Kantin Kwari Digital Market: Platform Privacy Notice
Issued by PeerPay Network and the Kantin Kwari Market Board. Version 1.0. Effective date: October 1, 2026
1. About this notice
1.1 This notice explains how personal data is collected and used when you use the Kantin Kwari Digital Market website, web app and related services (the "Platform"), whether you are a buyer, a vendor or a visitor. It is issued in line with the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive issued by the Nigeria Data Protection Commission (NDPC).
1.2 This notice should be read with the PeerPay Platform Terms of Service, the Marketplace Terms and the Cookie Notice. If you enrolled through the Kantin Kwari digitisation programme, the EARN Programme Privacy Notice also applies to the data EARN collects directly.
2. Who is responsible for your data
2.1 PeerPay Digital Assets Limited, trading as PeerPay Network (RC 1600947), of 30B Oriwu Street, Lekki Phase 1, Lagos ("PeerPay"), provides and operates the Platform. PeerPay is the data controller for your account, identity verification, transaction and payment instruction records, communications, security and fraud prevention data, and the Platform's technical and usage data. PeerPay is registered with the NDPC.
2.2 The Kantin Kwari Market Board, of [Market Board office address, to be confirmed] (the "Market Board"), owns the Marketplace. The Market Board is a separate data controller for the data it uses to regulate trading. This covers vendor trading registration and market membership, fees and levies, enforcement of market rules, and appeals to its Disputes Committee.
2.3 EARN Integrated Resources and Services Limited ("EARN"), the custodian of the digitisation programme, is a separate data controller for the data it collects to mobilise, enrol and train vendors, as described in the EARN Programme Privacy Notice. EARN receives data from the Platform only as set out in section 6.
2.4 Our partner bank, [Partner Bank name, to be confirmed], and our logistics partner, GIG Logistics, are separate data controllers for the data they process to provide their own services.
2.5 PeerPay provides a single point of contact for all questions and requests under this notice: the Platform Data Protection Officer, at [email protected], through the Help Centre, or by post to PeerPay at the address above. Where a request concerns another controller, PeerPay will pass it on and follow it up for you.
3. The data we collect
3.1 Some details are required to open an account, process an order or pay a vendor. We tell you on screen which details are required.
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, phone number, email address, delivery address, business name | You |
| Verification (vendors, and buyers at higher limits) | NIN, BVN (checked but not stored in full), CAC number, TIN, identity document, selfie or liveness image (if applicable) | You, verification providers, the Market Board and market associations |
| Vendor details | Shop block and number, association membership, bank account in your name, records of fees, levies and payments | You, the Market Board and associations, the Partner Bank, EARN (with your instruction) |
| Orders | Items bought or sold, prices, quotes, delivery details, order status, returns | You and the other party to the order |
| Payments | Payment reference, amount, payment method type, status, last four digits of card. Full card and bank log-in details are handled only by the Partner Bank and its processors | The Partner Bank |
| Delivery | Pickup and delivery addresses, recipient name and phone number, delivery status, proof of delivery | You, the Vendor, the Logistics Partner |
| Communications and disputes | Buyer–vendor messages, complaints, disputes, appeals, photos, support calls | You |
| Reviews and content | Ratings, reviews, product photos and descriptions | You |
| Technical and device | IP address, device and browser type, device identifiers, sign-in times, pages viewed, approximate location from IP address | Your device, cookies (see the Cookie Notice) |
| Preferences | Language (English or Hausa), marketing choices, saved items | You |
3.2 The Platform is not intended for anyone under 18, and we do not knowingly collect their data.
4. Why we use your data and our legal basis
4.1 PeerPay uses your data for these purposes:
| Purpose | Legal basis (NDPA, section 25) |
|---|---|
| Creating and managing your account | Performance of a contract |
| Processing orders, delivery, returns and refunds | Performance of a contract |
| Sending payment instructions to the Partner Bank (hold, release, refund, split, deduct charges) | Performance of a contract |
| Verifying identity and eligibility | Legal obligation (AML/KYC) and performance of a contract |
| Operating the Resolution Centre and the Resolution Desk | Performance of a contract and legitimate interests |
| Preventing, detecting and reporting fraud, money laundering and misuse, including automated risk checks | Legal obligation and legitimate interests |
| Keeping records required by law | Legal obligation |
| Securing, maintaining and improving the Platform and PeerPay's technology, including by using de-identified data | Legitimate interests |
| Marketing messages about the Platform | Consent, which you can withdraw at any time |
| Non-essential cookies (analytics) | Consent (see the Cookie Notice) |
| Biometric check during vendor onboarding (if applicable) | Explicit consent |
| Responding to lawful requests from regulators, courts and law enforcement | Legal obligation |
4.2 The Market Board uses your data for these purposes:
| Purpose | Legal basis (NDPA, section 25) |
|---|---|
| Confirming vendors' shops and market membership, and keeping the register of Marketplace traders | Performance of a contract and legitimate interests |
| Setting, collecting and accounting for fees and levies | Performance of a contract and legal obligation |
| Enforcing market rules, suspending vendors, and hearing reviews and appeals | Performance of a contract and legitimate interests |
| Reports on Marketplace activity | Legitimate interests (using de-identified data wherever possible) |
4.3 Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms. You can ask us for details of that assessment.
5. Automated checks
5.1 PeerPay uses automated checks to detect suspicious payments, accounts and listings. These checks may delay an order or flag an account for review. A person always reviews any suspension lasting more than 72 hours, any closure of a vendor account, and any payment withheld for more than 72 hours. You can ask for a human review and give your side (see section 10).
6. Who we share your data with
6.1 We share personal data only as needed for the purposes in section 4:
- The other party to your order receives the details needed to fulfil it. Vendors may use those details only for the order.
- Between PeerPay and the Market Board: vendor registration, fee and levy records, the records needed to decide reviews and appeals, and Marketplace reports.
- EARN receives the enrolment status of the vendors it onboarded, plus aggregated reports on programme progress. EARN does not receive buyer data or transaction details that identify individuals.
- The Partner Bank receives what it needs to receive, hold, release and refund payments.
- GIG Logistics, or another Logistics Partner you choose, receives what it needs to collect and deliver orders.
- Identity verification providers receive what they need to check NIN, BVN and CAC details. Market associations receive what they need to confirm a vendor's shop and membership.
- Service providers acting on PeerPay's instructions under written data processing agreements: hosting, SMS and messaging, email, customer support, analytics and security.
- Regulators, law enforcement agencies and courts, where the law requires or permits it. These include the NDPC, the Central Bank of Nigeria, the NFIU, the Federal Competition and Consumer Protection Commission and the tax authorities.
- A successor to PeerPay's business, or a successor operator of the Platform, which will be bound by this notice.
6.2 Your personal data is never sold.
7. How we protect your data
7.1 We use technical and organisational measures that fit the risk. These include encryption in transit and at rest, role-based access controls, multi-factor authentication for staff, logging and monitoring, regular security testing and staff training.
7.2 If a personal data breach is likely to put your rights and freedoms at risk, the NDPC is notified within 72 hours of the breach becoming known. If the risk to you is high, you will also be told directly, together with the steps you can take to protect yourself.
8. Where your data is stored
8.1 Platform data is stored on servers in Nigeria. We do not currently transfer personal data outside Nigeria. If this changes, we will transfer data only in line with sections 41 to 43 of the NDPA, and we will update this notice first.
9. How long we keep your data
| Data | How long |
|---|---|
| Account details | While your account is open, then 6 years after it closes |
| KYC and verification records | 5 years after the business relationship ends |
| Orders, payments, fees and levies | 6 years from the transaction |
| Complaints, disputes and appeals | 6 years from closure |
| Records of acceptance of terms and of consents | 6 years after your account closes |
| Marketing preferences | Until you withdraw consent, plus a record of the withdrawal |
| Technical logs | 12 months |
| Analytics data | 14 months, in a form that does not identify you wherever possible |
9.1 When the retention period ends, data is deleted or anonymised. If you ask for your data to be deleted but the law requires us to keep it, we restrict its use to that legal duty and tell you which duty applies.
10. Your rights
10.1 Under the NDPA, you have the right to:
- Be told how your data is used.
- Get a copy of your data, including in a portable format.
- Have inaccurate data corrected.
- Have your data deleted when it is no longer needed or there is no lawful basis to keep it.
- Restrict how your data is used in certain circumstances.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent at any time.
- Not be subject to a decision based solely on automated processing that significantly affects you, and to ask for a human review.
10.2 You can exercise most of these rights in your account settings (Download my data, Edit profile, Marketing preferences, Close account), or by contacting the Platform Data Protection Officer. We may need to verify your identity first.
10.3 Requests for a copy of your data are answered within 7 days, and other requests within 30 days. For complex requests, we may extend this and will tell you why.
10.4 If you are not satisfied, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
11. Marketing
11.1 Marketing messages are sent by SMS, WhatsApp, email or push notification only if you opt in. Each message includes a way to opt out. Service messages about your orders, account and security are not marketing and are always sent.
12. Changes to this notice
12.1 Updates to this notice are published on the Platform with a new version number and effective date. If a change materially affects how your data is used, you will be told in the app and by SMS or email before it takes effect, and your consent will be asked for again where the law requires.
13. Contact
Platform Data Protection Officer, PeerPay Network, 30B Oriwu Street, Lekki Phase 1, Lagos. Email: [email protected]. Help Centre: in the app. Market Board: [Market Board office address, to be confirmed].