Privacy Policy

1. Introduction

Ulisha Store ("we", "our", or "us") is operated by Ulisha Limited, a company duly registered under the laws of the Federal Republic of Nigeria. We are committed to protecting your personal data in accordance with the Nigeria Data Protection Regulation (NDPR) 2019, the Nigeria Data Protection Act (NDPA) 2023, and all applicable Nigerian laws.

By accessing or using Ulisha Store, you consent to the collection, processing, and use of your personal information as described in this Privacy Policy.

2. Information We Collect

Personal Information

• Full name
• Email address and phone number
• Residential, shipping, and billing addresses
• Account login credentials (stored in encrypted form)
• Order history and transaction records
• Customer support communications

Importer & Vendor Information

• Business name and company registration details (CAC number)
• Tax Identification Number (TIN)
• Business address and contact information
• Banking and payout information
• Scanned verification documents

Technical & Usage Data

• IP address, browser type, device identifiers
• Pages visited, clicks, and session duration
• Cookies and similar tracking technologies

3. Lawful Basis for Processing (NDPR/NDPA)

Under the NDPR 2019 and NDPA 2023, we process your personal data on the following lawful bases:

• Consent — where you have expressly agreed to processing (e.g., marketing communications).
• Contractual Necessity — to fulfill your orders and manage your account.
• Legal Obligation — to comply with Nigerian laws, including tax and regulatory reporting.
• Legitimate Interest — to prevent fraud, ensure platform security, and improve our services.

4. How We Use Your Information

• Create and manage user accounts
• Process orders, payments, and issue receipts
• Verify importer and vendor applications
• Facilitate product delivery and logistics coordination
• Send order status updates and support communications
• Detect and prevent fraud, abuse, and unauthorized access
• Comply with Nigerian regulatory and tax obligations
• Improve platform performance and user experience

5. Sharing Your Information

We do not sell, rent, or trade your personal data. We may share your information only with:

• Payment processors — Paystack and MixPay, to securely complete financial transactions (PCI-DSS compliant).
• Logistics and courier partners — to deliver your orders (name, phone, address only).
• Cloud infrastructure providers — for secure hosting and data storage.
• Error monitoring services — see Section 11 (Sentry).
• Regulatory authorities — where required by Nigerian law, court order, or FIRS/CAC directives.

6. Cookies & Tracking Technologies

We use cookies and similar technologies to enhance platform functionality, analyze usage, and maintain session security. You can manage your cookie preferences via your browser settings. See our Cookie Policy for full details.

7. Payment Processing

All payment transactions are processed by authorized, PCI-DSS-compliant third-party gateways. We do not store full card details, PINs, or CVV codes on our servers. Payment tokenization is managed entirely by our payment partners.

8. Data Security

We implement industry-standard administrative, physical, and technical safeguards including encryption at rest and in transit, access controls, and regular security audits. However, no method of electronic transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this policy, comply with legal and regulatory obligations under Nigerian law (including the Finance Act and FIRS requirements), resolve disputes, and enforce our agreements. When data is no longer required, it is securely deleted or anonymized.

10. Your Rights Under the NDPR & NDPA

As a data subject under Nigerian law, you have the following rights:

• Right to Access — request a copy of the personal data we hold about you.
• Right to Rectification — request correction of inaccurate or incomplete data.
• Right to Erasure — request deletion of your data where legally permissible.
• Right to Restrict Processing — request we limit how we use your data.
• Right to Data Portability — receive your data in a structured, machine-readable format.
• Right to Object — object to processing based on legitimate interests.
• Right to Withdraw Consent — at any time, where processing is based on consent.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days as required by the NDPA 2023. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

11. Error Monitoring (Sentry)

We use Sentry (sentry.io) by Functional Software, Inc. to identify and resolve technical errors on our platform. When an error occurs, Sentry may automatically collect:

• Browser type, version, and operating system
• Pages visited and actions performed at the time of the error
• IP address (used for geolocation purposes only)
• Error stack traces and diagnostic data
• Authenticated user identifiers (e.g., user ID) where applicable

This data is used solely for debugging and platform stability. We do not use Sentry data for marketing. Review Sentry's Privacy Policy for more information.

12. International Data Transfers

Some data may be processed on servers located outside Nigeria (including EU cloud regions). Where this occurs, we ensure appropriate safeguards are in place consistent with the NDPR and NDPA, including contractual data protection clauses with processors.

13. Children's Privacy

Ulisha Store is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted information to us, please contact us immediately and we will delete such data.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page with an updated effective date. Your continued use of the platform after changes are posted constitutes acceptance of the revised policy.