Privacy Policy

Ogasela is a product of Float Solution Hub. This Privacy Policy explains how Float Solution Hub ("we", "our" or "us") collects, uses, shares and protects personal data when you use our website (ogasela.com), our mobile apps, and related services (together, the "Services"), including when you join our waiting list or testers programme.

We process personal data in line with the Nigeria Data Protection Act 2023 (the "NDPA"), the Nigeria Data Protection Regulation 2019 where it still applies, the General Application and Implementation Directive issued by the Nigeria Data Protection Commission ("NDPC"), and other applicable law.

1. Who we are and how to reach us

Float Solution Hub, Lagos, Nigeria, is the data controller for the personal data described in this policy. For any privacy question or request, contact our Data Protection Officer at privacy@ogasela.com.

2. Personal data we collect

Information you give us

• Account details: your name, phone number, email address, password (stored only as a secure hash), profile photo, and, for sellers, your business name, store address and social media links.
• Verification details (sellers): the type and number of your government-issued ID, images of the ID, a proof-of-address document, and photos captured during a live face check.
• Ads and content: photos, videos, descriptions, prices, categories and the location of items you list, and reviews you write.
• Messages: chats with other users, and messages and files you send in a report or dispute.
• Payments: ad-plan and promotion purchases, Office Pickup orders and refunds, including amounts, references and status. Card and bank details are entered on our payment providers' pages; we don't receive or store your full card number or PIN.
• Office Pickup: the branch you chose, and a delivery address if you ask for delivery.
• Website forms: what you submit through our contact form, account or data deletion form, waiting list or testers form (name, email, and optionally phone number, state, whether you plan to buy or sell, and for testers the type of phone you use).

Information collected automatically

• Device and usage data: device type, operating system, app version, IP address, push notification token, crash and performance data, and how you use the Services, such as ads viewed, saved or messaged about.
• Location: the state and city you choose for browsing, and your device's location only if you give the app permission.
• Website storage: see section 11 (Cookies).

Information from others

• Sign-in providers: if you sign in with Google, Apple or Facebook, we receive your name, email address and an account identifier from that provider.
• Payment providers: confirmation of whether a payment succeeded, and its reference.
• Other users: reviews, reports or dispute messages that mention you.

3. How we use your data, and our lawful basis

The NDPA requires a lawful basis for each use of personal data. Ours are:

Where we rely on legitimate interests, we have weighed them against your rights and freedoms. You can object at any time (section 9).

4. Face checks and other sensitive data

Seller verification includes a live face check that confirms a real person is behind the account. Face data is biometric, which the NDPA treats as sensitive personal data. We only do this with your explicit consent, which we ask for in the app before the check starts.

• The raw photos from the check are deleted automatically within 30 days.
• After that we keep only a face identifier and the result of the check, so we can show that verification happened and prevent the same face being used on many accounts.
• You can refuse or withdraw consent. You can still buy on Ogasela, but you won't be able to become a verified seller.

5. Automated checks

We use automated checks to flag ads that look risky, for example a price far below similar ads, requests to pay outside the platform, or a very new account. A flag sends the ad to our moderation team; a person makes the decision. We don't make decisions that have legal or similarly significant effects on you based solely on automated processing. If you disagree with a moderation decision, contact us and a member of staff will review it.

6. Who we share data with

We never sell your personal data. We share it only as follows:

• Other users: your public profile (name, business name, verified badge, reviews, join date) and your ads are visible to everyone. If you're a seller, your phone number and store address are shown on your ads so buyers can call or visit you. Buyers' phone numbers aren't shown to sellers. Messages are visible to the people you send them to.
• Service providers who process data for us under contract and only on our instructions:
  • Cloud hosting, file storage and face verification: Amazon Web Services
  • Payments and refunds: Paystack and Flutterwave
  • SMS one-time codes: Termii
  • Email: Brevo
  • Push notifications: Google Firebase
  • Bot protection on our website forms: Cloudflare Turnstile
  • AI listing tools: Google (Gemini) and Anthropic (Claude), which receive only the ad details and photos you ask them to work on
  • Sign-in: Google, Apple and Facebook, if you choose them
• Advertising platforms: if you connect a TikTok or Facebook account to promote an ad, we send that platform the ad content needed to run the promotion, and receive performance figures back. We don't send them your contact details.
• Office Pickup: the buyer and seller on an order see the details needed to complete it, such as the item, branch and status.
• Authorities: regulators, law enforcement or courts where the law requires it, or where needed to protect people from fraud or harm.
• A change of ownership: if Ogasela is merged or sold, your data may pass to the new owner, who must keep protecting it as this policy describes.

7. Transfers outside Nigeria

Some of our providers store or process data outside Nigeria, including in the United Kingdom, the European Union and the United States. We only transfer personal data abroad as Part VIII of the NDPA allows: to countries or organisations that provide an adequate level of protection, under binding contractual safeguards, or on another basis the NDPA permits. You can ask us for more detail about these safeguards.

8. How long we keep data

We keep personal data only as long as we need it for the purposes above:

• Account, profile and ads: while your account is open. When you delete it, we delete or anonymise them, except as below.
• Raw face-check photos: deleted within 30 days. The face identifier and result are kept while you're a seller and deleted when your account is deleted.
• ID and proof-of-address documents: while you're a seller, and for up to 12 months after your account closes if needed to deal with fraud or a dispute.
• Payment and transaction records: six years after the transaction, as Nigerian tax and company law requires.
• Chats: while your account is open. Messages that form part of a report or dispute are kept until it is resolved and for up to two years after.
• Waiting list and testers signups: until 12 months after the app launches, or until you ask us to remove you, whichever comes first.
• Contact form and data-request messages: up to two years after we've dealt with them.

9. Your rights

Under the NDPA you have the right to:

• Be informed about how we use your data (this policy).
• Access the personal data we hold about you and get a copy.
• Correct data that is inaccurate or incomplete. You can edit most details in the app.
• Erase your data, subject to the legal exceptions in section 8.
• Restrict how we use your data while a concern is looked into.
• Data portability: receive data you gave us in a common, machine-readable format, or have it sent to another organisation.
• Object to processing based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time, without affecting what we did before you withdrew it.
• Not be subject to a decision based solely on automated processing that significantly affects you (see section 5).
• Complain to the Nigeria Data Protection Commission at ndpc.gov.ng. We'd appreciate the chance to put things right first, so please contact us.

To use any of these rights, email privacy@ogasela.com or use our Account / Data Deletion page. We may need to confirm your identity first. We respond within 30 days, and there's no charge unless a request is clearly unfounded or excessive.

10. Waiting list, testers and marketing messages

If you join our waiting list or testers programme, we use your details only to tell you about the launch or about testing, as you agreed on the form. We'll send you news and offers only if you've opted in. Every marketing email lets you unsubscribe, and you can ask us to remove you from any list by emailing privacy@ogasela.com.

11. Cookies and similar technologies

Our website doesn't use advertising or analytics cookies. It uses:

• Your browser's local storage, to remember that you've seen our cookie notice.
• Cloudflare Turnstile on our forms, which processes technical signals such as your IP address and browser details to tell people from bots.
• Google Maps on our Locate us page, only after you choose to load the map. Google may then set its own cookies under its privacy policy.

The mobile app stores your sign-in session and preferences securely on your device. You can clear website storage in your browser settings at any time.

12. How we protect your data

We use encrypted connections (HTTPS/TLS), store passwords only as one-way hashes, encrypt sensitive tokens, and limit staff access by role. Staff actions on user data are logged and audited. No system is perfectly secure, so please use a strong, unique password and never share your one-time codes. If a personal data breach is likely to put your rights and freedoms at risk, we'll notify the NDPC within 72 hours of becoming aware of it, and tell you without undue delay if the risk to you is high.

13. Children

Ogasela is only for people aged 18 or over. We don't knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we'll delete it.

14. Changes to this policy

We'll post any update on this page with a new "Last updated" date. If a change significantly affects how we use your data, we'll tell you in the app or by email before it takes effect, and ask for fresh consent where the law requires it.

15. Contact us

Data Protection Officer, Float Solution Hub, Lagos, Nigeria: privacy@ogasela.com. For general support, email support@ogasela.com.