ITCloser Technologies Ltd is responsible for personal information processed to operate and administer Oya Commerce, subject to the roles established by applicable law and the arrangements governing individual services.

Depending on the activity, we may act as a data controller when we determine why and how account, security and platform information is processed. We may act as a data processor when we handle customer information on behalf of a merchant according to that merchant's instructions.

Banks, payment providers and identity verification providers may act as independent controllers for activities they perform under their own legal and regulatory responsibilities. Merchants may also be controllers of information they collect from their customers.

For example, a merchant may determine what customer information is needed to fulfil an order or issue a receipt, while Oya Commerce provides the technology used to record and manage that information.

We may collect or process information relating to:

• Business owners, merchants, vendors and account holders.
• Buyers, customers and other transaction participants.
• Employees, cashiers, managers and authorised business users.
• Suppliers and business contacts.
• Visitors to our website and public storefronts.
• People who contact our support or compliance teams.
• Other individuals whose information appears in orders, receipts or records submitted to the platform.

Not every user must provide every category of information described in this policy. Collection depends on the account type, the service requested and applicable requirements.

When you register for or manage an account, we may collect:

• Username, display name, first name and last name.
• Email address and telephone number.
• Password or other authentication credentials, handled using appropriate security controls.
• Account identifiers, account type, role and permissions.
• Account creation date, verification status and profile preferences.
• Information used to confirm account ownership or eligibility.
• Account recovery requests and relevant support communications.

We use this information to create and manage your account, verify your identity where necessary, provide our services, communicate with you about your account and activities on Oya Commerce, and protect your account against unauthorised access.

Where a Transaction PIN is required to authorise supported financial transactions, it is used for transaction authentication and is subject to the additional safeguards described in the Transaction PINs and Authorization Security section of this policy.

For business owners and merchants, we may collect:

• Business name, trading name, store name and public username.
• Business email address, telephone number and physical store address.
• Residential or home address where required for verification, administration or a supported financial service.
• Business registration details, where applicable.
• Business category, description and public storefront links.
• Branch, terminal and authorised staff information.
• Store preferences, opening information and staff permissions.
• Business verification documents and verification status, where required.

We use this information to establish and administer business accounts, support verification, manage stores and inventory, facilitate transactions and display business information that the account holder chooses or is required to make public.

A business address is not necessarily a residential address. Where both are collected, they are handled according to their different purposes and appropriate access restrictions.

For identity verification, Know Your Customer (KYC) requirements, fraud prevention, account activation, banking, payment, settlement or other supported financial services, Oya Commerce may collect and process your Bank Verification Number (BVN). Where required for the relevant service, we may store your BVN securely or process it through authorised verification providers and financial service partners.

Depending on the service, related information may include your first name, last name, other identity details required by an authorised verification service, verification requests and results, bank account identifiers, and records of verification attempts.

Why we process BVNs

• Identity verification and account validation.
• Know Your Customer (KYC) checks and account activation.
• Eligibility checks for supported financial services.
• Fraud prevention and account security.
• Compliance with applicable financial, anti-money laundering (AML), regulatory and other legal requirements.
• Delivery of a financial service that requires identity verification.

Where a bank or authorised verification provider performs a check, relevant information may be transmitted to that provider as necessary for the requested service. The precise information shared depends on the integration and the service involved. Such providers may process the information in accordance with their applicable privacy policies, contractual obligations and legal requirements.

Consent to BVN collection and processing

Where consent is the applicable legal basis for collecting or processing your BVN, we will request your explicit, affirmative consent before collecting or submitting your BVN through the relevant Oya Commerce interface. We will explain the relevant purpose of the processing and provide the information necessary for you to make an informed decision. Where processing is authorised or required on another lawful basis, we will rely on that basis as permitted by applicable law.

You should not submit your BVN unless you understand why it is required and how it will be used. Where a supported service cannot be provided without BVN verification, declining to provide your BVN may prevent you from accessing that particular service.

How we protect BVN information

• Public visibility: BVNs are not displayed on public storefronts, public product pages or ordinary customer receipts.
• Hashing and security: Where BVNs are stored as bcrypt hashes, we use one-way password hashing to protect the stored hash values. We apply appropriate technical and organisational safeguards to protect personal information against unauthorised access, disclosure, alteration, loss or destruction.
• Restricted access: Access to BVN-related information is limited to authorised systems and personnel with a legitimate business need, subject to applicable access controls.
• Data minimisation: We aim to collect, process and retain only the BVN-related information necessary for the relevant service, security purpose or legal obligation.
• Reduced storage: Where a verification result, reference or token can satisfy the relevant requirement without retaining the full BVN, we may use that approach where appropriate.
• Secure processing: BVN-related information shared with authorised banks or verification providers is disclosed only as necessary for the relevant service and subject to applicable safeguards.
• Retention controls: BVN-related information is retained only for as long as necessary for the relevant purpose, subject to applicable legal, regulatory and other recognised retention requirements.

We use appropriate technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, loss or misuse. Where BVNs are stored using our application's encryption service, they are encrypted using AES-256-GCM. Access to protected information is restricted to authorised purposes, and we take steps to safeguard the information we process and retain. No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

BVN retention and deletion

When you request deletion of your Oya Commerce account, BVNs and associated identity verification information held by us will be included in the deletion process. We will delete or anonymise such information within the applicable deletion timeframe, subject to legal, financial, regulatory, security and other recognised retention exceptions.

Where applicable, we aim to complete the deletion of personal data associated with a verified account deletion request within 30 days. However, BVN-related records or encrypted compliance logs may need to be retained for a longer period where required by applicable financial, tax, anti-money laundering (AML), regulatory or other legal obligations, or where necessary for a legitimate dispute or security investigation.

Where retention is legally required, the affected information will be restricted to the purposes for which retention is necessary and protected against unauthorised access or use. We will delete or anonymise the retained information when the applicable retention requirement or exception ends, subject to applicable law. Information held by third-party verification providers is also subject to their applicable retention obligations and our arrangements with those providers.

Protecting your banking credentials

We do not ask users to share bank passwords, banking PINs or one-time passwords (OTPs) through ordinary Oya Commerce forms or support messages. Where additional authentication is required, use the appropriate bank-controlled or authorised authentication process. Never disclose your banking credentials or OTPs to anyone claiming to provide support on behalf of Oya Commerce.

When you buy goods, place an order or interact with a merchant, we may collect:

• First name, last name and customer identifier, where applicable.
• Telephone number and email address.
• Delivery address and fulfilment instructions.
• Billing information where applicable.
• BVN or other identity information when required for a supported financial service.
• Order and transaction references.
• Products purchased, quantities, prices and applicable charges.
• Order status, fulfilment status and payment status.
• Receipts, invoices, refund and dispute information.
• Relevant communications with the merchant.

The information requested depends on the transaction, merchant requirements and service being used. We use customer information to process orders, record sales, generate receipts, support fulfilment, maintain transaction histories and resolve disputes.

Merchants may access the customer and order information made available to them for legitimate business operations, including fulfilling orders, providing customer support and maintaining required records.

To support business recordkeeping and transaction management, we may collect, receive or generate:

• Transaction, order and invoice reference numbers.
• Items sold, quantities, prices, discounts, taxes, fees and other charges.
• Payment method and payment status.
• Transaction timestamps and relevant payment-provider references.
• Refunds, cancellations, reversals and disputed transactions.
• Settlement and reconciliation records.
• Business balance or wallet information, where supported.
• Financial summaries, reports, receipts and transaction evidence.
• Records of cash, bank transfer or other supported payment methods.

We use these records to maintain sales histories, reconcile payments, generate receipts, support accounting and reporting, identify irregularities and resolve disputes.

Transaction information may vary depending on whether a sale occurs online, in a physical store or through another supported channel. Creating an order does not necessarily mean that payment has been completed. Payment status should reflect available transaction evidence or confirmation from the relevant provider.

Transaction PINs and Authorization Security

Oya Commerce may require users to create and use a Transaction PIN to authorise supported financial operations, such as wallet payouts and store settlements. The specific transactions requiring a PIN depend on the services and features available to the user.

Transaction PINs are authentication credentials used to verify a user's authorisation of a transaction. They are distinct from transaction records, payment references and other financial information that may be retained for accounting, reconciliation, security and compliance purposes.

• Cryptographic protection: Transaction PINs are protected using appropriate security controls. Where PINs are stored as cryptographic hashes, the hashing process is designed to prevent the original PIN from being directly recovered from the stored hash.
• Protection against exposure: We take appropriate measures to prevent unauthorised disclosure of Transaction PINs and to protect them during entry, transmission, processing and storage.
• Restricted access: Access to authentication systems and related information is restricted according to applicable security controls and legitimate operational requirements.
• Transaction authorisation: Transaction PINs are used to authenticate or authorise supported transactions and are not intended to form part of ordinary transaction receipts, sales histories or public storefront information.
• Third-party disclosure: We do not disclose readable Transaction PINs to merchants or external parties. Where an authorised service provider supports transaction authentication, relevant authentication data may be processed as necessary for the service, subject to appropriate safeguards.

Users are responsible for keeping their Transaction PINs confidential and should not share them with other people, including anyone claiming to provide Oya Commerce support. If you suspect that your PIN has been compromised or used without your authorisation, contact us promptly so that appropriate security measures can be taken.

Merchants may submit or generate information about products and services, including:

• Product names, descriptions, images and specifications.
• Prices, available quantities, categories, brands and attributes.
• Product identifiers, stock-keeping units and variants.
• Sizes, colours, discounts and promotional details.
• Stock movements, adjustments, restocking and sales history.
• Supplier or procurement details where recorded.

We use this information to maintain catalogues, update inventory, support storefronts, manage orders and provide business reports.

Users should not upload BVNs, passwords, identity documents or private customer information as product content.

When you use Oya Commerce, we may collect technical information such as:

• IP address, browser type and operating system.
• Device, application and session identifiers where implemented.
• Login timestamps, session activity and authentication attempts.
• Pages, screens and features accessed.
• Error logs, crash reports, diagnostic data and performance information.
• Application version, connection information and security events.
• Cookie or similar technology information where used.

We use technical information to maintain service availability, diagnose faults, protect accounts, investigate suspicious activity and improve performance. The exact information collected depends on the technologies deployed.

When you contact us or use our support channels, we may collect your contact details, message contents, support tickets, case references, feedback, complaints and information you provide to explain a problem.

We may also review relevant account, transaction or technical information to investigate and resolve your enquiry. We use support records to respond to users, resolve problems, maintain appropriate records and improve our services.

Please do not send passwords, full BVNs, PINs, one-time passwords or other unnecessary sensitive authentication information through ordinary support messages.

Where permitted by law, we may receive information from banks, financial institutions, payment processors, identity verification services, fraud prevention services, merchants, authorised account representatives, public business registries and other lawful sources.

We may use this information to verify details, complete requested services, reconcile transactions, protect accounts and comply with legal obligations. A third party that independently determines how it processes your information may also have its own privacy policy and legal responsibilities.

• Account management: registering users, authenticating access, managing permissions and recovering accounts.
• Business operations: maintaining catalogues, recording stock movements, managing branches and preparing reports.
• Orders and receipts: recording purchases, generating receipts and invoices, and documenting transaction status.
• Financial services: supporting verification, payment processing, settlement and reconciliation where available.
• Security and fraud prevention: detecting suspicious activity, investigating unauthorised access and protecting users.
• Compliance: meeting applicable legal, regulatory and recordkeeping obligations.
• Customer service: resolving enquiries, complaints, returns, refunds and disputes.
• Service improvement: diagnosing errors, understanding usage and improving platform reliability.
• Communications: sending verification messages, security alerts, transaction notifications and service announcements.
• Legal protection: enforcing our terms and establishing, exercising or defending legal claims.

Oya Commerce allows merchants to operate public digital storefronts through which prospective buyers can discover stores and products.

Information that may be public

• Store name, public username and business description.
• Business contact information deliberately provided for public display.
• Product names, descriptions, images and prices.
• Promotional details and product availability.
• Other information deliberately published by the merchant.

Information that should remain private

• Passwords and authentication credentials.
• BVNs and private identity verification documents.
• Private residential addresses.
• Bank authentication secrets.
• Private account recovery information.
• Internal security logs and non-public financial information.
• Private buyer contact or delivery information, except when appropriately shared for an authorised transaction.

We do not intend to make sensitive information public merely because someone operates a store or purchases goods. Relevant transaction details may be shared with the buyer, seller or authorised provider as necessary to complete and document a transaction.

Merchants are responsible for reviewing what they publish. Public information may be copied, indexed, saved or shared by people outside the platform. Removing it from Oya Commerce may not immediately remove external copies or search engine results.

We do not sell personal information to third-party advertisers as a business model. However, providing Oya Commerce may require information to be disclosed to or processed by the following categories of recipients.

Banks and financial service providers

Where a feature requires banking, identity verification, payment processing, settlement or another financial service, relevant information may be shared with the bank or provider involved. This may include names, BVNs, account identifiers, verification results, transaction references and payment amounts, depending on the service.

Wema Bank may be a recipient where it is the relevant provider for a particular service. The precise information shared and the provider's role depend on the actual integration. Banks may process information under their own legal and regulatory obligations.

Payment, identity and fraud prevention providers

We may share relevant information with authorised providers to verify identities, validate accounts, process payments, confirm payment status, facilitate settlements and investigate suspicious activity. We seek to limit disclosures to information reasonably necessary for the relevant purpose.

AI service providers

When an AI-assisted feature is used, relevant product information may be sent to the AI provider, including Google where we use Gemini. Depending on the feature, this may include product names, specifications, text instructions and product images. Ordinary product description generation should not require BVNs, passwords, private home addresses or unrelated buyer financial records.

The AI provider's applicable terms and service configuration govern its handling of submitted information. Retention and model-improvement practices may vary by service and configuration. We do not promise that prompts are never retained or used for model improvement without verifying the applicable arrangements.

Merchants and transaction participants

A merchant may receive the customer and order information needed to fulfil an order, provide support, manage returns and maintain business records. Buyers may receive receipts showing appropriate transaction details, such as the seller, goods purchased, amounts and transaction reference.

Technology and infrastructure providers

Hosting, database, backup, email, authentication, monitoring and technical support providers may process information as necessary to provide their services. Depending on the provider and configuration, information may be processed in Nigeria or other countries.

Other permitted disclosures

• Authorised employees, contractors and professional advisers who need access to perform legitimate duties.
• Regulators, law enforcement agencies or courts where disclosure is legally required or permitted.
• Relevant parties involved in a merger, acquisition, restructuring or sale of assets, subject to appropriate safeguards.
• Other recipients where you direct us to share information or provide consent where required.

These categories do not give every recipient unrestricted access to all information. We seek to limit access and disclosure according to the relevant purpose, permissions and applicable arrangements.

We process personal information where a lawful basis applies under relevant law. Depending on the activity, this may include:

• Contract: processing necessary to create your account, provide requested features, record purchases or perform agreed services.
• Legal obligation: processing required by applicable data protection, financial, tax, recordkeeping or other laws.
• Legitimate interests: processing needed for purposes such as platform security, fraud prevention, reliability and protection of users, where those interests are not overridden by applicable rights.
• Consent: processing based on your consent where consent is required or is the appropriate legal basis.
• Other lawful grounds recognised by applicable law, where relevant.

Where we rely on consent, you may withdraw it subject to applicable law. Withdrawal does not invalidate processing that lawfully occurred before withdrawal, and it does not automatically prevent processing that remains lawful on another basis.

If information is necessary to provide a service or comply with a legal obligation, refusing to provide it may prevent us from offering that service.

Oya Commerce may use artificial intelligence services, including Google's Gemini API, to help merchants generate or improve product descriptions, titles, attributes, recommendations and other product-related content. These services process information submitted through the relevant AI-assisted feature to generate the requested output.

Information that may be submitted

• Product names and categories.
• Product specifications and attributes.
• Existing product descriptions.
• Product images, where supported.
• Instructions and context needed for the requested output.
• Technical information associated with the request.

We aim to limit information sent to AI providers to the information reasonably necessary to fulfil the requested task. AI-assisted product content features are intended for product-related information and should not be used to submit BVNs, passwords, Transaction PINs, identity documents, customer financial information or private transaction records.

How AI providers process information

When you use an AI-assisted feature, the relevant product information, instructions and other necessary request context may be transmitted to the AI service provider, such as Google through the Gemini API. The provider processes the submitted information to generate the requested content or output and may process associated technical information to operate, secure and maintain the service.

We use appropriate safeguards to protect information during transmission, including encrypted connections where supported by the relevant integration. Encryption during transmission does not, by itself, mean that information is encrypted throughout all processing or storage stages.

We do not intend to send BVNs, Transaction PINs, passwords, identity documents, customer financial information or private business transaction records to AI providers through product content-generation features. However, product information or other content submitted by a user may contain personal or confidential information. Users should review their inputs and avoid including information that is not necessary for the requested task.

AI model training and data retention

The use of submitted information for model improvement, the retention of prompts and generated outputs, and the handling of associated technical data depend on the AI service, account type, API configuration and applicable provider terms. We will configure and use the relevant AI services in accordance with the applicable terms and privacy requirements. We will not claim that information is excluded from model training or retained for a particular period unless the applicable service configuration and contractual terms support that claim.

Information submitted to an AI provider is subject to the provider's applicable privacy terms, data-processing arrangements and retention practices. Where required, we will provide additional information about the provider and its processing arrangements in our applicable privacy disclosures.

Reviewing AI-generated content

Generated content may be returned for review, saved to a catalogue or published if the merchant chooses to use it. AI-generated information may be inaccurate, incomplete, misleading or unsuitable for a particular product.

Merchants are responsible for reviewing product descriptions, specifications, prices, recommendations and claims before publication. AI-generated output is not a substitute for human verification.

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, alteration, disclosure and destruction.

Depending on the system and the risk involved, these measures may include:

• Secure transmission protocols.
• Encryption or equivalent safeguards for sensitive stored information, where appropriate.
• Password hashing and protected authentication systems.
• Role-based access controls and restricted administrative permissions.
• Authentication, session security and system monitoring.
• Security logging, vulnerability management and software maintenance.
• Backup and recovery procedures.
• Staff confidentiality obligations and appropriate provider agreements.
• Incident detection, investigation and response procedures.

The safeguards applied may differ across systems and providers. We cannot guarantee that any electronic system or network is completely secure, but we seek to maintain protections appropriate to the nature and sensitivity of the information processed.

Users should protect their passwords and devices, avoid unnecessary account sharing and notify us promptly if they suspect unauthorised access.

Some service providers may store or process information outside Nigeria. Cloud infrastructure, email delivery, identity verification and AI services may use facilities in other countries.

Where personal information is transferred internationally, we will take steps required by applicable law. Depending on the circumstances, these may include assessing the destination, using appropriate contractual safeguards, relying on a recognised transfer mechanism or obtaining consent where legally appropriate.

A provider's headquarters does not necessarily establish where its systems store or process information. We will not represent that all personal data is stored exclusively in Nigeria unless this is accurate for the relevant systems and providers.

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, subject to applicable legal, contractual, regulatory and security requirements. Retention periods vary by information type and purpose.

Account information

We retain account information while an account is active and for an appropriate period afterwards where necessary to resolve disputes, enforce agreements, maintain security or meet legal obligations.

Account and Data Deletion

You have the right to request the deletion of your Oya Commerce account and associated personal data at any time, subject to applicable legal, regulatory and other recognised retention exceptions. If you created an account through Oya Commerce, you can initiate an account deletion request using any of the following methods:

Delete your account in the mobile application

Open the Oya Commerce mobile application, navigate to Settings > Delete Account, and follow the instructions provided to submit your deletion request.

Delete your account through the website

Alternatively, visit https://app.oyacommerce.com, log in to your account, open Settings from the menu, and select Delete Account. Follow the instructions provided to submit your request.

Request deletion by email

You may also submit an account and personal data deletion request by emailing oyacommerce.privacy@itcloser.com. For security purposes, we may need to verify your identity before processing the request.

Following a verified deletion request, we will permanently delete or anonymise the personal data associated with your account within 30 days, except for information that must be retained under applicable financial, tax, regulatory or other legal requirements, or that is necessary for legitimate dispute resolution, security investigations or other recognised legal exceptions. Where retention is required or deletion is otherwise restricted, the affected information will be retained only for the applicable purpose and protected against unauthorised access or use. Where appropriate and legally required, we will delete the retained information when the applicable retention requirement or exception ends.

Deleting your account may result in the loss of access to your account, transaction history and other associated services. Account deletion does not necessarily mean that every record can be erased immediately, particularly where records must be retained for legal, financial, regulatory, fraud-prevention or dispute-resolution purposes. Information remaining in backups or archives will be handled in accordance with our applicable backup-retention and deletion procedures.

Transactions and business records

Receipts, invoices, sales histories and financial records may need to be retained after a transaction or account closure for accounting, tax, compliance, fraud prevention or dispute resolution.

BVNs and verification records

BVNs and related verification information are retained only as permitted and required for the relevant service and applicable law. Where a verification result or reference can satisfy the relevant requirement without retaining the full BVN, we may use that approach where appropriate.

Technical logs, AI content and backups

Security logs may be retained for an appropriate period to investigate incidents and maintain platform security. Product descriptions may remain in a merchant's catalogue or records. External AI providers may retain request-related information according to their applicable terms and configuration.

Information may remain temporarily in backups or archives after removal from the active platform. It should remain protected and be removed or overwritten according to applicable backup-retention and deletion procedures.

We may be unable to delete particular records immediately where retention is legally required, necessary for a legitimate dispute or security investigation, or subject to another recognised exception. Where deletion is not possible, we will restrict use as required by law.

Subject to applicable law, you may have the right to:

• Request access to personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion where the applicable conditions are met.
• Request restriction of certain processing activities.
• Object to processing in circumstances recognised by law.
• Withdraw consent where processing relies on consent.
• Request information about how your data is used or disclosed.
• Request a copy of eligible information in an appropriate format where portability applies.
• Complain to the relevant data protection authority.
• Seek other remedies available under applicable law.

These rights are not absolute in every circumstance. For example, we may need to retain records to comply with legal obligations or protect legitimate legal claims.

How to submit a request

Email oyacommerce.privacy@itcloser.com with a description of your request and the account or information concerned. We may need to verify your identity before disclosing, changing or deleting information, particularly where BVNs, financial information or account access are involved.

We will respond within the period required by applicable law. We will not require unnecessary sensitive information simply to submit a privacy request.

If you believe your information has been handled improperly, you may contact us to request an investigation. You may also contact the Nigeria Data Protection Commission or another competent authority where applicable.

You may request account closure through available account features or by contacting support. Following closure, we will take appropriate steps to deactivate the account and delete or anonymise information that is no longer needed, subject to applicable requirements.

Some records may need to remain for accounting, tax, regulatory compliance, security, fraud prevention or dispute resolution. Closing an account does not automatically erase transaction records that must lawfully be retained or information independently held by a bank, merchant or other provider.

Where a merchant closes an account, information relating to other individuals may remain necessary to fulfil legal obligations or preserve legitimate transaction records.

We may send account verification messages, security alerts, order and transaction notifications, receipts, payment-status updates, service announcements, support responses and notices about changes to our terms or policies.

Some communications are necessary to provide the service and may continue even if you opt out of optional marketing. Where we send marketing communications, we will comply with applicable consent and opt-out requirements.

You may unsubscribe from optional marketing communications using the available mechanism or by contacting us. Consent to optional marketing does not automatically authorise disclosure of BVNs or other sensitive information to advertisers.

Our website or application may use cookies, local storage or similar technologies where implemented. These technologies may support account sessions, authentication, security, user preferences, website functionality, performance monitoring and analytics.

Some technologies may be necessary to operate the service. Others may require consent or provide additional controls under applicable law. The information collected depends on the technologies actually deployed.

You may be able to control cookies through your browser settings. Disabling certain cookies may affect login, security or other platform functions. Where non-essential tracking or analytics tools are used, we will provide notices and choices required by applicable law.

Oya Commerce is intended for people who can lawfully use its business and commerce services. We do not knowingly seek to collect children's personal information for purposes that are not appropriate or lawful.

Where a user is below the age required to use a particular service, we will apply restrictions, consent requirements and safeguards imposed by applicable law.

If we become aware that personal information has been collected unlawfully from a child, we will assess the circumstances and take appropriate action, subject to applicable legal requirements.

Oya Commerce may contain links to external websites, banks, payment providers, delivery services and other third-party platforms. Those services may have their own privacy policies, terms and security practices.

We are not responsible for the privacy practices of independent third-party websites merely because they can be accessed through Oya Commerce. Review the relevant provider's policy before submitting information directly to that provider.

Where we integrate with a third party to provide a feature, our disclosure of information remains subject to this policy, applicable service arrangements and the law.

If we become aware of a personal data breach, we will investigate the incident, assess its nature and potential consequences, and take appropriate steps to contain and mitigate its effects.

Where notification to affected individuals, the Nigeria Data Protection Commission or another competent authority is required, we will make the notifications within the applicable legal requirements.

A security incident may involve unauthorised access, accidental disclosure, loss, destruction or alteration of personal information. We cannot guarantee that incidents will never occur; our responsibility is to maintain appropriate safeguards, respond to incidents and meet applicable obligations.

We may update this Privacy Policy to reflect changes in our services, data practices, technology, legal requirements or business operations. When we make changes, we will update the Last Updated date.

Where a change materially affects how personal information is processed, we will provide notice or seek consent where required by applicable law. Publishing a new policy does not replace obtaining consent where consent is legally required.

The version published on our official website is the currently published version, subject to any additional notices or contractual terms applicable to a particular service.

For questions, privacy requests, complaints or concerns about this policy or your personal information, contact us using the details below.

• Organisation: Oya Commerce, operated by ITCloser Technologies Ltd.
• Privacy email: oyacommerce.privacy@itcloser.com
• Website: https://oyacommerce.com
• Address: Road 26, Ikota Villa estate, Lekki, Lagos State, Nigeria.

Please do not include your password, full BVN, PIN, one-time password or other unnecessary authentication information in your initial email. We will take reasonable steps to review and respond to privacy enquiries in accordance with applicable law.

Oya Commerce helps businesses maintain reliable records of the goods they sell, the orders they fulfil and the transactions they complete. We recognise that the trust required to provide these services depends on responsible handling of personal information.

We aim to collect information for legitimate purposes, limit access to authorised parties, explain relevant disclosures, protect sensitive information and respect the privacy rights of individuals who use or interact with the platform.