Privacy Policy

1. Introduction #

Your privacy matters to us. This Privacy Policy describes the personal information that Raphash Corporations Nigeria Limited ("Raphash", "we", "us" or "our") collects through our website and platform, how we use it, who we share it with, and the choices you have.

We process your personal information in accordance with the Nigeria Data Protection Act 2023 ("NDPA") and other applicable Nigerian laws. Where you are located outside Nigeria, we also endeavour to respect the principles of applicable local data-protection laws, including the EU/UK General Data Protection Regulation to the extent it applies to our processing of your data.

This Policy is not a contract and does not override any rights you may have under Nigerian law. It supplements, and does not replace, the disclosures made elsewhere on the platform.

2. Who We Are #

For the purposes of the NDPA, Raphash is the data controller responsible for the personal information processed through this platform.

Email: info@raphash.com
Phone: +2347072312003
Postal address: High Level, Makurdi, Benue, Nigeria

We have not appointed a separate Data Protection Officer (DPO) as our processing does not fall within the categories that require one under the NDPA. Any privacy query should be addressed to the contact details above and will be handled by our designated privacy lead.

3. Information We Collect #

Depending on how you interact with the platform, we may collect the following categories of personal information:

3.1 Information you provide

Identity data — first name, last name, and (for admin accounts) role and permission scope.
Contact data — email address, phone number, delivery address, city, state, and country.
Account credentials — your password (stored in hashed form only) and 2FA settings.
Order and transaction data — products ordered, quantities, prices, delivery preferences, order notes, and payment references.
Quotation data — the details you submit when requesting a quotation, plus the messages exchanged through the quotation workflow.
Chat and communications — messages you send through our live chat widget, contact form, or email, together with the name and email you choose to provide.
Profile picture — optional image you upload to personalise your account.

3.2 Information we collect automatically

Device data — browser type and version, operating system, device category (desktop/mobile/tablet), and screen information.
Log data — IP address, access times, pages viewed, referring URL, and click-through activity.
Session data — cookies and session identifiers used to keep you signed in and to protect against cross-site request forgery.
Approximate location — derived from IP address, only when our geo-lookup feature is enabled.

3.3 Information from third parties

Paystack — payment status, reference, channel (card, bank, USSD) and gateway response. Paystack handles your card details directly; we never see or store them.
Email delivery provider — delivery and bounce status for transactional emails we send you.

4. How We Collect Information #

We collect personal information:

directly from you, when you register, place an order, request a quotation, send a chat message, or update your profile;
automatically, through cookies and similar technologies when you browse the platform; and
from third parties such as Paystack, when you complete an online payment.

5. Why We Process Your Information #

We use your personal information to:

create and manage your account, and authenticate your sign-in;
process, fulfil, deliver, and track your orders;
respond to your quotation requests and negotiate commercial terms with you;
process payments and issue refunds through Paystack;
provide customer support through email, contact form, and live chat;
send transactional messages (order confirmations, status updates, password resets, 2FA codes, and receipts);
send promotional communications where you have opted in (you can unsubscribe at any time);
prevent fraud, abuse, and unauthorised access, including maintaining a blacklist of emails associated with confirmed abuse;
comply with our legal and regulatory obligations under Nigerian law; and
analyse usage and improve the platform, in aggregated and anonymised form wherever possible.

6. Legal Bases for Processing #

Under the NDPA, our processing of your personal information relies on one or more of the following lawful bases:

Contract — where processing is necessary to enter into or perform our contract with you (for example, to process your order).
Legal obligation — where we are required to process your data to comply with Nigerian law (for example, tax or anti-fraud obligations).
Legitimate interests — where we have a legitimate business interest that is not overridden by your rights (for example, preventing fraud, securing the platform, improving our services).
Consent — where you have given us specific, informed, and unambiguous consent (for example, to send you marketing emails).
Vital interests — in rare cases where processing is necessary to protect life or safety.

Where we rely on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing carried out before the withdrawal.

7. Cookies & Tracking #

The platform uses a small number of cookies and similar technologies. These include:

Strictly necessary cookies — used to keep you signed in and to protect against cross-site request forgery. The platform cannot function without these.
Preference cookies — used to remember settings such as a collapsed sidebar.
Analytics identifiers — a random identifier assigned to your browser (raphash_vid) so that we can count unique visitors and better understand how the platform is used. This identifier is not shared with advertisers.

You can control or delete cookies through your browser settings. Blocking strictly necessary cookies will prevent you from signing in and placing orders.

9. International Transfers #

Some of our service providers (for example, cloud hosting and email delivery) may process your personal information on servers located outside Nigeria. Where that happens, we take steps to ensure the transfer is lawful under the NDPA — for instance, by relying on the provider's binding contractual commitments, their data-processing agreement, or an adequacy determination by the Nigeria Data Protection Commission.

10. Data Retention #

We retain your personal information only for as long as it is needed for the purpose for which it was collected, or as required by law. In practice:

Account data — retained while your account is active, and for a period thereafter to comply with our legal, tax, and accounting obligations.
Order and payment records — retained for the period required under Nigerian tax and commercial law.
Chat and support communications — retained for a reasonable period to resolve disputes and improve our service.
Marketing preferences — retained until you withdraw your consent or unsubscribe.
Blacklist entries — an email address added to our fraud-prevention blacklist may be retained indefinitely, because its sole purpose is to prevent re-registration by an account that has been removed for confirmed abuse.

11. Your Rights #

Under the NDPA, you have the following rights in relation to your personal information:

Right to be informed — to know how your data is being used, as described in this Policy.
Right of access — to request a copy of the personal information we hold about you.
Right to rectification — to correct inaccurate or incomplete information.
Right to erasure — to have your personal information deleted, subject to our legal retention obligations.
Right to restrict processing — to ask us to stop processing your data in certain circumstances.
Right to object — to object to processing based on legitimate interests, including for direct marketing.
Right to data portability — to receive your data in a structured, commonly used, machine-readable format.
Right to withdraw consent — where processing is based on your consent, to withdraw it at any time.
Right to lodge a complaint — with the Nigeria Data Protection Commission or another competent supervisory authority.

To exercise any of these rights, please contact us using the details in Section 17. We will respond within the timeframe required by the NDPA and will ask you to verify your identity before acting on your request.

12. Security #

We take the security of your personal information seriously. The measures we apply include, but are not limited to:

encryption of all traffic between your browser and our servers using HTTPS/TLS;
password hashing with a modern adaptive hashing algorithm (bcrypt) — we never store your password in plain text;
optional two-factor authentication (app-based or email-based) on every account;
rate limiting on authentication endpoints to slow down credential-stuffing attacks;
strict role-based access control on our internal systems, so that support agents and administrators only see the information required for their role;
audit logging of administrative and security-relevant actions; and
regular backups and monitoring of our hosting environment.

No online platform can guarantee perfect security. If you suspect your account has been compromised, change your password immediately and contact us using the details in Section 17.

13. Children’s Privacy #

The platform is not directed at children under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

14. Marketing Communications #

We only send you marketing communications where you have expressly opted in, or where we are otherwise permitted to do so under Nigerian law. Every marketing email we send includes an unsubscribe link. You can also withdraw your marketing consent at any time by updating your preferences in your profile or by contacting us.

Even where you opt out of marketing, we will continue to send you essential transactional messages related to your account and your orders.

15. Third-Party Links #

The platform may include links to third-party websites (for example, a courier's tracking page, or a payment provider's checkout). We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy notice of any third-party site you visit.

16. Changes to This Policy #

We may update this Privacy Policy from time to time to reflect changes in our services, our operations, or applicable law. When we do, we will update the "Last reviewed" date at the top of the page. Where the change is material, we will notify you through the platform or by email before the change takes effect.

17. How to Contact Us #

If you have any questions about this Privacy Policy, want to exercise one of your rights, or want to raise a complaint, please contact us using any of the following:

Email: info@raphash.com
Phone: +2347072312003
Address: High Level, Makurdi, Benue, Nigeria
Live chat: available on every page of the platform during business hours.

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), the supervisory authority established under the Nigeria Data Protection Act 2023.

Questions about your data?

We will answer any privacy-related enquiry as quickly as we can.