Okmall (okmall.ng) is an online marketplace based in Nigeria that connects buyers with vendors and individual sellers of thrifted and pre-loved goods. We are the data controller for the personal information collected through our website and mobile app.

This Privacy Policy explains what personal information we collect, why we collect it, how we use it, and what rights you have over it. It applies to everyone who uses Okmall — customers, vendors, and personal sellers.

By creating an account or using Okmall, you agree to the practices described in this policy.

What we collect depends on how you use Okmall — whether you’re shopping as a customer, running a store as a vendor, or selling as a personal seller. We only collect what’s necessary to make the marketplace work.

Payment card details are processed entirely by our payment processor and are never stored on Okmall’s own servers.

We use the information we collect for the following purposes:

• To operate the marketplace — creating your account, listing products, processing orders, and connecting buyers with sellers.
• To verify your identity — confirming a vendor or personal seller’s identity before enabling withdrawals, to keep the marketplace trustworthy and prevent fraud.
• To process payments and payouts — charging customers for orders, and paying out vendors’ and personal sellers’ earnings to their registered bank account.
• To fulfil and deliver orders — sharing the necessary delivery details between a customer and the vendor/seller fulfilling their order.
• To resolve disputes — reviewing order disputes raised by a customer, evidence submitted by either party, and communications relevant to reaching a fair outcome.
• To send service-related notifications — order updates, dispute updates, withdrawal confirmations, and account-related emails or push notifications. We do not send promotional messages unless you’ve agreed to receive them, and you can opt out at any time.
• To improve the platform — analysing aggregated, anonymised usage patterns to understand how features are used and to fix issues.
• To comply with legal obligations — retaining transaction and payout records as required by Nigerian financial regulations.

We do not use your personal information for advertising, profiling, or any purpose unrelated to operating Okmall.

To keep Okmall a safe and trustworthy marketplace, vendors and personal sellers are required to complete identity verification before they can withdraw earnings. This is one of the more sensitive parts of our data handling, so here is exactly how it works:

• Who reviews it: Submitted documents are reviewed by authorised Okmall staff only, through a restricted admin review queue. They are not visible to customers or to any other vendor or seller.
• Why we ask for a live selfie: Requiring the photo to be taken in the moment, rather than uploaded, helps confirm the person submitting the ID is the same person applying to sell on the platform.
• What happens if verification is rejected: You’ll be told why, and you’re free to resubmit with corrected information or documents.
• Retention: Verification documents are kept for as long as necessary for fraud prevention and regulatory compliance — see Section 6 for details.

Customers are not required to complete identity verification to shop on Okmall.

We do not sell, rent, or trade your personal information. We share it only in the following limited circumstances:

All third-party service providers we use are required to use your data only for the purpose of providing services to us on your behalf.

We retain your personal data for as long as your account is active, or as long as necessary to provide the service. More specifically:

• Account, store, and order data — kept for as long as your account exists. If you request account deletion, we will delete your account and associated personal data, subject to the exceptions below.
• Identity verification documents — retained for as long as necessary for fraud prevention and regulatory compliance, even after an account is closed, and then securely deleted.
• Payout, withdrawal, and transaction records — retained to comply with Nigerian financial recordkeeping requirements, even after account deletion. This does not include your identity verification documents once no longer needed.
• Order chat and dispute messages — retained for as long as necessary to resolve a dispute, and for a reasonable period afterward for accountability purposes.
• Technical and usage logs — retained for a limited period and then automatically purged.

When data is deleted, it is permanently removed from our systems and cannot be recovered.

We take the security of your personal information seriously and apply appropriate technical and organisational measures to protect it, including:

• All data in transit between your device and our servers is encrypted using HTTPS/TLS.
• Your password is stored using strong one-way encryption (hashing). We cannot see or recover your password — only you know it.
• Payment card and bank transfer details are never stored on our own servers; they are handled directly by our payment processor’s secure infrastructure.
• Identity verification documents are only accessible to authorised staff through a restricted admin review area, never to other users.
• Every request to view or change account, order, or payout information is checked to confirm it belongs to the person making the request.

While we take reasonable precautions, no online system is completely secure. We encourage you to use a strong, unique password for your Okmall account and to keep it confidential.

If you believe your account has been compromised, please contact us immediately using the details in Section 12.

Under the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR), you have the following rights regarding your personal data:

To exercise any of these rights, please contact us using the details in Section 12. There is no charge for making a reasonable request.

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

We use cookies to make the website function correctly and to keep you logged in to your account. Specifically, we use:

• Session cookies — essential for keeping you logged in while you use your dashboard. They expire when you close your browser or log out.
• Persistent login cookies — keep you signed in across visits until you log out.
• Security cookies — small tokens used to protect forms on the website from cross-site request forgery. These are essential for security and cannot be disabled.

If you use the Okmall mobile app, we request permission to send push notifications so we can alert you about order and dispute updates. You can disable this at any time in your device’s notification settings.

We do not use advertising cookies, tracking pixels, or third-party analytics that follow you across the web. The cookies we use are strictly functional and necessary for the service to work.

Okmall is a commercial marketplace intended for use by adults. Our service is not intended for anyone under the age of 18, and identity verification for vendors and personal sellers requires a valid government-issued ID. We do not knowingly collect personal data from children under 18.

If you believe a child has created an account on our platform, please contact us at the address in Section 12 and we will take steps to review and, where appropriate, remove the account and associated data promptly.

We may update this Privacy Policy from time to time to reflect changes in our service, technology, or legal requirements. When we make material changes, we will:

• Update the “Effective Date” at the top of this page.
• Notify registered users by email or in-app notification before the change takes effect, where the change affects how we use your personal data.
• For minor clarifications or administrative updates, we will update this page without a separate notification.

We encourage you to review this page periodically. Continued use of Okmall after a change takes effect constitutes your acceptance of the updated policy.

If you have any questions about this Privacy Policy, want to exercise your data rights, or need to report a concern about your personal data, please get in touch: