Paylesa Privacy Policy

Effective date: 27 July 2026 1. SCOPE This Privacy Policy explains how Paylesa collects, uses, discloses, stores, and protects personal data when you use the Paylesa mobile application, website, marketplace, vendor tools, support channels, payment features, discount features, and related services. For the processing described in this Policy, Paylesa acts as a data controller where it determines why and how personal data is processed. A vendor, payment provider, logistics provider, or other partner may separately act as a controller for processing it determines. 2. DATA WE COLLECT Depending on how you use Paylesa, we may collect: Identity and account data, including name, username, date of birth where supplied, profile image, account role, Firebase or authentication identifier, and verification status. Contact and delivery data, including email address, telephone number, delivery address, landmark, city, state, country, and delivery instructions. KYC and vendor data, including identity-document details, selfie or verification images, proof of address, business information, CAC or other registration details, store information, bank or payout information, and compliance-review records. Order and transaction data, including products viewed or purchased, vendor, quantity, price, discounts, payment reference and status, shipping details, order history, returns, refunds, payout records, reviews, support cases, and dispute evidence. Payment data. Payments are processed by Paystack or another provider displayed in the service. Paylesa may receive a payment reference, masked card details, card type, issuing bank, amount, status, and fraud indicators. Paylesa does not intentionally store a full payment-card number or card security code. Device, technical, and usage data, including IP address, device type, operating system, app version, language, push-notification token, session and security events, crash information, pages and products viewed, search activity, and interaction with features. Communications and content, including messages to Support, survey responses, reviews, vendor responses, uploaded images or videos, return evidence, and other information you send to us. 3. HOW WE USE DATA We process personal data to create and secure accounts; provide customer and vendor services; verify identity and eligibility; display and fulfil orders; process and reconcile payments; coordinate delivery; operate returns, refunds, settlements, and payouts; provide spins and discounts; personalise product discovery; communicate service updates; respond to support requests; prevent fraud and abuse; keep audit and accounting records; improve performance; and comply with legal and regulatory obligations. Our lawful bases may include performance of a contract, compliance with a legal obligation, your consent, protection of vital interests, performance of a task in the public interest where applicable, and legitimate interests that are not overridden by your rights. Where we rely on consent, you may withdraw it, but withdrawal does not invalidate earlier lawful processing. 4. AUTOMATED PROCESSING AND RISK CONTROLS Paylesa may use automated rules to detect unusual payments, account activity, return abuse, marketplace manipulation, or other risk. Where a solely automated decision produces a legal or similarly significant effect and the Nigeria Data Protection Act gives you a right to human intervention, you may contact Support to request review, express your position, or contest the decision. 5. SHARING We may share only the data reasonably necessary with: Vendors, to fulfil orders, respond to disputes, and provide marketplace support. Customer information available to vendors may be limited to what is operationally required. Payment and financial-service providers, including Paystack, banks, card schemes, and fraud-prevention partners. Logistics and delivery providers, including providers used to create waybills, coordinate drop-off, deliver orders, and process returns. Technology providers supporting authentication, cloud hosting, media storage, messaging, analytics, monitoring, security, and customer support. Professional advisers, auditors, insurers, and prospective transaction counterparties subject to appropriate confidentiality safeguards. Regulators, courts, law-enforcement agencies, or other persons where required by law, necessary to protect legal rights, or needed to prevent serious harm or fraud. We do not sell personal data in exchange for money. 6. INTERNATIONAL TRANSFERS Some service providers may process data outside Nigeria. Where personal data is transferred internationally, Paylesa will use a lawful transfer basis and appropriate safeguards required by the Nigeria Data Protection Act, considering the destination, recipient, and nature of the data. 7. RETENTION We keep personal data only for as long as reasonably necessary for the purposes described in this Policy, including service delivery, dispute handling, fraud prevention, tax, accounting, audit, and legal requirements. Retention periods vary by record type. When data is no longer required, it will be deleted, anonymised, or securely isolated, subject to lawful backup cycles. Closing an account does not require immediate deletion of records that Paylesa must retain for completed transactions, unresolved disputes, fraud prevention, regulatory compliance, or legal claims. 8. SECURITY Paylesa uses administrative, technical, and organisational measures designed to protect personal data, including access controls, authentication, encryption in transit where supported, audit records, monitoring, role-based permissions, and service-provider safeguards. No system is completely secure. You must protect your credentials and promptly report suspicious activity. If a personal-data breach creates a legally reportable risk, Paylesa will notify the Nigeria Data Protection Commission and affected data subjects as required by law. 9. YOUR RIGHTS Subject to applicable law and permitted limitations, you may request information about processing; access to your personal data; correction of inaccurate or incomplete data; deletion where there is no lawful reason to retain it; restriction of processing; objection to certain processing; withdrawal of consent; data portability where applicable; and human review of certain automated decisions. You may also object at any time to direct marketing. Use in-app preferences where available or contact Support. You have the right to lodge a complaint with the Nigeria Data Protection Commission. To protect your account, Paylesa may verify your identity before completing a rights request. Requests may be refused or limited where the law permits, and an explanation will be provided. 10. CHILDREN Paylesa is not intended for unsupervised use by children who cannot lawfully consent or contract. Parents and guardians should supervise use by minors. If you believe a child provided personal data without appropriate authority, contact Support. 11. DEVICE STORAGE, COOKIES, AND ANALYTICS The app and website may use cookies, local storage, secure device storage, SDK identifiers, and similar technologies for authentication, preferences, security, performance, analytics, and communications. See the Cookie Policy for details. 12. CHANGES AND CONTACT The Super Admin may publish an updated Policy when the service, processing, or law changes. The app displays the current version and publication date. Material changes may also be communicated through the app or your registered contact details. Privacy enquiries, data-rights requests, or complaints: support@paylesa.com. You may also contact the Nigeria Data Protection Commission through its official channels at ndpc.gov.ng.