that order.

This may include your name, delivery details, contact information, products purchased, and order status.

Sellers must use customer information only for legitimate order fulfilment, customer service, and other permitted purposes. They must not misuse customer data for unrelated marketing, unauthorised disclosure, or unlawful activities.

7.2 Payment Service Providers

We may share relevant transaction information with payment processors, banks, payment gateways, or other financial service providers to process payments, verify transactions, reconcile funds, and manage refunds.

These providers may process personal data under their own applicable terms and privacy notices.

7.3 Delivery and Logistics Partners

We may share delivery information with couriers and logistics providers to fulfil orders, coordinate delivery, and resolve delivery problems.

7.4 Technology and Hosting Providers

We may use authorised third-party providers for hosting, databases, cloud storage, messaging, OTP delivery, customer support, analytics, security, and technical maintenance.

Such providers should receive only the information reasonably required to perform their authorised services and should be subject to appropriate contractual and security safeguards.

7.5 Verification and Fraud Prevention Partners

Where necessary and lawful, we may share relevant information with identity verification providers, fraud prevention services, or other parties assisting with marketplace safety and compliance.

7.6 Professional Advisers

We may disclose relevant information to lawyers, auditors, accountants, insurers, and other professional advisers when reasonably necessary.

7.7 Legal and Regulatory Authorities

We may disclose personal data where required by applicable law, a valid legal process, or a lawful request from a competent authority.

Where legally permitted, we will seek to limit disclosure to the information reasonably required.

7.8 Corporate Transactions

If Kasumart is involved in a merger, acquisition, restructuring, financing, or sale of assets, relevant information may be transferred subject to applicable legal requirements and appropriate safeguards.

7.9 With Your Direction or Consent

We may share information in other circumstances where you have specifically requested or authorised the disclosure, or where another lawful basis permits it.

8. Seller Access to Customer Information

Kasumart is a multi-vendor marketplace. A seller may need access to certain customer information to fulfil an order.

Sellers must:

Use customer information only for authorised purposes.
Keep customer information confidential.
Apply appropriate security measures.
Avoid exporting or retaining customer information unnecessarily.
Never sell, rent, or disclose customer information for unauthorised purposes.
Report suspected data breaches affecting customer information promptly.
Comply with applicable privacy and data protection laws.

Kasumart may investigate suspected misuse, restrict seller access, suspend accounts, or take other appropriate action where a seller violates these requirements.

9. Cookies and Similar Technologies

Kasumart may use cookies, pixels, local storage, software development kits (SDKs), and similar technologies, depending on the services deployed.

These technologies may support:

Essential website and account functionality.
Session management and security.
User preferences.
Shopping cart functionality.
Performance measurement.
Analytics and service improvement.
Advertising or marketing measurement, where implemented and legally permitted.

Where required, we will obtain consent before using non-essential cookies or similar technologies.

You may manage cookie preferences through available website controls or your browser settings. Disabling certain cookies may affect some marketplace features.

For additional information, please refer to our Cookie Policy, if published separately.

10. Marketing Communications

Kasumart may send service-related messages concerning account verification, orders, payments, deliveries, security alerts, and customer support.

Where permitted, we may also send promotional communications about new products, offers, sellers, and marketplace features.

You can opt out of promotional emails using the unsubscribe mechanism provided or by contacting our support team. You may also use available SMS or messaging opt-out instructions.

Opting out of promotional communications will not necessarily stop essential service or security messages.

We will respect applicable consent and direct-marketing requirements.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal requirements.

Retention periods may depend on:

Whether your account remains active.
The nature of your orders or seller relationship.
Applicable financial, tax, or regulatory recordkeeping requirements.
Fraud investigations and unresolved disputes.
Security and audit requirements.
The need to establish, exercise, or defend legal claims.

When information is no longer required, we will take reasonable steps to delete, anonymise, or securely dispose of it.

Some information may remain in restricted backups for a limited period or be retained where the law requires it. Account deletion does not necessarily result in the immediate deletion of every transaction or compliance record.

Kasumart should establish and maintain internal retention periods appropriate to each category of information.

12. Data Security

We use reasonable technical, organisational, and administrative measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction.

Depending on the system and the data involved, safeguards may include:

Access controls and role-based permissions.
Encryption in transit and, where appropriate, at rest.
Secure authentication and OTP verification.
Monitoring and security logging.
Software updates and vulnerability management.
Backups and recovery procedures.
Staff confidentiality obligations and security training.
Security requirements for service providers.

No website, application, or data transmission can be guaranteed to be completely secure. However, we will take appropriate steps to protect personal data and respond to identified security risks.

Users should keep their devices secure, protect their verification codes, and notify us promptly if they suspect unauthorised account access.

13. Personal Data Breaches

If Kasumart becomes aware of a personal data breach, we will assess the incident and take appropriate steps to contain, investigate, and remediate it.

Where required by applicable law, we will notify the Nigeria Data Protection Commission and affected individuals within the applicable timeframes, taking into account the nature and risk of the breach.

We may also take steps to secure affected accounts, reset authentication credentials, restrict access, or provide relevant security guidance.

14. Your Data Protection Rights

Subject to applicable law and any lawful limitations, you may have the right to:

14.1 Right to Be Informed

To receive clear information about how your personal data is processed.

14.2 Right of Access

To request confirmation of whether we process your personal data and obtain access to relevant information.

14.3 Right to Rectification

To request correction of inaccurate or incomplete personal data.

14.4 Right to Erasure

To request deletion of personal data where the applicable legal conditions are satisfied.

14.5 Right to Restrict Processing

To request that certain processing activities be restricted where the law permits.

14.6 Right to Object

To object to certain processing activities, including processing based on legitimate interests where applicable. You may object to direct marketing as provided by law.

14.7 Right to Data Portability

Where applicable, to receive certain personal data in a structured, commonly used format or request its transmission to another controller.

14.8 Right to Withdraw Consent

Where processing is based on consent, to withdraw that consent without affecting the lawfulness of processing carried out before withdrawal.

14.9 Rights Concerning Automated Decisions

Where applicable, to exercise rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

14.10 Right to Complain

To lodge a complaint with the Nigeria Data Protection Commission if you believe your personal data has been handled unlawfully.

These rights are subject to the conditions and limitations provided by applicable law.

15. How to Exercise Your Rights

To make a privacy request, contact:

Privacy Email: [Insert privacy email address]
Subject: Personal Data Request — Kasumart

Please describe your request and provide enough information for us to identify the relevant account or records.

We may request reasonable information to verify your identity before responding. We will not request unnecessary sensitive information merely to process a routine request.

We will respond within the period required by applicable law. Where a request cannot be fulfilled, we will explain the reason where legally required.

We will not unlawfully discriminate against you for exercising your data protection rights.

16. Account Deletion

You may request the deletion of your Kasumart account through available account settings or by contacting our support team.

Before completing a deletion request, we may need to verify your identity and address outstanding matters, such as pending orders, refunds, disputes, or legal obligations.

Where legally permitted, we may retain certain information necessary for transaction records, fraud prevention, regulatory compliance, security, or the establishment and defence of legal claims.

Information retained for these purposes will remain subject to appropriate safeguards and will not be kept longer than necessary.

If your account supports seller functions, account closure may also require resolution of outstanding orders, seller payouts, or compliance matters.

17. Children's Privacy

Kasumart is intended for individuals who can lawfully use our services and enter into the relevant transactions.

We do not knowingly collect children's personal data in circumstances where such collection would be unlawful. Where processing involves a child, we will apply the protections and consent requirements required by applicable law.

If you believe a child has provided personal data to Kasumart unlawfully, please contact us so that we can assess the matter and take appropriate action.

18. International Data Transfers

Kasumart may use service providers whose systems or personnel are located outside Nigeria. This may result in personal data being processed or stored in another country.

Where personal data is transferred internationally, we will take the steps required by applicable Nigerian data protection law, including ensuring an appropriate lawful basis and implementing any required safeguards.

The safeguards used may depend on the destination, recipient, type of information, and applicable legal requirements.

19. Third-Party Websites and Services

Our website or applications may contain links to third-party websites, payment services, social media platforms, seller pages, or other external services.

We do not control the privacy practices of independent third parties. Their collection and use of personal data may be governed by their own privacy policies and terms.

We encourage you to review the relevant privacy notices before submitting personal data to those services.

20. Automated Processing and Fraud Prevention

Kasumart may use automated systems to help identify suspicious transactions, detect account abuse, prioritise security alerts, recommend products, or improve marketplace operations.

Where such processing involves personal data, we will apply appropriate safeguards and comply with applicable legal requirements.

Where required by law, we will provide information about relevant automated decisions and the rights available to affected individuals.

We will not represent that a fully automated decision is the sole basis for an important outcome unless that is actually how the relevant system operates.

21. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technology, business operations, or legal obligations.

When we make material changes, we will take reasonable steps to notify users, such as by publishing the revised Policy on Kasumart.ng or displaying an appropriate notice within our services.

The “Last Updated” date at the beginning of this Policy indicates when it was most recently revised.

Where required by law, we will obtain fresh consent or provide additional notice before implementing a change that requires it.

22. Complaints and Dispute Resolution

If you have a concern about how Kasumart handles your personal data, please contact us first using the privacy contact details provided in this Policy.

We will review your concern and take reasonable steps to address it.

You may also lodge a complaint with the Nigeria Data Protection Commission through its official website: https://ndpc.gov.ng/

Nothing in this Policy removes any right or remedy available to you under applicable law.

23. Contact Us

For privacy questions, requests, or complaints, contact:

Kasumart Privacy Team

Website: https://kasumart.ng
Privacy Email: [Insert privacy email address]
Customer Support Email: [Insert support email address]
Business Address: [Insert registered business address]
Legal Entity: [Insert registered company name]

Please use the privacy email for personal data access, correction, deletion, objection, or other data protection requests.

24. Governing Law

This Privacy Policy is intended to operate in accordance with the Nigeria Data Protection Act 2023 and other applicable laws of the Federal Republic of Nigeria.

Where a provision of this Policy conflicts with a mandatory legal requirement, the applicable legal requirement will prevail.

Important Notice: This Privacy Policy should be read together with Kasumart's Terms and Conditions, Cookie Policy, Return and Refund Policy, and Seller Agreement, where applicable.

Privacy policy