Data Protection & Security

Privacy Policy

Compliant with the Nigeria Data Protection Act (NDPA) · Last Revised: October 2026
Data Privacy Commitment: Lakwaye B2B treats your personal, financial, and commercial information with the highest security standards. We never sell your personal data to third parties. All sensitive data is protected using state-of-the-art cryptographic safeguards.

1. Who We Are & Scope

This Privacy Policy applies to all services, web portals, APIs, and mobile applications operated by Lakwaye B2B ("we", "us", or "our"). We act as the Data Controller under the Nigeria Data Protection Commission (NDPC) framework.

2. Data We Collect

Depending on your engagement with the marketplace, we may collect:

  • Identity & Profile Data: Full name, phone number, email address, physical shipping address, state, and Local Government Area (LGA).
  • Merchant KYC & Verification Data: For registered sellers, we collect business registration documents (CAC), verified bank account numbers for payouts, and government-issued identification to prevent commercial fraud.
  • Transactional Data: Order records, transaction references, items purchased, delivery notes, and conversation logs between buyers and sellers.
  • Technical & Device Information: IP address, browser type, operating system, and login session activity used to detect account takeovers and automated attacks.

3. How We Use Your Data

We process your personal information strictly under lawful bases:

  • Contractual Performance: Processing your purchases, routing orders to merchants, and coordinating courier logistics.
  • Security & Fraud Prevention: Validating transactions, defending user sessions, identifying fraudulent sellers, and investigating suspicious activities.
  • Platform Communications: Order tracking notifications, security alerts (e.g. password resets), and customer support inquiries.
  • Legal Compliance: Adhering to Nigerian tax, commercial law, and anti-money laundering (AML) regulations.

4. Technical & Organizational Security Measures

We maintain rigorous enterprise security architectures to keep your data secure:

  • Password Encryption: Passwords are never stored in plaintext. We utilize strong, salted cryptographic hashes (PASSWORD_DEFAULT / bcrypt).
  • Data in Transit: 100% of network communications are encrypted via Transport Layer Security (TLS 1.2/1.3 / HTTPS).
  • SQL Injection Prevention: Database interactions are enforced via parameterized PDO queries and prepared statements.
  • Cross-Site Request Forgery (CSRF): All state-changing requests require cryptographically validated anti-CSRF tokens.
  • Access Control: Administrative and database access is segmented strictly under Least Privilege principles with role-based authentication.

5. Data Sharing & Third Parties

We only share data with essential, audited third parties under strict confidentiality obligations:

  • Payment Processors: Licensed gateways (e.g. PayVessel) receive transaction references and totals for payment clearance. We do not store raw credit card CVV numbers.
  • Logistics Partners: Delivery carriers receive shipping addresses and contact phone numbers solely to fulfill ordered shipments.
  • Law Enforcement: We will disclose data only when legally mandated by a valid subpoena or court order under Nigerian law.

6. Your Rights Under the NDPA

As a data subject, you have enforceable legal rights regarding your personal information:

  • Right of Access: Request a copy of the personal information we hold about you.
  • Right to Rectification: Request correction of inaccurate or incomplete records.
  • Right to Erasure ("Right to Be Forgotten"): Request deletion of your personal data, subject to legal record retention requirements.
  • Right to Object: Object to processing of your data for direct marketing purposes.

7. Data Retention

We retain personal data only as long as necessary to fulfill the purposes for which it was gathered, support legitimate business needs, and comply with regulatory statutory requirements (such as 6-year financial tax retention).

8. Contact the Data Protection Officer (DPO)

To exercise your data privacy rights or submit inquiries regarding our security protocols, please contact our Data Protection Office:

Email: dpo@lakwaye.com
Address: Data Protection Department, Lakwaye Commercial Center, Lagos, Nigeria
Support Ticket: Reach out via our Contact Us page.