NDPR & GDPR Compliance

Nigeria

Lawful basis for processing

We process personal data under the lawful bases of contractual necessity (to operate your store), legitimate interest (platform security and improvement), and consent (marketing communications).

Data Controller registration

Shopinbos Inc. is registered as a Data Controller with the National Information Technology Development Agency (NITDA) in compliance with NDPR Article 2.1.

Third-party processors

All third-party data processors (Paystack, AWS, Twilio) are bound by data processing agreements that require NDPR-equivalent protections.

Data Protection Officer

Our DPO can be reached at dpo@shopinbos.com for any NDPR-related enquiries or complaints.

Breach notification

In the event of a data breach affecting Nigerian users, we will notify NITDA within 72 hours and affected users within 7 days, as required by NDPR.

European Union & UK

Legal basis

Contractual necessity, legitimate interest, and consent. Marketing emails require opt-in consent and include a one-click unsubscribe.

International transfers

Data transferred from the EU to our Nigerian servers is covered by Standard Contractual Clauses (SCCs) approved by the European Commission.

Your rights under GDPR

Access, rectification, erasure ("right to be forgotten"), portability, restriction, objection, and rights related to automated decision-making. Exercise these at privacy@shopinbos.com.

Response time

We respond to GDPR data subject requests within 30 days. Complex requests may take up to 90 days -- we will inform you if an extension is needed.

Supervisory authority

EU users may lodge a complaint with their local data protection authority. UK users may contact the Information Commissioner's Office (ICO).