1. Introduction

OBINRIN Global Venture Limited (“OBINRIN”, “we”, “our”, “us”) operates a women-first e-commerce marketplace consisting of a website and mobile application (the “Marketplace”) together with supporting payment and logistics infrastructure for the sale and purchase of women-focused consumer products and services in the Federal Republic of Nigeria.

We are the data controller responsible for the personal data we process about you. We are committed to protecting your privacy and to handling your personal data lawfully, fairly and transparently in accordance with the Nigeria Data Protection Act 2023 (the “NDPA”) and any regulations, directives and guidance issued under it by the Nigeria Data Protection Commission (the “NDPC”).

This Policy explains what personal data we collect, how and why we use it, who we share it with, how long we keep it, and the rights you have. It applies to buyers, vendors, visitors and any other individual whose data we process through the Marketplace. It should be read together with our General Terms and Conditions, Returns, Refunds & Cancellation Policy, and our Cookie Policy.

By using the Marketplace, you acknowledge that you have read and understood this Policy. Where we rely on your consent, we will ask for it separately and you may withdraw it at any time.

2. Definitions

1. Personal Data - any information relating to an identified or identifiable individual.
2. Processing - any operation performed on personal data, such as collection, storage, use, sharing or deletion.
3. Data Subject - the individual to whom the personal data relates (for example, you).
4. Data Controller - the party that determines the purposes and means of processing. For platform operations, this is OBINRIN.
5. Data Processor - a party that processes personal data on the controller’s behalf and on its instructions.
6. Buyer / Vendor / Marketplace - as defined in our General Terms and Conditions.

3. Personal Data We Collect

In processing your personal data, we adhere to the data processing principles set out in the Nigeria Data Protection Act 2023. Our obligation under these principles is to ensure that personal data is:

1. processed in a fair, lawful and transparent manner;
2. collected for specified, explicit and legitimate purposes, and not further processed in a way incompatible with those purposes;
3. adequate, relevant, and limited to the minimum necessary for the purposes for which it was collected or further processed;
4. retained for no longer than is necessary to achieve the lawful bases for which it was collected or further processed;
5. accurate, complete, not misleading, and, where necessary, kept up to date having regard to the purposes for which it is collected or further processed; and
6. processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing, access, loss, destruction, damage, or any form of data breach.

We are further committed to demonstrating accountability, exercising a duty of care towards you, and upholding the confidentiality, integrity and availability of the personal data we hold.

4. Personal Data We Collect

4.1 Information you provide to us

1. Account and profile data: name, email address, phone number, password, and (where you choose to provide it) gender, date of birth and profile preferences.
2. Buyer transaction data: delivery address, order history, items saved to your Stockpile, ratings, reviews and feedback.
3. Vendor onboarding and verification data: business name and registration details, proof of identity, business address, bank and payout details, and other documentation required to verify you and meet our anti-money-laundering and know-your-customer obligations.
4. Communications: messages you send through in-app chat, support tickets, dispute submissions, and any photos or videos you upload as evidence in a return or dispute.

4.2 Information we collect automatically

1. Device and technical data: IP address, device identifiers, browser type, operating system and app version.
2. Usage data: pages and listings viewed, searches, clicks, and how you interact with the Marketplace. We use this information, together with then analytics tools described in Section 8, mainly in aggregate form, to understand how people find and use the Marketplace and to measure the  performance of our marketing channels not to monitor or profile individual buyers or vendors.
3. Approximate location, derived from your IP address or, with your permission, more precise location to support delivery and fraud prevention.
4. Cookies and similar technologies, as described in Section 7.

4.3 Information we receive from third parties

1. Our payment partner, regarding the status of payments, payouts and refunds.
2. Logistics partners, regarding delivery status and proof of delivery.
3. Identity-verification and fraud-prevention providers, regarding the outcome of checks.

Sensitive data: We do not seek to collect special-category or sensitive personal data through the Marketplace. Please do not include such data in chat messages, reviews or dispute uploads unless it is strictly necessary.

5. How We Use Your Personal Data and Our Lawful Bases

Under the NDPA, we must have a lawful basis for each use of your personal data. The table below sets out our principal purposes and the basis we rely on for each.

Account creation, authentication, and providing the Marketplace to you

1. Lawful basis: Performance of a contract
2. Reason: We cannot give you an account or process your orders without this.

Processing orders, holding funds in escrow, and releasing vendor payouts

1. Lawful basis: Performance of a contract
2. Reason: Core to the buyer–vendor transaction you enter into.

Vendor verification, KYC, anti-fraud and anti-money-laundering checks

1. Lawful basis: Legal obligation; legitimate interests
2. Reason: Required under the Money Laundering (Prevention and Prohibition) Act 2022 and CBN regulations, and to protect platform trust.

Dispute resolution, returns, refunds and Trust & Safety enforcement

1. Lawful basis: Performance of a contract; legitimate interests
2. Reason: To deliver the protections promised in our policies and keep the Marketplace safe.

Reviewing in-app chat for safety, fraud prevention and dispute evidence

1. Lawful basis: Legitimate interests
2. Reason: Balanced against your privacy; scope is described in Section 6.

Service notifications (order, delivery, dispute and account messages)

1. Lawful basis: Performance of a contract
2. Reason: These are transactional, not marketing, and necessary to operate your account.

Marketing and promotional communications

1. Lawful basis: Consent
2. Reason: You may withdraw consent at any time without affecting service messages.

Maintaining, securing and debugging the Marketplace

1. Lawful basis: Legitimate interests
2. Reason: To keep the platform running reliably and securely.

Understanding overall site traffic and measuring the performance of our marketing channels (analytics and marketing cookies):

1. Lawful basis: Consent (given via our cookie banner)
2. Reason: We use tools such as Google Analytics to understand, in aggregate, how visitors find and use the Marketplace and which channels are effective, so we can strategize on marketing and improve the service. These tools run only where you have given cookie consent - see Section 8 and our Cookie Policy.

Complying with legal, tax, regulatory and court requirements

1. Lawful basis: Legal obligation
2. Reason: Including disclosures to courts, the NDPC and other authorities.

6. Lawful Bases Explained

We rely on the following lawful bases recognized under the NDPA, as relevant to the purpose:

1. Consent - where you have given clear, affirmative agreement (for example, to marketing or non-essential cookies)
2. Performance of a contract - where processing is necessary to provide the Marketplace and complete your transactions.
3. Legal obligation - where we must process data to comply with Nigerian law, including AML/KYC and tax requirements.
4. Legitimate interests - where processing is necessary for our legitimate interests (such as security, fraud prevention and platform improvement) and not overridden by your rights.
5. Vital interests - in rare cases, to protect someone’s life or safety.

Where we rely on legitimate interests, you may ask us about the balancing assessment we carried out by contacting us at the details in Section 19.

7. In-App Chat and Moderation

The Marketplace includes a moderated in-app chat so buyers and vendors can communicate about orders. To keep the platform safe and to resolve disputes, messages and any attachments may be stored and reviewed including to detect fraud, harassment, prohibited items, or attempts to take transactions off-platform.

Please do not share payment details, passwords or unnecessary personal data in chat. Attempts to arrange payment outside the Marketplace are prohibited under our General Terms and Conditions.

8. Cookies and Similar Technologies

We use cookies and similar technologies for the following purposes:

1. Strictly necessary cookies, to keep you signed in, secure the platform, and enable core functionality such as your cart and checkout. These cannot be switched off, as the Marketplace cannot function without them.
2. Analytics cookies, including Google Analytics, to understand in aggregate how visitors find and use the Marketplace such as which pages are viewed, which channels bring visitors, and overall traffic trends. We use this information to strategize on our marketing channels and improve the Marketplace; it is not used to monitor, profile, or make decisions about individual users.
3. Marketing cookies, including tools such as Meta Pixel, where enabled, to measure the performance of our advertising and, where you have consented, to show you more relevant ads.

Analytics and marketing cookies are non-essential and will only be activated after you have given consent through the cookie banner on the Marketplace. You may withdraw or change your consent at any time through your cookie preferences or your browser settings.

Full details of the specific cookies we use, their purpose, and how long they last are set out in our Cookie Policy.

9. How We Share Your Personal Data

We share personal data only where necessary for the purposes set out in this Policy. We do not sell your personal data. We may share data with the following categories of recipient:

Vendors

When you place an order, we share the details a vendor needs to fulfil it (name, delivery address, contact details, order contents). Vendors are independently responsible for that data (see Section 9.)

Logistics partners

Third-party couriers receive the delivery information needed to complete or return a shipment, and proof-of-delivery data flows back to us.

Payment partner

Payments and escrow are handled through our approved payment provider, which processes card, transfer and payout data under its own security obligations.

Service providers

Hosting, cloud, analytics, communications (SMS/email), identity-verification and fraud-screening vendors that process data on our instructions under written agreements. This includes analytics providers such as Google (Google Analytics) and, where enabled, advertising partners such as Meta, who help us understand aggregate site traffic and measure marketing performance under their own data processing terms.

Regulators and authorities

Courts, the Nigeria Data Protection Commission, the CBN, tax and law-enforcement authorities where we are legally required or permitted to disclose.

Professional advisers

Lawyers, auditors and insurers, bound by confidentiality.

Corporate transactions

A successor entity in the event of a merger, acquisition or reorganization, subject to this Policy.

10. Vendor Responsibilities Regarding Buyer Data

When a vendor receives buyer personal data to fulfil an order, the vendor is directly and independently responsible for handling that data lawfully. Vendors must:

1. use buyer personal data only to fulfil the specific order;
2. not share, sell or otherwise transmit buyer personal data to any third party; and
3. comply with the NDPA and all applicable data protection law.

OBINRIN bears no liability to buyers for a vendor’s misuse of personal data that comes into the vendor’s possession through a transaction. Vendors indemnify OBINRIN against any such misuse, as set out in our General Terms and Conditions.

11. International Transfers and Data Residency

Some of our service providers (for example, cloud hosting, analytics or communications partners) may process personal data outside Nigeria. Where personal data is transferred outside the Territory, we take steps to ensure it receives a level of protection consistent with the NDPA, including by using providers in jurisdictions recognized as adequate or by putting appropriate contractual safeguards in place.

For example, our analytics provider, Google, processes analytics data on servers located outside Nigeria. Where we rely on a service provider’s standard contractual clauses or other appropriate safeguards, and no adequacy determination has been made for that country by the Nigeria Data Protection Commission, we may also rely on your consent to the transfer, given after you have been informed of the possible risks, in accordance with Section 43 of the NDPA.

12. How Long We Keep Your Data

We keep personal data only for as long as necessary for the purposes described in this Policy, and thereafter where we must retain it to meet legal, tax, accounting, AML or dispute-resolution obligations. When data is no longer needed, we securely delete or anonymize it.

13. How We Protect Your Data

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse or alteration. These include access controls, encryption in transit, secure handling of payment data through our payment partner, and holding buyer funds in escrow until an order is confirmed. No system is completely secure, but we work to maintain safeguards proportionate to the risk.

If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the NDPC and, where required, affected individuals, in line with the NDPA.

14. Your Rights

Subject to conditions and exemptions under the NDPA, you have the following rights in respect of your personal data:

1. Access: Ask whether we hold personal data about you and request a copy of it.
2. Rectification: Ask us to correct inaccurate or incomplete data.
3. Erasure: Ask us to delete your data where there is no overriding legal reason to keep it.
4. Restriction: Ask us to limit how we use your data while a concern is resolved.
5. Objection: Object to processing based on our legitimate interests, including profiling.
6. Portability: Receive certain data in a structured, commonly used, machine-readable format.
7. Withdraw consent: Withdraw any consent you gave, at any time, without affecting prior processing.
8. Lodge a complaint: Complain to the Nigeria Data Protection Commission if you are unsatisfied.

To exercise any of these rights, contact us using the details in Section 18. We will respond within the timeframe required by the NDPA. We may need to verify your identity before acting on a request.

15. Marketing Communications

We send service messages (about orders, deliveries, disputes and your account) because they are necessary to operate your account — these are not marketing and you cannot opt out of them while you hold an account. We send marketing and promotional messages only where you have consented, and you can withdraw consent at any time by using the unsubscribe option in the message, adjusting your notification settings, or contacting us. SMS may be used as a primary channel for both service and, with consent, promotional messages.

16. Children

The Marketplace is not intended for anyone under 18 years of age, and you must be at least 18 to register. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

17. Third-Party Links

The Marketplace may contain links to third-party websites or services. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review their privacy notices before providing them with personal data.

18. Changes to This Policy

We may update this Policy from time to time. Where changes are material, we will provide reasonable notice through the Marketplace or by email before they take effect. The “Last Updated” date at the top of this Policy indicates when it was last revised. Continued use of the Marketplace after changes take effect constitutes acceptance of the updated Policy.

19. Contact and Complaints

If you have questions about this Policy, wish to exercise your rights, or want to make a complaint about how we handle your personal data, please contact us

1. Support: support@obinrin.ng
2. Website: www.obinrin.ng

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you are not satisfied with our response.

© 2026 OBINRIN Global Venture Limited. All rights reserved.