DOROKI COMMERCE LIMITED

PRIVACY POLICY

1.   INTRODUCTION

1.1     Doroki Commerce Limited (“We”, “Us”, “Our”, “Doroki”) is the operator of an e-commerce platform consisting of a website ( www.doroki.com(“Website”) and mobile application (together the “Platform”span ) which provides an all-in-one point-of-sale solution to aid merchants manage billing, inventory, credit sales, payments, Khata (digital ledger), eStore, Customer Relationship Management (CRM) and loyalty Programs (the “Service” or “Services”).

1.2     Doroki is committed to protecting the privacy of all personal data provided to us in the course of your use of our Services and have set out in this privacy policy (“Privacy Policy”)the manner in which We collect, use, store, share, and protect personal data from users who engage our Platform or Services, as well as the rights you may have in respect of your own personal data.

1.3     We will not use or share your information with anyone except as described in this Privacy Policy

1.4     By browsing through, accessing or using Our Platform or Services, you agree to Our collection and use of your personal data in accordance with this Privacy Policy and our Terms of Use available at Terms of Service . Once you provide consent, you may change your mind and withdraw the consent at any time by contacting Us at privacy@doroki.com,but please note that consent withdrawal will not affect the lawfulness of any processing carried out before you withdraw your consent.

2.     INFORMATION COLLECTION AND USE

2.1.   The scope of personal data We may collect from persons using our Services include:

2.1.1. All personal data obtained from natural persons who use the Platform.

2.1.2. Information provided to us while making an enquiry on the use of the Service.

2.1.3. Information provided to us while reporting a problem or making a complaint about the Service.

2.2.   The specific types of personal data that We may collect, use and store are as follows:

2.2.1.   “Identity Data”: This includes profile name, phone number, address, email address, business information, profile picture, and any other data we may require to identify you.

2.2.2.  “Account Information”: This includes information such as usernames and passwords, authentication methods and roles, and similar data.

2.2.3. “Technical Data”: This includes information collected when you access Doroki’s Services, your internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you are using.

2.2.4. “Transaction Information”: Details of purchases, payments and account activity.

2.2.5. “Marketing and Communication Data”: This includes data relating to your preferences in receiving newsletters with respect to Our products and Services from us as well as your communication preferences.

2.3.   We may also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data may be derived from your personal data but is not considered personal data as this data does not reveal your identity. For example, We may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if We combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, We treat the combined data as personal data which will be used in accordance with this Privacy Policy.

2.4.   When you are asked to provide personal data, you may decline, and you may use web browser or operating system controls to prevent certain types of automatic data collection. However, where We need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, We may not be able to perform the contract We have or are trying to enter into with you (for example, to provide you with, or receive from you, goods or services). In which case, We may have to cancel the Service, but we will notify you if this is the case at the time.

3.   WHY WE COLLECT PERSONAL DATA

We collect personal data to:

3.1.   be able to communicate with you, to provide further information on Our Services, and to assist you in your experience with Our Services;

3.2.   respond to questions or requests which you submit as well as anticipate and resolve problems with any services We offer to you;

3.3.   process transactions and facilitate payments;

3.4.   collect information to be able to communicate with you for advertisements, promotions, offers, any other sponsored content that Doroki and its group companies may display on the Platform or any other marketing channels, including its digital channels, television, print and publication, without requiring any further consent from you and without being required to pay any compensation to you;

3.5.   comply with legal and regulatory requirements;

3.6.   to monitor and prevent fraudulent activity;

3.7.   resolve disputes that may arise; and

3.8.   any other purpose that We disclose to you in the course of providing our Services to you.

4.     HOW WE COLLECT YOUR PERSONAL DATA

We use different methods to collect data from and about you including through:

4.1.   Direct collection: This is for information you provide when creating an account, contacting Us, or using Our Services. You may give Us your data by filling in forms (e.g., the contact form on our website); creating your profile; by correspondence and conversations (including via email and telephone); or through contracts We may enter with you.

4.2.   Automated technologies:As you interact with Our Platform or Services, We will automatically collect data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies. We collect such data to be able to properly provide you with Our Services.

4.3.   Third parties or publicly available sources: We also receive your personal data from third parties to whom you have legally provided such data to. We may retrieve information from public sources such as open government databases. To the extent that such data is disclosed by third parties, different rules may apply to their use or disclosure of your information. We do not control how they use or share your data, and We cannot make any representations or warranties as to these. Doroki will not accept any responsibility for any loss or damage in whatever manner resulting from your disclosure of your personal data to third parties. However, Doroki shall also make all reasonable efforts to ensure that adequate safeguards have been put in place to prevent unauthorized access and to ensure confidentiality of your personal data. We, however, have control over data that you have voluntarily shared with Us directly or through your usage of Our Platform. With your consent, we use your information to fulfill requests to receive information or materials from us, to carry out Services for your benefit and to process applications and requests from you. We do not use your data for any other purpose than for the purposes listed out in this policy.

5.     LAWFUL BASIS FOR OUR USE OF YOUR PERSONAL DATA

5.1.   We will use your personal data only to the extent permitted by law. Under the Nigeria Data Protection Act 2023 (NDPA), personal data may be processed under any of the following lawful basis:

6.1.1.  where you consent to Our use of your personal data;

6.1.2.  where your personal data is necessary for the performance of the contract to use Our Services;

6.1.3.  where We need to comply with a legal obligation;

6.1.4.  where We need to protect your vital interest or the vital interest of another individual;

6.1.5.  where it is in the interest of the public to process your personal data.

5.2.   While We mostly collect and process your personal data with your consent, We may collect and process your personal data under any of the identified lawful bases depending on the circumstance. You are at liberty to withdraw your consent to such kinds of processing at any time. Where such withdrawal makes us unable to proceed with providing you with certain Services, We will inform you accordingly.

6.   DISCLOSURE OF YOUR INFORMATION

We may disclose your personal data:

6.1.   To any of Our affiliates and third-party service providers, including payment processors aga for transaction facilitation.

6.2.   To third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligation or law enforcement investigations., or in order to enforce or apply our Terms of Use and other agreements; or to protect our rights, property, or safety or those of other users our clients or others.

6.3.   in the event of a merger, acquisition or sale of assets.

6.4.   with your consent when you authorise specific sharing.

6.5.   if We believe it is necessary to help prevent the loss of life or serious injury of anyone, or other exceptional circumstances.

7.     COOKIES

7.1.   Cookies are small text files placed by a website and stored by your browser on your device. We use cookies to remember visitors to Our Website and provide a better user experience. You will be asked to accept or reject cookies. If you choose to reject cookies, you may not be able to access every function and service on the Website. Most web browsers are set to accept cookies by default. If you prefer, you can go to your browser settings to learn how to delete or reject cookies.

8.     DATA SECURITY

8.1.   We will take reasonable steps to protect personal data disclosed to Us against loss, modification, misuse, unauthorised access and/or disclosure. While we do our best to protect your personal data, we cannot guarantee the security of your data transmitted to Us over the internet as transmission over the internet is not completely secure; therefore, We note that any such transmission is at your own risk. However, We will use strict procedures and security features to try to prevent unauthorised access once We have collected your information. We are bound by international standards and best practices on information and cyber security as may be issued from time to time.

8.2.   The security of your Doroki account relies on the protection of your username, email address, Personal Identification Number (PIN) or password. You should never share any of the aforementioned with anyone. No employee of Doroki will ever request your PIN, password and any email or correspondence asking for this information should be treated as unauthorised and suspicious. If you receive such a request, please forward it immediately to privacy@doroki.com.  We will make every effort to respond to such reports promptly.

9.     DATA RETENTION

9.1.   We retain your personal data for such a period as is necessary for the purpose for which it was collected. Storage of your data is also determined by legal, regulatory, administrative, or operational requirements. We only retain information that allows Us to comply with legal and regulatory requests for certain data, meet business and audit requirements, respond to complaints and queries, or address disputes or claims that may arise. When data is no longer required for the purposes for which it was collected, We securely destroy it.

9.2.   All personal data, including any contact information you provide or grant us access to, is stored securely on Our servers, as well as in secure physical locations and cloud infrastructure (where applicable). This ensures seamless delivery of Our Services, including but not limited to business continuity.

10.   THIRD PARTY SITES

Our website, and Services may contain links to third-party websites, products, and services. Our products and Services may also use or offer products or services from third parties. Information collected by third parties, which may include such things as location data or contact details are governed by their privacy practices and We will not be liable for any breach of confidentiality or privacy of your information on such third-party websites. We encourage you to learn about the privacy practices of such third parties.

11.    PRIVACY POLICY CHANGE

We may modify this Privacy Policy from time to time without prior notice by publishing a new version of the Privacy Policy on Our Platform. Any changes to the Privacy Policy will be reflected on Our Platform and will become effective immediately upon publication. We encourage you to periodically review this Privacy Policy to stay informed about how We are protecting the personal data We collect. If changes to the Privacy Policy are material, We will do our best to notify you via email or through a notification on our website.

12.     TRANSFER OF PERSONAL DATA

12.1.   As part of our service provision, we may rely on third-party servers, databases co-located with hosting providers, resident in foreign jurisdictions, which constitutes the transfer of your personal data to computers or servers in foreign countries. We take steps designed to ensure that the data we collect under this Privacy Policy is processed and protected according to the provisions of this Policy and applicable law wherever the data is located.

12.2.   Where personal data is to be transferred to a country outside Nigeria, Doroki shall put adequate measures in place to ensure the security of such personal data. Any transfer of Personal data out of Nigeria will be in accordance with the provisions of the NDPA. In addition, Doroki shall use contractual terms to ensure protection of the data or ensure the country has adequate data protection laws as required under the NDPA. Furthermore, we can transfer when we have a legal obligation, need to establish or defend a legal claim, or there is a public interest obligation.

12.3.   Should We wish to transfer personal data to a country deemed to have inadequate data protection laws, Doroki will take all necessary steps to comply with the NDPA, including ensuring that informed consent is obtained from you, and you are aware of the risks entailed with such transfer. In any instance, Doroki will ensure personal data is transmitted in a safe and secure manner. Details of the protection given when your personal data is transferred abroad, and details of the basis of such transfers shall be provided to you upon request.

13.     YOUR LEGAL RIGHTS

In addition to being able to control the data you directly provide to Us; you may exercise any of the below rights with respect to your personal data:

13.1.1.   Request information about any of your personal data which we are processing,

13.1.2.  Right to request for and access any personal information collected and stored by Doroki;

13.1.3.   Right to be informed regarding their personal information;

13.1.4.  Right to object to automated decision making and processing;

13.1.5.  Right to request rectification and modification of personal information which Doroki keeps;

13.1.6.  Right to request the deletion of their data;

13.1.7.  Right to request the movement of data from Doroki to a third party - this is the right to the portability of data;

13.1.8.  Right to revoke consent;

13.1.9.   Right to object to direct marketing, and to request that Doroki restricts the processing of their information; and

13.1.10. Right to submit a complaint to the Nigeria Data Protection Commission (NDPC).

14.   POLICY VIOLATIONS

Any violation of this Privacy Policy should be brought to the attention of Our Data Protection Officer (Alimi Adeyemi) for appropriate sanctioning and treatment.

Contact Details

Name or title of Data Protection Officer : Alimi Adeyemi

Email address: privacy@doroki.com

Telephone number: 09090197869

If you have any questions about this privacy policy or our privacy practices, please contact us using the details provided above. Your request will be treated by Our Data Protection Officer within a 30-day period from the date of receipt.