Privacy Policy

1. Controller and scope

Orderly NG is the controller for account administration, platform security, payment-status records, support and platform operations. A seller is independently responsible for customer information it receives to fulfil an order. This Policy applies to Orderly websites, dashboards, product links and support interactions.

2. Data we collect

• Identity and account data: name, email, phone, authentication status and role.
• Seller data: business details, address, sales profile, legal name, registration information, verified bank name and masked account details.
• Order data: customer name, email, phone, delivery address, selections, answers, notes and fulfilment history.
• Payment metadata: references, requested and charged amounts, fees, status, timestamps, channel, gateway response, refunds, disputes and settlements. Orderly does not receive full card details.
• Technical and security data: IP address where supplied by providers, browser/device information, logs, event signatures, timestamps and fraud signals.
• Communications, consent records, policy acceptance, support messages and administrative audit events.

3. Purposes and lawful bases

• Perform contracts and provide accounts, orders, payments, settlement and support.
• Meet legal obligations involving accounting, tax, fraud, disputes, regulatory requests and data rights.
• Pursue legitimate interests in securing the platform, preventing abuse, improving reliability, reconciling money and communicating operational information.
• Use consent where required for optional marketing or non-essential technologies; consent may be withdrawn without affecting earlier lawful processing.

4. Sharing and processors

We share only what is reasonably necessary with sellers and customers involved in an order, Supabase for database/authentication/storage, Vercel for application hosting, Paystack for payments, bank verification and settlements, configured email providers for transactional messages, professional advisers, and authorities where lawfully required. Providers may process data outside Nigeria subject to appropriate contractual and legal safeguards. We do not sell personal data.

5. Security

• Role and ownership access controls, private order tokens and server-only financial mutations.
• Encrypted transport, managed infrastructure, restricted secrets, webhook signatures, logging and immutable financial records.
• Data minimisation, masked bank details and provider-hosted card entry.
• Incident assessment and notification where required by applicable law.

6. Retention

The Data Retention Policy is incorporated here. Account/profile data is kept while active; closed accounts are de-identified where feasible. Financial, tax, refund, settlement, fraud and dispute records may be retained for at least seven years or longer when law, litigation, investigation or provider obligations require. Security logs are retained only as long as reasonably necessary.

7. Your rights

• Request access to and a copy of your personal data.
• Request correction of inaccurate or incomplete data.
• Request deletion where no legal or legitimate retention ground applies.
• Object to or restrict certain processing and withdraw consent.
• Request portability where technically applicable.
• Complain to us or the Nigeria Data Protection Commission.

8. Children and sensitive information

Orderly is not intended for children under 18. Do not place passwords, full card data, government identifiers, health information or other unnecessary sensitive data in order notes or product questions.

9. Automated decisions and changes

Orderly may use rules to flag suspicious payments, settlement changes or account risk, but material restrictions should be reviewable by an authorised person. We will publish and date material Policy updates and provide additional notice where required.