Policy
Privacy notice
Last updated 14 October 2026
In short: we collect only what we need to deliver your order. We do not sell it or use it for advertising. You can see it, correct it, download it or delete it.
Who we are
Buylow Marketplace Limited runs the Buylow online store. We decide why and how your personal data is used, so we are the data controller under the Nigeria Data Protection Act 2023 (the Act). Our address is Ilorin, Kwara State, Nigeria. You can reach us at buylowmarketplace@protonmail.com or on WhatsApp from the store page.
Our data protection contact is the email address above.
What we collect
| What | When we collect it |
|---|---|
| Name, WhatsApp number, delivery state and street address | When you place an order, as a guest or as an account holder. These are needed to deliver the order. |
| Email address | Required for an account, so we can send your sign-in code. Optional for a guest order, for the receipt. |
| Order details | Items, quantities, prices, the service fee, any discount code, delivery fee, payment reference and order status. |
| Account record and consent | When you create an account: the date you agreed to this notice and the version you agreed to. |
| Saved items, bag and delivery state | While you use the store. These are kept in your browser, not on our servers (see cookies below). |
| Network address (IP) | Each time you send a request to the store, for a short time, to stop repeated or abusive requests. |
| Messages on WhatsApp | When you message us on WhatsApp. These are handled in WhatsApp, outside our store systems. |
We do not ask for, and do not store, card numbers, bank passwords, date of birth or your exact location. Payments are taken by Paystack on its own page. We receive only the confirmation and the amount.
Why we use it, and our legal basis
| Purpose | Basis |
|---|---|
| Taking, confirming and delivering your order; tracking it | Performing our contract with you |
| Sending your sign-in code, receipts and order updates | Performing our contract with you |
| Keeping order and accounting records | Legal obligation |
| Creating an account | Your consent, given when you tick the box. You can withdraw it by deleting your account. |
| Stopping fraud and abuse, and keeping the store secure | Our legitimate interest, weighed against your rights |
We do not use your information for advertising, and we do not sell it.
Who we share it with
We share only what each partner needs to do its job:
- Delivery partners: your name, WhatsApp number, address and the items being delivered.
- Our email provider (Resend): sign-in codes, receipts and order updates. Its servers may be outside Nigeria.
- Payment providers: only if card payments are offered (Paystack or Monnify). They take the payment and confirm it to us. We never see card details.
- Our hosting provider: stores the store's data on secure servers.
- Authorities: where the law requires it.
How long we keep it
| Information | How long we keep it |
|---|---|
| Guest orders: name, WhatsApp number, address and email | 24 months from the order date. After that these personal details are removed. The order number, items and amounts stay, for accounting. |
| Account details | Until you delete your account. Deleting it removes your personal details from your orders; the order amounts stay. |
| Sign-in codes | 15 minutes, or until used, whichever is sooner. |
| Network addresses used to limit requests | 24 hours. |
| Backups | 30 days. |
| Staff activity log | Kept while needed to keep the store secure and to account for changes made by staff. |
Once a period ends, we delete the information, or remove the personal details from it where we keep the rest of the record.
Your rights
Under the Act you can ask us to:
- see the personal information we hold about you;
- correct information that is wrong;
- delete your information, or limit how we use it;
- give you a copy of your account and orders in a usable form;
- object to a use based on our legitimate interest; and
- withdraw consent you have given, such as for creating an account.
Signed-in customers can download a copy of their data, and delete their account, from the Account page. For anything else, email buylowmarketplace@protonmail.com. We may ask you to confirm who you are before we act, and we will tell you if we cannot do what you ask and why.
How we protect it
- The store is served over HTTPS.
- Sign-in codes are stored only in scrambled form, and are deleted once used or expired.
- Staff sign in with a password and an authenticator code, and see only the information their role needs. Customer details are visible only to the roles that need them for an order.
- Every change staff make is recorded in an activity log.
- Backups are encrypted.
Cookies and browser storage
The store keeps your bag, saved items, delivery state and last order in your browser's local storage, so they are there when you come back. A session cookie keeps you signed in to your account and is removed when you sign out or your session ends. We do not use advertising or tracking cookies, and the store loads no third-party analytics or advertising scripts.
Children
The store is for adults who can place orders. If you believe a child has given us personal information, email us and we will delete it.
Changes to this notice
We will update this notice if how we handle information changes. The date at the top shows when it last changed, and we will tell account holders by email about material changes.
Complaints
If you are not satisfied with how we handle your information, please tell us first at buylowmarketplace@protonmail.com. You also have the right to complain to the Nigeria Data Protection Commission.