Privacy Policy

This Privacy Policy explains how sellcondhand.ng collects, uses, shares, and protects your personal information when you use our website and app — including the auction and Marketplace, Escrow by Sellcondhand.ng, and Repairs by Sellcondhand (together, the "Platform"). We are based in Surulere, Lagos, Nigeria, and we process personal information in line with the Nigeria Data Protection Act, 2023 ("NDPA") and the guidance of the Nigeria Data Protection Commission (NDPC). By using the Platform, you agree to the collection and use of information as described here.

1. Information We Collect

We collect:

• Account information you provide when you register — full name, email address, phone number, and address;
• Verification information — email OTP confirmation at signup; phone number OTP confirmation before you can request a wallet withdrawal or book a repair; and, for sellers, identity verification (KYC) documents needed to confirm who they are before they can list a device. If you apply to become a repair Engineer, we also collect a government ID document and a profile photo to verify your identity before approving you to accept jobs;
• Listing, bidding, order, and repair information — the devices you list or bid on, your bid history, orders, standalone Escrow deals, repair bookings and job history, deliveries, and any disputes you raise;
• Location and address information — the delivery address you provide for an order, and, for a repair booking, the address and area where you'd like an Engineer to visit. If you use address autocomplete when entering an address, what you type is sent to Google to suggest matching addresses (see Section 6);
• Payment activity — wallet balance and transaction records, confirmation of payments made through our payment gateway partners (see Section 5), and, if you withdraw funds, the bank account details (account number, bank, and account name) you add and we verify before paying out;
• Technical information collected automatically, such as your IP address, device and browser type, and general usage activity on the Platform, used to keep the Platform secure and working properly.

2. How We Use Your Information

We use your information to verify your identity (via email/phone OTP and, for sellers and Engineers, identity documents), operate bidding, orders, Escrow deals, repair bookings, dispatch, and payouts, prevent fraud and abuse of the Platform (including checking for self-bidding or attempts to list unlawfully obtained devices), communicate important account or order updates (such as outbid notices, auction results, order status changes, and repair job updates), and improve the Platform. For a repair booking, we use your address and phone verification to match you with a nearby approved Engineer and confirm the booking is genuinely yours. For a withdrawal, we use your phone verification and bank account details to confirm we're paying the right person to the right account. If you sign in with Google, we use the name and email address Google provides to create or match your account. If we ever need to investigate a report that a listed device is stolen or unlawfully obtained, we may use account and transaction information for that purpose, including sharing it with law enforcement as described in Section 4.

3. Legal Basis for Processing

Under the NDPA, we process your personal information because it is necessary to perform our contract with you (operating your account, listings, bids, orders, Escrow deals, and repair bookings), to comply with a legal obligation (for example, responding to a lawful request from the Nigeria Police Force or another authority), for our legitimate interests in keeping the Platform safe and fraud-free, or because you have given us consent (for example, for optional marketing communications, which you can opt out of at any time).

4. How We Share Your Information

We do not sell your personal information. We only share it:

• With payment gateway partners (Paystack / Flutterwave) to process a payment or wallet withdrawal you initiate, including verifying a bank account you add for withdrawals;
• With the other party to a transaction, to the extent needed to complete it — for example, a Seller receives the delivery address needed to ship an order, and an assigned Engineer receives the address and contact details needed to visit you for a repair; bidder identities are otherwise kept anonymous to other users;
• With Termii, our SMS provider, to deliver phone verification and confirmation codes;
• With Resend, our email provider, to deliver account, order, and verification emails;
• With Cloudinary, our image storage provider, to store photos and documents you upload (listing photos, KYC documents, and Engineer application photos/documents);
• With Google, if you use address autocomplete when entering an address, or if you sign in with Google;
• With law enforcement authorities, such as the Nigeria Police Force or the Economic and Financial Crimes Commission (EFCC), where we receive a credible report that a listed or sold device is stolen or unlawfully obtained, or where we are otherwise legally required to do so;
• With other service providers who help us operate the Platform (such as hosting), under obligations to protect your information; and
• Where required to comply with a court order, regulation, or other legal process in Nigeria.

5. Payment Data

Card and bank transfer details are handled directly by our payment gateway partners, Paystack and Flutterwave, both of which are licensed payment processors in Nigeria. sellcondhand.ng never sees or stores your full card number or banking credentials — we only receive confirmation that a payment succeeded and the amount involved. When you add a bank account to withdraw funds, the account number and bank you provide are verified through Paystack's account-lookup service, which returns the registered account name so we can confirm it before saving it as your payout destination.

6. Cookies and Similar Technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Platform is used. When you use address autocomplete (for example, when booking a repair), what you type is sent to Google's Places service to suggest matching addresses, subject to Google's own privacy policy. You can control cookies through your browser settings, though disabling them may affect parts of the Platform, such as staying signed in.

7. Data Retention

We keep your personal information for as long as your account is active and for a reasonable period afterward to meet legal, accounting, fraud-prevention, and dispute-resolution needs — for example, order and payment records connected to a device later reported stolen may be retained longer to support an investigation. Engineer identity verification documents are retained for as long as the Engineer's account is active and for a reasonable period afterward, for the same reasons. When information is no longer needed for these purposes, we delete or anonymize it.

8. Data Security

We use reasonable technical and organizational measures to protect your personal information. However, no method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security. Please keep your password confidential and notify us immediately if you suspect unauthorized access to your account.

9. Your Rights

Under the Nigeria Data Protection Act, you have the right to:

• Know what personal information we hold about you and how it is used;
• Correct inaccurate or outdated information — most of this you can update yourself from your Profile page (name, phone number, and address);
• Request deletion of your personal information, subject to our legal, fraud-prevention, and dispute-resolution obligations described in Section 7;
• Withdraw consent for optional processing, such as marketing communications, at any time; and
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights under the NDPA have been breached.

To exercise any of these rights, contact us using the details in Section 13.

10. Children's Privacy

The Platform is not directed at, and we do not knowingly collect personal information from, anyone under 18 years of age. If we learn that we have collected information from a minor, we will take reasonable steps to delete it and deactivate the associated account.

11. International Data Transfers

Some of our service providers (such as hosting, payment infrastructure, SMS, email delivery, image storage, and address-lookup partners) may process data outside Nigeria. Where this happens, we take reasonable steps to ensure your information continues to receive an adequate level of protection, consistent with the requirements of the NDPA.

12. Changes to This Policy

We may update this Privacy Policy from time to time, including to reflect changes in our features or in applicable Nigerian data protection law. We will update the "Last updated" date above when we do, and encourage you to review this page periodically.

13. Contact Us

Questions, requests, or complaints about this Privacy Policy or how we handle your personal information can be sent to hello@sellcondhand.ng, or via our Contact page.