Privacy Policy

Indosabest Limited is a Nigerian-registered technology company operating an online peer-to-peer marketplace that connects buyers and sellers across all 36 states and the FCT. Our platform features escrow-protected payments, NIPOST-integrated delivery, and a regulated seller onboarding system.

• Full legal name, username, and email address
• Phone number and date of birth (for age verification)
• Profile photograph (optional)
• Password — stored as a one-way bcrypt cryptographic hash; never readable

• Delivery addresses — street, city, LGA, state, and postal code
• Order history, product details, quantities, and order status
• Wallet top-up and transaction records
• Dispute filings and refund request history
• Product reviews and ratings submitted

Sellers provide significantly more information during onboarding due to our Know Your Business (KYB) obligations. All business documents are detailed in Sections 3, 4, and 5.

• IP address, browser type, version, and operating system
• Pages visited, session duration, referral source, and clickstream data
• Device identifiers and city-level geolocation
• Cookies and similar tracking technologies (see Section 11)

• In-platform messages between buyers and sellers
• Support tickets, emails, and live chat transcripts
• Dispute evidence, photos, and documents submitted

All sellers on Indosabest must complete a comprehensive Know Your Business (KYB) and Know Your Customer (KYC) verification process before listing products. This is mandatory to protect buyers, combat fraud, and ensure regulatory compliance with Nigerian law.

Verification is conducted in partnership with relevant Nigerian regulatory bodies including the CAC, NAFDAC, PCN, SON, EFCC, FIRS, CBN, and other sector-specific authorities. Indosabest may cross-reference submitted documents with official registries at any time.

• Board Resolution — a duly signed and sealed resolution authorising named individual(s) to register, operate, and transact on behalf of the company on the Indosabest platform
• CAC Form CO2 — Allotment of Shares (to identify beneficial owners with 5%+ shareholding)
• CAC Form CO7 — Particulars of Directors (current and complete)
• Memorandum and Articles of Association (MEMART) — certified true copy
• Certificate of Commencement of Business (for public limited companies)
• Audited Financial Statements for the last 2 financial years (mandatory for businesses with annual turnover above ₦25 million)
• Shareholders' Register (where applicable)

• CAC Business Name Registration Certificate
• Two recent passport photographs of the proprietor
• NIN (National Identity Number) and NIN slip
• Personal bank statement — last 3 months (for high-volume sellers)

In addition to the documents in Section 4, sellers in regulated product categories must provide the following sector-specific licences and permits. Indosabest will verify these against official regulatory databases where available.

• NAFDAC Registration Number & Certificate for each packaged food, food supplement, or beverage product listed
• SON (Standards Organisation of Nigeria) Certification for processed or manufactured food products
• State Ministry of Health Food Handler's Certificate for businesses involved in food processing or preparation
• HACCP (Hazard Analysis Critical Control Point) Certification — required for mid-to-large scale food manufacturers
• Business Premises / Operational Certificate from Local Government Authority (LGA)
• Food Safety Management System (FSMS) Documentation
• Market Trader's Licence from the relevant market authority (for market-based food sellers)

• PCN (Pharmacists Council of Nigeria) Registration Certificate — mandatory for any business selling pharmaceutical products
• NAFDAC Registration Certificate for each individual drug, supplement, or medical device product listed
• Pharmacist-in-Charge Details — full name, PCN registration number, and practising licence
• PCN Premises Inspection Certificate — valid for the business location
• Drug Wholesale or Retail Licence from the relevant State Ministry of Health
• NAFDAC Import Permit for any imported pharmaceutical or medical products
• Product Dossier or Registration Summary for each listed pharmaceutical product
• Good Distribution Practice (GDP) Certificate for pharmaceutical distributors

• Farm Registration Certificate from the relevant State Ministry of Agriculture
• NAFDAC Agro-Chemical Registration Certificate for pesticides, herbicides, fertilisers, or other agro-chemicals
• NAQS (Nigeria Agricultural Quarantine Service) Phytosanitary Certificate — for interstate movement or export of plant products
• SON Product Certification for standardised agricultural commodities
• Organic Certification from an accredited certification body (e.g., ECOCERT, Control Union) — required for any product marketed as organic
• USDA / CODEX Phytosanitary Certificate (for export-grade products)
• NSPFS (National Plant Protection & Food Safety) Permit where applicable
• Cold Chain Compliance Documentation for perishable agricultural products requiring temperature-controlled logistics

• NAFDAC Cosmetics Registration Certificate per individual product SKU
• Safety Assessment Certificate from a recognised cosmetic safety assessor
• SON Certification where applicable

We process your personal data only where we have a lawful basis to do so, as defined under the NDPA 2023:

We do use automated decision-making or profiling in ways that produce output with human review.

• NIPOST: Buyer delivery address and order reference number, for shipping and delivery
• Tracking API: Tracking number and courier data, for real-time delivery status updates
• Payment Processors Transaction data for wallet top-ups and payment processing
• CAC, NAFDAC, PCN, SON, FIRS, CBN: Seller business documents during verification or upon regulatory request
• Law Enforcement Agencies: Only when compelled by a valid Nigerian court order, EFCC warrant, or regulatory directive
• Fraud Prevention Services: Anonymised or pseudonymised risk-scoring data only
• Cloud Infrastructure Providers: Data stored on secure servers; processors are contractually bound by data processing agreements and must meet NDPA-equivalent standards

Our escrow system holds buyer payments securely until NIPOST confirms delivery. The following data is collected and retained in connection with every escrow transaction:

• Order value, item description, and quantity
• Buyer wallet balance, deduction record, and payment timestamp
• Seller bank account or wallet details for fund disbursement
• NIPOST tracking number linked to the escrow record
• API delivery confirmation timestamp
• Dispute filings, refund decisions, and communication logs

All escrow and transaction records are retained for 7 years from the date of transaction, in compliance with CBN record-keeping directives and Nigerian tax law (CITA and FIRS regulations).

Upon account closure, data is anonymised or securely deleted beyond any legally mandated retention periods.

As a data subject under Nigerian law, you have the following rights, which you may exercise by contacting our DPO (see Section 15). We will respond within 30 days as required by the NDPA 2023.

We use cookies and similar technologies to operate the platform, remember your preferences, and measure performance. You may manage cookie preferences through your browser settings at any time.

• All data transmitted via TLS 1.2+ (HTTPS) encryption — plaintext transmission is never permitted
• Passwords stored using bcrypt one-way hashing — irreversible and never stored in plaintext
• Business and identity documents stored in AES-256 encrypted, access-controlled cloud storage
• Payment data processed exclusively by PCI-DSS compliant processors
• Access to user data limited to authorised personnel on a strict need-to-know basis, with audit logs
• Regular security audits and penetration testing conducted by independent third parties
• Multi-factor authentication (MFA) available and encouraged for all seller accounts
• In the event of a data breach, affected users and the NDPC will be notified within 72 hours, as required under NDPA 2023 Section 40

The Indosabest Marketplace is intended exclusively for users who are 18 years of age or older. We do not knowingly collect personal data from minors. If you believe a minor has created an account or submitted personal data, please contact us immediately at privacy@indosabest.com. We will investigate and delete such data without delay.

We may update this Privacy Policy periodically to reflect changes in law, platform features, or our data practices. Material changes will be communicated via email notification and a prominent banner on the platform at least 14 days before taking effect. Minor clarifications may be made without advance notice. The "Last Updated" date at the top of this document always reflects the most recent revision. Continued use of the platform after the effective date constitutes your acceptance of the revised Policy.

For all privacy-related enquiries, data subject access requests, complaints, or document-related queries:

You also have the right to lodge a complaint directly with the Nigeria Data Protection Commission (NDPC): ndpc.gov.ng