Privacy Policy

Dream Marketplace Nigeria Ltd, the owner and operator of DreamShop, is the data controller responsible for your personal data. We are committed to processing data lawfully, fairly, and transparently in line with the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Regulation 2019, as supervised by the Nigeria Data Protection Commission (NDPC).

You can reach our Data Protection Officer (DPO) at privacy@dreamshop.com.ng for any privacy-related request or concern.

• Identity & contact data: name, email address, phone number, delivery and billing addresses.
• Account data: username, password (stored in hashed form), preferences, notification settings, and order history.
• Security data: two-factor authentication settings and, where you enable it, an encrypted authenticator secret used to generate verification codes.
• Transaction data: items purchased or sold, amounts, and delivery details. Card data is handled directly by CBN-licensed payment processors — we do not store your full card number. Where you save a payment method, we store only masked details (such as card type and last four digits) for your convenience.
• Location data: the state and city in your delivery addresses and, for sellers, your shop location (state and city). We use this to match buyers with the nearest sellers so delivery is faster and cheaper.
• Technical data: IP address, device and browser type, and cookie identifiers (see our Cookie Policy).
• Seller data: for sellers, business name, store name, bank/settlement details, and KYC documents required by law. Sensitive KYC and settlement fields are encrypted at rest where supported, while KYC documents are stored in access-controlled private storage and are not publicly served.
• Advertising data: the platform does not currently collect seller-created product advertising data because paid product advertising tools are not available.
• Communications: messages, reviews, complaints, and support requests you send us.

Under the NDPA 2023 we only process personal data where we have a lawful basis to do so:

• Performance of a contract: to create your account, process orders, arrange delivery, and provide support.
• Legal obligation: to meet tax, KYC, anti-money-laundering, and record-keeping duties under Nigerian law.
• Legitimate interests: to secure the platform, prevent fraud, match buyers with nearby sellers to reduce delivery cost and time, and improve our services, balanced against your rights.
• Consent: for marketing communications and non-essential cookies, which you may withdraw at any time.

We do not sell your personal data. We share it only as necessary with:

• Sellers and buyers, to complete and fulfil your orders (e.g. a seller receives the delivery address for your order).
• Logistics and delivery partners, to ship your items.
• CBN-licensed payment processors, to take payment and issue refunds.
• Service providers who host, secure, and support our platform under confidentiality obligations.
• Regulators, law enforcement, or courts where required by law or to protect our rights and users.

Where personal data is transferred outside Nigeria (for example to cloud service providers), we ensure an adequate level of protection through appropriate safeguards, such as contractual data-protection clauses, in accordance with the NDPA 2023 and NDPC guidance.

We keep your personal data only for as long as necessary to provide our services and to meet legal, accounting, and regulatory requirements (for example, transaction records retained for the period required by tax and financial-services law). Managed-cloud backups and disaster-recovery copies may persist for a limited period after deletion while they rotate out under the provider’s retention schedule. When data is no longer needed and no legal exception applies, we securely delete or anonymise it.

Under the NDPA 2023 you have the right to:

• Access the personal data we hold about you and request a copy.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data where there is no lawful reason to keep it.
• Object to or restrict certain processing, including direct marketing.
• Request portability of data you provided to us.
• Withdraw consent at any time, without affecting processing already carried out.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

We use technical and organisational measures such as HTTPS encryption in transit, slow password hashing, field-level encryption for selected sensitive KYC and settlement data, private document storage, access controls, rate limiting, abuse prevention, audit logging, and monitoring to protect your data against unauthorised access, loss, or misuse. Where enabled, CAPTCHA and multi-factor verification help protect registration and high-risk account actions. In the event of a personal-data breach that poses a risk to you, we will notify the NDPC and affected users as required by the NDPA 2023.

Our platform is hosted using managed cloud infrastructure and managed databases. These providers may apply encryption at rest and in transit, access controls, automated backups, point-in-time recovery, monitoring, and security patching as part of their services. We do not treat backups as a separate purpose for using your data; backups are retained only for business continuity, security, and legal requirements and are securely deleted or overwritten according to provider schedules and our retention obligations.

Our platform is not directed at children under 18. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact us and we will delete it.

We may update this Privacy Policy to reflect changes in law or our practices. The latest version will always be available on this page with an updated date.