Privacy Notice

These documents were prepared against the Nigeria Data Protection Act 2023 and the NDP Act General Application and Implementation Directive 2025 (GAID), in force from 19 September 2025. They have not yet been reviewed by a qualified legal practitioner and are not legal advice. They are published so that the Service is never operating without terms, and they are due for professional review.

Who we are

WeSelling is operated by WeSelling, TheBuidl, 10 Algeria Crescent, Barnawa, Kaduna 800283, Kaduna State, Nigeria. For questions about this notice, or to exercise any of the rights described below, contact team@weselling.store.

This notice is written to meet the Nigeria Data Protection Act 2023 and the NDP Act General Application and Implementation Directive 2025 (GAID), in force from 19 September 2025.

The two roles we act in

Our role under the Act depends on the processing, and it is not the same throughout. Saying we are only ever a processor would be convenient and untrue.

• We are a data controller for the personal data we process to run our own business: administering accounts, verifying who is signing in, taking payment, keeping the platform secure, investigating fraud and abuse, meeting our legal and tax obligations, and communicating with account holders about their accounts. This notice covers that processing.
• We are a data processor for the personal data a business puts into the Service about its own customers, staff and suppliers. That business is the controller; it decides what is collected and why, and we act on its instructions. Our Data Processing Agreement covers that processing.

What we collect, as controller

• Account details — your business name, your name, email address, phone number and password (stored only as a hash).
• Billing records — payments you make to us, and the balance movements that result.
• Stakeholder details — where an investor or adviser is given read access to our own platform figures, their name and email address, and when they last signed in.
• Integration credentials — the API keys, secrets and tokens you save so the Service can talk to your payment and messaging providers on your behalf. These are held so that they are not returned to any interface after being saved and are never written to logs or analytics.
• Security and audit logs — sign-in attempts, actions taken in the app and by whom, IP address, browser and device information, and error diagnostics. We use these to keep the Service running, to investigate misuse, and to answer the question of who changed what.
• Communications with us — support messages and the correspondence that follows them.
• Push notification subscriptions — only where you or your customer explicitly turns notifications on, and removed when that permission is withdrawn or the device stops accepting them.

Why we use it, and on what basis

• To provide the Service you signed up for — performance of our contract with you.
• To take payment and keep accurate billing records — performance of our contract, and our legal obligations for tax and accounting.
• To keep the Service secure and investigate misuse — our legitimate interests in protecting the platform and everybody on it, and our obligation under the Act to secure the personal data we hold.
• To contact you about your account, including billing and service notices — performance of our contract. These are not marketing and cannot be opted out of while you hold an account.
• To comply with the law, including responding to lawful requests from a regulator or a court.

We do not sell personal data, we do not use your business records to advertise to your customers, and we do not profile individuals for advertising.

Your customers' data

Where a business enters information about its own customers, that business decides what is collected and why. We process it on their instructions, we do not contact their customers on our own behalf, and we do not use their details for our own marketing. If you are the customer of a business using WeSelling and want to exercise a right over your data, ask that business — they are the controller, and we will support them in answering you.

Who we share it with

Only with the suppliers needed to run the Service, each of which processes data on our instructions under a written agreement. Our current categories of subprocessor are listed in our Data Processing Agreement, which names them and says what each one does. We do not sell personal data to anyone and we do not share it for anyone else's marketing.

Separately from this, the integrations you choose to enable send data to providers whose accounts are yours — your payment gateway, your messaging provider. Those providers are not our subprocessors; they act for you, under your agreement with them.

Where it is stored, and transfers out of Nigeria

Data is stored on servers in the European Union. Backups are encrypted.

This means personal data collected in Nigeria is transferred outside Nigeria. Under the Nigeria Data Protection Act 2023 such a transfer requires an adequate basis, and we rely on the recipient jurisdiction's own data protection regime together with contractual protections in our agreements with the suppliers concerned. Where you enable an integration whose provider is based elsewhere, that integration will also transfer data to wherever that provider operates, under your agreement with them.

How long we keep it

• Account and business records — for as long as you hold an account, and for 90 days after closure so they can be restored if you return, then deleted.
• Billing records — for as long as tax and company law require, which is longer than the period above.
• Security and audit logs — for as long as they are useful for investigating an incident, and no longer than we can justify.
• Integration credentials — until you replace or remove them, or the account is closed and its retention period ends.

Your rights

Under the Nigeria Data Protection Act 2023 you may ask us to:

• confirm whether we hold personal data about you, and give you a copy;
• correct it where it is wrong or incomplete;
• delete it, where we have no continuing basis to keep it;
• restrict or object to our processing of it;
• provide it in a portable form, where that right applies;
• withdraw a consent you previously gave, without affecting what was done before you withdrew it.

Business records you have entered can be exported from within the app at any time. For anything else, contact team@weselling.store. We will respond within the time the Act allows, and we will not charge you for a first request.

If you are not satisfied with how we have handled your data, you may complain to the Nigeria Data Protection Commission, or to another supervisory authority with jurisdiction over you.

Cookies

We use cookies that are strictly necessary to keep you signed in and to keep your session secure. We do not use advertising or third-party tracking cookies, and there is nothing here to consent to beyond what the Service needs to function.

A business using WeSelling may add its own analytics or marketing scripts to its own storefront. Those are that business's responsibility, under its own privacy notice, and it must obtain whatever consent the law requires.

Changes

If we change this notice materially we will tell you before the change takes effect.