Privacy Policy

1. Introduction

TrackLit ("we", "us", "our") respects your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use, share and protect it, and the rights you have under the Nigeria Data Protection Act 2023 ("NDPA") and other applicable laws. It applies to everyone who visits tracklit.name.ng or uses the TrackLit Platform, including Business Owners, Staff Members and Buyers.

For the data we hold about our Users and website visitors, TrackLit is the data controller. For the personal data of your own customers, suppliers and staff that you enter into the Platform, you are the data controller and TrackLit acts as your data processor, handling that data only on your instructions and to provide the service.

Data Protection contact: info@tracklit.com.ng

2. Information We Collect

2.1 Information you give us

• Account details: name, email address, password (stored in protected form), phone number, and business name.
• Business profile: business name, address, logo, signatures, warranty text, branding and store settings.
• Business Data: sales, invoices, receipts, expenses, payments, balances, inventory, product details, IMEI or serial numbers, supplier information and goods ledgers, and reports.
• Customer and supplier records you add: names, phone numbers, addresses, purchase history and amounts owed.
• Staff details: names, emails, roles and activity records (for example, which Staff Member recorded a sale).
• Storefront and order data: buyer name, phone number, delivery address, order items, delivery choice and order status.
• Support communications: messages you send us by email or WhatsApp, and any files you share.

2.2 Information collected automatically

• Device and usage data: IP address, browser type, device type, operating system, language, pages and features used, time and date of access, and error logs.
• Cookies and local storage: small files or browser storage used to keep you signed in, remember preferences and keep the Platform working (see Section 8).

2.3 Information from third parties

We may receive limited information from service providers (for example, authentication, hosting or payment providers) to confirm sign-ins, process payments and keep the Platform secure.

2.4 Sensitive data

We do not intentionally ask for sensitive personal data (such as health, religion, political opinions, biometric data or national ID numbers). Please do not enter such data into the Platform unless necessary and lawful. If we introduce identity verification or payment features that need such data, we will tell you first and collect it only as the law allows.

3. How We Use Your Information and Our Lawful Bases

We do not sell your personal data.

4. How We Share Your Information

We share personal data only where necessary:

• Within your Business: Business Owners and Staff Members can see Business Data according to the roles and permissions the Business Owner sets.
• Storefront and Marketplace: information you choose to publish (such as business name, logo, product listings and prices) is public. When a Buyer places an order, their order details are shared with that Business.
• Service providers (processors): trusted companies that help us run the Platform, such as cloud hosting and database providers, email and messaging services, analytics and error-monitoring tools, and payment processors. They may use data only to provide services to us and must protect it.
• Professional advisers: lawyers, accountants and auditors, under confidentiality.
• Legal and safety: courts, regulators, law enforcement or other authorities where the law requires, or where needed to protect rights, safety or property, or to investigate fraud or abuse.
• Business transfers: if TrackLit is involved in a merger, acquisition or sale of assets, data may be transferred, and we will tell you if your data becomes subject to a different privacy policy.
• With your direction: when you ask us to share something, for example by sharing a receipt or opening a WhatsApp reminder. Once you share content through WhatsApp or other third-party apps, those services' own privacy terms apply.

5. International Data Transfers

Our service providers may store or process data on servers outside Nigeria. Where personal data is transferred outside Nigeria, we take steps required by the NDPA to make sure it receives an adequate level of protection, such as relying on adequacy decisions, contractual safeguards or other approved mechanisms.

6. Data Retention

• We keep your account and Business Data while your account is active and as long as needed to provide the Platform.
• If you close your account, we will delete or anonymise your personal data within [90] days, unless we must keep certain data longer to comply with law (for example, tax, accounting or anti-fraud requirements), resolve disputes or enforce our agreements.
• Backups may persist for a limited period before being overwritten.
• Server and security logs are kept for a limited period needed for security and troubleshooting.

7. Data Security

We use reasonable technical and organisational measures to protect personal data, including sign-in protection, store-level permissions and role-based access, encryption of data in transit, access controls and monitoring, and secure hosting. No online system is completely secure, so we cannot guarantee absolute security. You help protect your data by using a strong password, not sharing login details, signing out on shared devices and managing Staff access carefully.

If a personal data breach occurs that is likely to put your rights and freedoms at risk, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware, and notify affected users without undue delay, as required by the NDPA.

8. Cookies and Similar Technologies

We use cookies and browser storage to keep you signed in, remember your settings and store your business or store selection, support the "add to home screen" experience, understand how the Platform is used, and keep it secure. You can control cookies through your browser settings. Disabling essential cookies or storage may stop the Platform from working properly.

9. Your Rights

Under the NDPA and other applicable law, you have the right to:

• be informed about how we use your data (this Policy);
• access the personal data we hold about you and get a copy;
• correct inaccurate or incomplete data;
• delete your data, subject to legal retention duties;
• restrict or object to certain processing, including direct marketing;
• data portability, to receive your data in a commonly used format and ask us to transfer it where technically possible;
• withdraw consent at any time where we rely on consent (this will not affect earlier lawful processing);
• not be subject to solely automated decisions with legal or similarly significant effects (we do not currently make such decisions); and
• lodge a complaint with the Nigeria Data Protection Commission (https://ndpc.gov.ng).

To use these rights, contact us at [privacy email]. We may need to verify your identity first, and we will respond within the time required by law, generally within one month.

If you are a customer, supplier, staff member or Buyer of a Business using TrackLit, please contact that Business first, because it controls your data. We will help the Business respond to your request where appropriate.

10. Your Responsibilities as a Business Owner

If you store personal data of your customers, suppliers, Staff Members or Buyers in TrackLit, you must:

• collect and use it lawfully, fairly and for specific purposes;
• tell those people how you use their data (for example, a short privacy notice at your shop or Storefront);
• collect only what you need and keep it accurate;
• get consent where required, especially before sending marketing messages;
• respond to their requests to access, correct or delete their data; and
• protect the data and limit access to authorised Staff.

To the extent we process this data on your behalf, we will only act on your documented instructions, keep it confidential, keep appropriate security measures, help you meet your obligations under the NDPA, and delete or return it when you ask or when your account ends (subject to law).

11. Children's Privacy

The Platform is intended for business owners and users aged 18 and above. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Third-Party Links and Services

The Platform may link to or work with third-party websites and apps (such as WhatsApp or a Business's own social pages). We do not control those services and are not responsible for their privacy practices. Please read their policies.

13. Marketing Choices

You can unsubscribe from marketing emails or messages using the link in the message or by contacting us. Service and security messages will still be sent while you have an account.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new "Last updated" date and notify you of material changes by email or in the Platform.

15. Contact and Complaints

TrackLit Privacy email: info@tracklit.com.ng
WhatsApp support: +234 813 876 7772

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Nigeria Data Protection Commission at https://ndpc.gov.ng.