AfriChop - African Food Marketplace
Framework: NDPA (NG) & GDPR (UK/EU)•Effective: September 2026•Last Updated: September 2026
Data Protection & Transparency

AfriChop Privacy Policy

Transparently outlining how AFRICHOP GLOBAL VENTURES LTD collects, utilizes, safeguards, and shares personal data for our marketplace users across Nigeria, the United Kingdom, Spain, Belgium, Italy, Germany, and France.

✓ PCI-DSS Offloaded Payments (Paystack)✓ Full User Privacy Rights (Access, Deletion)✓ Purpose-Limited Logistics Sharing✓ TLS 1.3 Transport Encryption
1

Who We Are and Controller Identity

Overview

This Privacy Policy explains how AFRICHOP GLOBAL VENTURES LTD (“AfriChop”, “we”, “us”, or “our”) collects, uses, stores, discloses, and protects your personal data when you visit, register an account on, sell through, or purchase from our online marketplace platform accessible via africhop.com.

AfriChop operates an e-commerce food marketplace connecting African agricultural producers, farmers, and food vendors with customers located domestically within Nigeria and internationally across the United Kingdom, Spain, Belgium, Italy, Germany, and France.

For the purposes of applicable data protection laws, AFRICHOP GLOBAL VENTURES LTD is the Data Controller responsible for your personal data.

⚠️ Regulatory Transparency Notice

We respect your privacy and are committed to protecting personal data. While this policy is structured in alignment with international data protection principles (including the Nigerian Data Protection Act 2023, the UK GDPR, and the European General Data Protection Regulation), AfriChop does not claim formal regulatory certification or blanket compliance guarantees without ongoing operational review by qualified data protection counsel.

2

Applicable Data Protection Frameworks

Overview

Because AfriChop operates as an international marketplace based in Nigeria serving cross-border consumers, our data processing activities are designed to respect the following statutory frameworks where applicable:

  • Nigeria: The Nigeria Data Protection Act 2023 (NDPA) and regulations issued by the Nigeria Data Protection Commission (NDPC).
  • United Kingdom: The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).
  • European Union: The General Data Protection Regulation (EU) 2016/679 (EU GDPR), directly protecting consumers residing in France, Germany, Italy, Spain, and Belgium.
3

Categories of Personal Data We Collect

Data Collection

We only collect personal information that is strictly necessary to operate our marketplace, fulfill your orders, verify vendors, and maintain secure services.

1. Customer & Account Data

  • Full name and title;
  • Email address (for account verification and notices);
  • Telephone number (for delivery driver communication);
  • Encrypted password hash (never plain text);
  • Guest session identifier (mv_session_id).

2. Delivery & Shipping Data

  • Physical delivery address (street, apartment, city, state);
  • Postal code / ZIP code;
  • Destination country and country code (e.g., NG, GB, ES, BE, IT, DE, FR);
  • Special delivery instructions or gate access notes.

3. Order & Transaction Details

  • Purchased items, quantities, and weights;
  • Order timestamps and status history;
  • Paystack transaction references and access codes;
  • Calculated shipping fees and currency (NGN, GBP, EUR).

4. Seller Verification Documents

  • Registered business name and contact person;
  • Corporate Affairs Commission (CAC) certificate;
  • Government-issued identity documents (passport, national ID, driver’s license);
  • Business address and banking details for vendor payouts.

5. Technical, Device, and Browsing Data

When you visit the Platform, our servers automatically log internet protocol (IP) addresses, browser type, operating system version, referring URLs, device type, error logs, and session interactions.

4

Payment Information and Payment Processors

Data Collection

We take the security of your financial data extremely seriously:

🛡️ Card Data Is Processed Exclusively by Paystack

All online debit and credit card payments on AfriChop are processed directly through Paystack (a licensed, PCI-DSS Level 1 certified payment gateway). AfriChop does not collect, see, record, or store full payment card numbers, bank account numbers, expiration dates, or Card Verification Values (CVV/CVC) on its servers.

Paystack receives your billing and card information directly through its encrypted authorization checkout. Paystack transmits back to AfriChop only a confirmation token, transaction reference, amount paid, and masked card summary (e.g. card brand and last 4 digits) for accounting reconciliation.

5

How We Use Your Personal Data and Legal Bases

Processing & Sharing

Under the NDPA, UK GDPR, and EU GDPR, we must have a lawful legal basis for each processing purpose:

Purpose / ActivityData CategoriesLawful Legal Basis
Creating accounts and order checkoutName, email, phone, address, password hashPerformance of a Contract with you
Fulfilling delivery and coordinating logisticsRecipient name, delivery address, phone numberPerformance of a Contract
Seller verification and KYC complianceCAC docs, government photo ID, premise addressLegal Obligation & Legitimate Interests (fraud prevention)
Customs and export declarationsParcel contents, declared value, recipient identityCompliance with Legal Obligation (customs laws)
Fraud detection and cyber securityIP address, session ID, failed login logsLegitimate Interests (protecting platform integrity)
Marketing newsletters and updatesEmail address, full nameConsent (freely given; can unsubscribe anytime)
6

Sharing Information with Third Parties

Processing & Sharing

We never sell, rent, or trade your personal information. We disclose personal data only on a strictly need-to-know basis to the following recipients:

  • Independent Sellers / Vendors: We share order item details, recipient name, and delivery destination details to the extent required for the seller to assemble, weight-verify, and package your order.
  • Logistics and Courier Partners: We share recipient name, physical delivery address, contact phone number, and parcel manifest with our domestic and international logistics providers (freight forwarders, air cargo handlers, customs clearing agents, and destination couriers) solely to deliver your package.
  • Payment Gateway Providers: Paystack receives order reference numbers, billing country, customer email, and total charge amounts to authenticate and authorize card transactions.
  • Cloud Hosting and Media Storage: Our platform is hosted on secure cloud infrastructure (Vercel) and stores product images and seller documents on encrypted cloud object storage (Cloudflare R2).
  • Authentication Providers: If you choose to log in via Google OAuth, Google processes your authentication credentials according to Google’s privacy terms.
  • Customs, Law Enforcement, and Regulatory Bodies: We may disclose information where required by statutory court order, search warrant, anti-money laundering investigations, or border customs declarations in Nigeria, the UK, or the EU.
7

International Cross-Border Data Transfers

Security & Transfers

Because AfriChop is established in Nigeria and serves customers in the UK, Spain, Belgium, Italy, Germany, and France, your personal data will naturally be transferred across international borders between these jurisdictions and to cloud data centers located in Europe and North America.

Transfer Safeguards:

When transferring personal data originating from the UK or EU to Nigeria or third-party service providers located outside the European Economic Area (EEA), we endeavor to implement appropriate contractual safeguards, such as:

  • Standard Contractual Clauses (SCCs) approved by the European Commission;
  • The UK International Data Transfer Agreement (IDTA) or UK Addendum;
  • Transfers strictly necessary for the conclusion or performance of your purchase contract (Article 49(1)(b) EU/UK GDPR derogation);
  • Compliance with Cross-Border Transfer Guidelines under Section 41-43 of the Nigerian Data Protection Act 2023.
8

Data Retention Periods

Security & Transfers

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with accounting and tax regulations, and resolve disputes.

  • Order and Financial Records: Retained for a minimum of 6 to 7 years to comply with statutory taxation, accounting, and anti-money laundering requirements under Nigerian, UK, and European fiscal laws.
  • Account Data: Retained for the duration of your active account. You may request account deletion at any time; upon verified request, non-essential data is erased or anonymized.
  • Seller Verification Documents: Retained for the duration of the seller’s marketplace relationship plus 5 years following offboarding for legal audit trails.
  • Guest Sessions and Cart Data: Guest shopping sessions (mv_session_id) and temporary cart data stored in temporary caches are purged after a limited period of inactivity.
9

Data Security and Safeguards

Security & Transfers

We employ comprehensive technical and organizational measures designed to protect your personal information against unauthorized access, accidental loss, destruction, alteration, or disclosure:

  • Transport Layer Encryption: All communications between your browser and our servers are encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS).
  • Token-Based Authentication: User sessions and API calls utilize secure JSON Web Tokens (JWT) with HTTP-only cookies and cryptographic verification.
  • Strict Access Controls: Access to sensitive administrative systems and vendor verification documents is restricted to vetted personnel on a need-to-know basis.

Please note that no electronic transmission over the internet or cloud storage solution is 100% immune to risk. You are responsible for maintaining the confidentiality of your account credentials.

10

Your Data Protection and Privacy Rights

Your Rights

Depending on your country of residence (Nigeria, UK, Spain, Belgium, Italy, Germany, or France), you hold specific statutory privacy rights under the NDPA, UK GDPR, or EU GDPR:

Right of Access: Request a copy of the personal data we hold about you and receive information on how we process it.
Right to Rectification: Request correction of inaccurate, misleading, or incomplete personal data.
Right to Erasure (“To Be Forgotten”): Request deletion of your personal data where retention is no longer necessary, subject to legal recordkeeping duties.
Right to Restrict Processing: Request the temporary freezing of processing under specific legal disputes.
Right to Data Portability: Receive your personal data in a structured, commonly used, and machine-readable format.
Right to Object & Withdraw Consent: Object at any time to direct marketing communications or withdraw previously granted consent.

How to Exercise Your Privacy Rights:

To exercise any of your privacy rights, please email our Data Protection Desk at care@africhop.com with the subject line “Data Subject Rights Request”. We will verify your identity before releasing information and aim to respond within 30 days.

Right to Lodge a Complaint with a Supervisory Authority:

If you believe our processing infringes data protection laws, you have the statutory right to lodge a formal complaint with:

  • Nigeria: Nigeria Data Protection Commission (NDPC) (ndpc.gov.ng)
  • United Kingdom: Information Commissioner’s Office (ICO) (ico.org.uk)
  • European Union: The relevant national data protection authority in your country of residence (e.g., CNIL in France, BfDI in Germany, Garante in Italy, AEPD in Spain, APD/GBA in Belgium).
11

Cookies and Similar Technologies

Data Collection

AfriChop uses cookies, local browser storage, and session tokens to ensure our website functions securely and efficiently:

  • Strictly Necessary Storage: We use local storage keys such as mv_session_id (to maintain your shopping cart before you log in), currency preferences (NGN, GBP, EUR), and authentication tokens to keep you logged in securely.
  • Functional & Performance Cookies: Measure network speeds, optimize asset loading, and prevent fraudulent duplicate requests.
  • Managing Cookies: You can manage or disable cookies via your browser settings. Please note that disabling strictly necessary cookies will disrupt checkout and cart functionality.
12

Children's Privacy

Overview

The AfriChop Marketplace is intended strictly for individuals aged 18 and older. We do not knowingly solicit, collect, or process personal data from children under 18 years of age.

If we become aware that we have inadvertently collected personal data from a minor without verified parental consent, we will take immediate steps to permanently delete the records from our servers.

13

Changes to This Privacy Policy

Overview

We may update this Privacy Policy periodically to reflect new marketplace features, integrations with additional payment or logistics providers, or revisions in data protection regulations across Nigeria, the UK, and Europe.

When updates occur, we will revise the “Last Updated” date at the top of this page. If we make significant changes in how we handle personal data, we will provide prominent notice via email or a platform banner prior to the change taking effect.

14

Contact Our Data Protection Team

Overview

If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact us:

AFRICHOP GLOBAL VENTURES LTD

Attention: Data Privacy Desk

Email: care@africhop.com

Hotline: +234 811 999 5696 / 0700 AFRICHOP

WhatsApp Support: +234 811 999 5696

Location: Federal Republic of Nigeria

Questions About Your Privacy?

Our Data Privacy Desk is available to help you access, correct, or request deletion of your personal data at any time.

Email Data Privacy DeskRead Terms of Use