Privacy Policy

1. Information we collect

We collect information in three ways: directly from you when you take an action (registering, listing, ordering, contacting support); automatically via your browser and device; and from our partners when they verify your identity, process your payment, or deliver your package.

Information you give us

• Account information: name, email address, Nigerian phone number, hashed password, date of birth (used for age verification only).
• Profile information: profile photo, business name (for vendors), store description, delivery and billing addresses.
• KYC documents (vendors and freelancers): a photo of your government-issued ID, your BVN, your Nigerian bank account details, and your business category.
• Transaction data: orders placed, products listed, services booked, dispute messages, reviews you write or receive.
• Communications: any messages you send to other users on the platform, and any messages you send to our support team.

Information collected automatically

• Device and browser data: IP address, browser type, operating system, screen size, language preference.
• Usage data: pages you visit, what you click, search queries, time spent on each page. We use this only to improve the platform.
• Cookies and similar technologies: session cookies (so you stay logged in), preference cookies (language, currency display), and basic anonymous analytics cookies.
• Approximate location: derived from your IP address, used to show you relevant currency, language, and shipping options. We do NOT track precise GPS location.

Information from third parties

• Payment processors (Flutterwave, Paystack, Squad): they tell us "payment confirmed/failed" plus a transaction reference. They never share your full card number with us.
• KYC verifiers (NIBSS, VerifyMe, Smile Identity): they confirm whether the ID you submitted is genuine and matches your BVN. They don't share other government-held data with us beyond a yes/no result.
• Couriers (Terminal Africa, GIG, etc.): they share tracking updates so we can show them in your dashboard.

2. How we use your information

We use your data only for the purposes listed below. We do not use it for any other reason without telling you first.

• Operating the marketplace: processing orders, routing payments, delivering goods, scheduling freelance bookings, sending receipts.
• Verifying identities: confirming vendor and freelancer accounts are real and trustworthy, detecting fraudulent or fake accounts.
• Resolving disputes: when one user files a dispute against another, we may review messages, payment records, and courier proofs to make a fair decision.
• Customer support: answering your questions and chasing down issues with payments, deliveries, or accounts.
• Transactional notifications: emailing or texting you about order confirmations, dispute updates, payouts, and security-relevant events on your account.
• Legal compliance: retaining tax records, anti-money-laundering checks, and responding to legitimate court orders or police investigations.
• Improving the platform: aggregated usage analysis to understand what's working and what isn't. We never look at individual users' behaviour for product decisions.
• Marketing (only with your consent): if you opt in, we may send you occasional emails about new features, vendor highlights, or promotions. You can unsubscribe at any time.

3. Who we share information with

We share data only when it's needed to provide our services, when you've explicitly consented, or when we're legally required to. We do not sell your personal information to anyone.

Service providers we share with

• Payment processors: Flutterwave, Paystack, and Squad — to collect funds from buyers and disburse to vendors.
• KYC verifiers: NIBSS / VerifyMe / Smile Identity — to confirm vendor and freelancer identities.
• Couriers: Terminal Africa and any other courier you select — to ship orders. They receive only the recipient's name, address, and phone for delivery.
• Email infrastructure: Amazon Simple Email Service (SES) — to deliver transactional emails. They handle delivery only; no marketing access.
• Hosting: Heroku and AWS Lagos — where the platform runs. They have technical access to encrypted databases but cannot read individual user data.
• Analytics: Anonymised, aggregated usage data only. No personally identifiable information is shared.

When we share with law enforcement

We share data with Nigerian law enforcement, regulators, or courts only when we receive a valid legal order. We will challenge orders we believe to be overly broad. Where legally permitted, we notify the affected user before complying.

If JEXCELHUB is acquired

In the event of a merger, acquisition, or asset sale, your data may transfer to the acquiring entity. They would be bound by the same protections in this policy. We would notify you by email at least 30 days before any such transfer.

4. Your rights under Nigerian law

Under the Nigeria Data Protection Act 2023, you have the following rights:

• Right to access: request a copy of all personal data we hold about you.
• Right to correction: ask us to fix anything inaccurate or incomplete.
• Right to deletion: ask us to permanently delete your data (subject to financial-records retention obligations under Nigerian tax law).
• Right to portability: get your data in a structured, machine-readable format so you can take it elsewhere.
• Right to withdraw consent: opt out of marketing communications at any time. Just click "unsubscribe" in any email or change settings in your dashboard.
• Right to object: tell us to stop processing your data for specific reasons.
• Right to lodge a complaint: file a complaint with the Nigeria Data Protection Commission (NDPC) if you believe we've mishandled your data.

To exercise any of these rights, email privacy@jexcelhub.com from the address registered to your account. We respond within 30 days, often much sooner. There's no fee for a reasonable request, but we may charge a small admin fee for repeat or excessive requests.

5. Data retention

We retain different categories of data for different periods, depending on legal obligations and reasonable business needs:

• Active account data: retained while your account is active and for 90 days after closure (in case you change your mind).
• Order, payment, and KYC records: retained for 7 years after your last transaction to comply with Nigerian tax law and the Money Laundering Prevention and Prohibition Act.
• Dispute records: retained for 3 years after resolution.
• Marketing data: deleted within 30 days of you unsubscribing.
• Server logs: retained for 90 days for security and debugging.

After the retention period, data is either permanently deleted or anonymised so it can no longer be linked back to an individual.

6. Security

We take security seriously and have implemented industry-standard measures to protect your data:

• Passwords are hashed using PBKDF2-SHA256 with per-user salt; we cannot read your password.
• Sessions are signed with cryptographic keys and expire automatically after a period of inactivity.
• All network traffic is encrypted via TLS 1.2+; HTTP is automatically upgraded to HTTPS.
• Card details never touch our servers — they go straight from your browser to Flutterwave/Paystack/Squad over an isolated PCI-DSS compliant connection.
• Database backups are encrypted at rest and access-logged.
• Internal access is role-based; staff only see the data they need for their job.
• Two-factor authentication is available for all users and required for staff.

Despite all of this, no system is 100% secure. If you suspect your account has been compromised, change your password immediately, enable 2FA if you haven't already, and email security@jexcelhub.com. We will investigate within 24 hours.

7. Cookies and similar technologies

We use cookies and similar technologies for the following purposes:

• Strictly necessary cookies: session cookies that keep you logged in and CSRF tokens that protect against cross-site request forgery. Cannot be disabled.
• Preference cookies: language and display preferences, the contents of your cart, your wishlist. Disabling these breaks the site.
• Analytics cookies: anonymous usage statistics. Disable from your browser settings if you prefer.

We don't use third-party advertising cookies. We don't sell your browsing history.

8. Children

JEXCELHUB is intended for users 18 and older. We do not knowingly collect data from children under 18. If you believe a minor has registered for an account, please email privacy@jexcelhub.com and we will delete the account and all associated data within 7 days.

9. International transfers

Your data is primarily stored on AWS infrastructure in Lagos, Nigeria. Some of our service providers (e.g. email infrastructure) may process data outside Nigeria. When this happens, we ensure equivalent legal protection via standard contractual clauses compliant with NDPA 2023.

10. Changes to this policy

We may update this policy from time to time as our services evolve and the law changes. Material changes will be announced by email and via in-app notification at least 30 days before they take effect. We always maintain a publicly available archive of previous versions for transparency.