PRIVACY POLICY

This Privacy Policy explains how Chrisvic.com (the "Company," "we," "us," or "our") collects, uses, discloses, and protects your Personal Data when you access or use our website at [WEBSITE DOMAIN] and related mobile applications, services, and features (the "Platform"). This Privacy Policy applies to all visitors, Buyers, and Vendors of the Platform. 

Please read this Privacy Policy carefully. By using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, you must not use the Platform.

1. DEFINITIONS

• "Data Controller" means a person that alone or jointly with others determines the purpose and means of processing Personal Data. The Company is the Data Controller for the purposes of this Privacy Policy.
• "Data Processor" means a person that processes Personal Data on behalf of a Data Controller.
• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"), including data that can identify a person directly or indirectly.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, organisation, storage, retrieval, use, disclosure, combination, restriction, erasure, or destruction.
• "Sensitive Personal Data" means Personal Data relating to religious or philosophical beliefs, health status, ethnicity, trade union membership, biometric data, genetic data, sexual life, or criminal records, or any other data classified as sensitive by applicable law.

2. INFORMATION WE COLLECT

2.1 Information You Provide Directly

We collect Personal Data that you provide to us when you:

• (a) create a Buyer or Vendor account;
• (b) place an Order;
• (c) list Products for sale;
• (d) submit payment information;
• (e) contact customer support;
• (f) complete surveys, feedback, or reviews;
• (g) subscribe to newsletters or marketing communications;
• (h) participate in promotions, contests, or loyalty programs.

This information may include:

• name, date of birth, and gender;
• email address, phone number, and postal address;
• delivery and billing addresses;
• payment information (including card details, bank account details, and payment identifiers);
• Vendor business information (including business name, registration details, tax identification number, and business verification documents);
• any other information you choose to provide.

2.2 Information Collected Automatically

When you use the Platform, we may automatically collect:

• device information (including device type, operating system, browser type, and settings);
• log data (including IP address, access times, pages viewed, and referring URLs);
• usage data (including interactions with the Platform, searches, and clicks);
• location data (approximate location derived from your IP address);
• cookie and tracking data, as described in our Cookies Policy.

2.3 Information From Third Parties

We may receive Personal Data from third parties, including:

• payment processors and financial institutions;
• identity verification and fraud prevention services;
• delivery and logistics providers;
• analytics and advertising providers;
• other users (for example, when a Buyer leaves a review about a Vendor).

3. SENSITIVE PERSONAL DATA

3.1 We generally do not collect Sensitive Personal Data. If we need to collect Sensitive Personal Data, we will obtain your explicit consent or rely on another lawful basis permitted under the NDPA 2023.

3.2 Government-issued identification and verification documents provided by Vendors may contain sensitive information; such data is processed solely for identity verification and anti-fraud purposes and is handled with heightened security and restricted access.

4. HOW WE USE YOUR PERSONAL DATA

We process Personal Data for the following purposes:

4.1 Where we rely on consent, you may withdraw your consent at any time by contacting us through the Platform. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

4.2 Where we rely on legitimate interests, we balance our interests against your rights and freedoms and process only such data as is necessary and proportionate to achieve the identified purpose.

5. HOW WE SHARE YOUR PERSONAL DATA

We may share Personal Data with the following categories of recipients:

5.1 Vendors

When you place an Order, we share your name, delivery address, and contact details with the Vendor selling the Product so that they can fulfil and deliver your Order.

5.2 Buyers

When you act as a Vendor, we share your business name and relevant contact information with Buyers to facilitate transactions and communication.

5.3 Service Providers

We share Personal Data with third-party service providers who process data on our behalf, including payment processors, logistics and delivery partners, identity verification services, cloud hosting providers, analytics providers, and customer support tools. These providers are bound by contractual obligations to protect your Personal Data.

5.4 Professional Advisers and Authorities

We may disclose Personal Data to our legal, accounting, and other professional advisers, and to regulatory or government authorities (including the Nigeria Data Protection Commission, the Federal Competition and Consumer Protection Commission, and law enforcement agencies) where required or permitted by law.

5.5 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your Personal Data may be transferred as part of the transaction, subject to appropriate safeguards.

5.6 With Your Consent

We may share Personal Data with third parties where you have given your explicit consent to do so.

6. CROSS-BORDER TRANSFERS

6.1 In some cases, we may transfer Personal Data to service providers located outside Nigeria, for example for cloud hosting or payment processing.

6.2 Where Personal Data is transferred outside Nigeria, we will ensure that appropriate safeguards are in place in accordance with the NDPA 2023, including Standard Contractual Clauses, adequacy decisions (where applicable), or other legally recognised transfer mechanisms.

6.3 By using the Platform, you acknowledge that such transfers may occur. You may request a copy of the safeguards in place by contacting us.

7. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies to operate, analyse, and improve the Platform, and to deliver relevant content. For detailed information on the cookies we use and how to manage them, please refer to our Cookies Policy.

8. DATA RETENTION

8.1 We retain Personal Data only for as long as necessary to fulfil the purposes described in this Privacy Policy, to comply with legal and regulatory obligations, to resolve disputes, and to enforce our agreements.

8.2 Specific retention periods may be determined by:

• (a) legal and regulatory requirements (including tax and record-keeping laws);
• (b) the duration of your account and any outstanding transactions;
• (c) the resolution of disputes and the enforcement of our Terms.

8.3 When Personal Data is no longer required, we will securely delete or anonymise it.

9. DATA SECURITY

9.1 We implement appropriate technical and organisational measures to protect Personal Data against unauthorised access, alteration, disclosure, or destruction, including encryption in transit and at rest, access controls, secure data storage, and employee training.

9.2 While we take reasonable precautions, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your Personal Data.

9.3 You are responsible for safeguarding your account credentials and for the security of your own devices.

10. YOUR RIGHTS

Under the NDPA 2023, you have the following rights in relation to your Personal Data:

• (a) Right to be informed: to be informed about the collection and use of your Personal Data (as set out in this Privacy Policy);
• (b) Right of access: to request a copy of the Personal Data we hold about you;
• (c) Right to rectification: to request the correction of inaccurate or incomplete Personal Data;
• (d) Right to erasure ("right to be forgotten"): to request the deletion of your Personal Data in certain circumstances;
• (e) Right to restrict processing: to request that we limit how we process your Personal Data in certain circumstances;
• (f) Right to data portability: to receive your Personal Data in a structured, commonly used, and machine-readable format and to transmit it to another controller;
• (g) Right to object: to object to processing based on legitimate interests or for direct marketing;
• (h) Right to withdraw consent: to withdraw your consent at any time where processing is based on consent;
• (i) Right not to be subject to automated decision-making: to request human intervention in respect of decisions made solely by automated means that produce legal effects or similarly significant effects on you;
• (j) Right to complain: to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any of these rights, please contact us. We will respond to valid requests within 60 days as required by law. We may require you to verify your identity before processing your request.

11. CHILDREN'S PRIVACY

11.1 The Platform is not directed at children under the age of thirteen (13).

11.2 If we become aware that we have collected Personal Data from a child under thirteen (13) without verifiable parental consent, we will take steps to delete such data. If you believe we have collected Personal Data from a child, please contact us.

12. VENDOR-SPECIFIC PROVISIONS

12.1 Vendors are separately responsible for complying with the NDPA 2023 and the NDPR 2019 in respect of any Personal Data of Buyers or other individuals that they collect, receive, or process in connection with their use of the Platform.

12.2 Vendors must only use Buyer Personal Data (including names, addresses, and contact details) for the purpose of fulfilling Orders and related customer service, and must not use such data for marketing or any other purpose without the Buyer's consent.

12.3 Where Vendors process Personal Data on behalf of the Company, the relevant terms of processing shall be set out in the Vendor agreement or a separate Data Processing Agreement.

13. THIRD-PARTY LINKS

The Platform may contain links to third-party websites, applications, or services. This Privacy Policy does not apply to those third parties. We are not responsible for the privacy practices of third parties, and we encourage you to review their privacy policies before providing any Personal Data.

14. AUTOMATED DECISION-MAKING AND PROFILING

We may use automated processes for purposes including fraud detection and the classification of vendors. Where automated decision-making produces legal or similarly significant effects on you, you may request human intervention, express your point of view, and contest the decision by contacting us.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting the updated Privacy Policy on the Platform and, where appropriate, by email. The updated policy will take effect on the "Last Updated" date shown at the top of this policy.

16. CONTACT US

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us.