Privacy Policy

1. Introduction

This website (www.digimart.ng) is owned and operated by Digimart NG Concepts, a company registered under the laws of the Federal Republic of Nigeria (“Digimart NG”, “we”, “us” or “our”). Digimart NG Concepts is the data controller responsible for the personal data collected through the Digimart NG website and web app (the “Platform”).

This Privacy Policy explains what personal data we collect, why we collect it, who we share it with and the rights you have. We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and the regulations and guidance of the Nigeria Data Protection Commission (NDPC). Please read it together with our Terms & Conditions.

2. Personal data we collect

Information you give us

• Account details: your name, email address, phone number and password (stored only as a secure one-way hash).
• Google sign-in: if you choose “Continue with Google”, we receive your name, email address and Google account identifier.
• Identity verification (KYC): your Bank Verification Number (BVN), date of birth, gender and address. We keep only the last four digits of your BVN together with a one-way cryptographic hash; we do not keep your full BVN in readable form.
• Security details: your wallet PIN (stored only as a secure hash) and security settings.
• Purchase details: the phone numbers, meter numbers, smartcard/IUC numbers and customer names you enter to buy airtime, data, electricity, cable TV and other services.
• Support messages: the content of support tickets and messages sent through our contact form, including any name, email address and phone number you provide.

Information created when you use the Platform

• Wallet and transactions: wallet balance, funding records, virtual account details, purchase history, references and receipts.
• Technical data: IP address, browser and device type, pages visited, timestamps and security logs.
• Cookies: see Section 9.

Information from third parties

• Payment partners confirm your funding payments and the virtual account issued to you.
• Service providers confirm the status of your purchases and, where applicable, the customer name on a meter or smartcard.

We do not collect or store your full card number, card expiry date or CVV; card payments are handled directly by our payment partner.

3. How we use your data and our lawful basis

• To provide the Platform (create your account, fund your wallet, deliver purchases, issue receipts, handle support) — performance of a contract.
• To verify your identity and prevent fraud and money laundering — legal obligation and legitimate interests.
• To keep the Platform secure (login protection, rate limiting, bot checks, audit logs) — legitimate interests.
• To send service messages (account activation, password reset, PIN changes, transaction notifications) — performance of a contract.
• To understand and improve the Platform through aggregated analytics — legitimate interests or consent where required.
• To comply with the law and respond to lawful requests from regulators, courts and law-enforcement agencies — legal obligation.

We do not sell your personal data, and we do not use it for automated decisions that produce legal effects about you.

4. Who we share your data with

We share personal data only where necessary, and with parties bound by confidentiality and data protection obligations:

• Licensed payment partners — to verify your BVN, issue your virtual account and process transfers and card payments.
• Service providers and aggregators — only the recipient details needed to deliver your airtime, data, electricity, cable TV or PIN purchase.
• Email delivery provider (ZeptoMail by Zoho) — to send account and transaction emails.
• Google — for Google sign-in (if you use it) and Google Analytics.
• Cloudflare — for bot protection on public forms (where enabled).
• Hosting and infrastructure providers that store and run the Platform on our behalf.
• Regulators, courts and law-enforcement agencies — where required by law.
• A successor business — if Digimart NG is merged, acquired or restructured, subject to this Policy.

5. International transfers

Some of our providers (for example Google, Cloudflare and Zoho) may process data outside Nigeria. Where personal data is transferred outside Nigeria, we rely on the safeguards permitted under the NDPA, such as adequacy decisions, contractual protections or your consent, to ensure your data remains adequately protected.

6. How long we keep your data

• Account, KYC and transaction records are kept for as long as your account is active and for at least five (5) years after your account closes or the transaction date, as required by Nigerian anti-money-laundering law.
• Support tickets and contact-form messages are kept for up to five (5) years so we can handle follow-ups and disputes.
• Security logs and rate-limiting data are kept only for as long as needed for security purposes.

When data is no longer needed, we delete or anonymise it securely.

7. How we protect your data

We use technical and organisational measures including encrypted connections (HTTPS), hashed passwords and PINs, hashed identity numbers, role-based staff access, CSRF protection, login and request rate limiting, and monitoring of payment callbacks. No system is completely secure, so please keep your password and PIN private. If we become aware of a personal data breach that is likely to put your rights at risk, we will notify the NDPC and affected users as required by law.

8. Your rights

Under the NDPA you have the right to:

• be informed about how your personal data is used;
• access a copy of the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data deleted, where we are not required to keep it by law;
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent; and
• lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any of these rights, email support@digimart.ng from the email address on your account. We may need to verify your identity before acting on your request, and we will respond within the period required by law.

9. Cookies

We use a small number of cookies and similar technologies:

• Essential cookies — keep you signed in, remember your “Remember me” choice and protect forms against cross-site request forgery. The Platform cannot work without them.
• Analytics cookies — Google Analytics helps us understand how the Platform is used in aggregate.
• Security — Cloudflare Turnstile may set cookies to distinguish people from bots on public forms.

You can block or delete cookies in your browser settings, but parts of the Platform (such as signing in) will stop working.

10. Children

The Platform is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this Policy

We may update this Privacy Policy from time to time. The “Last updated” date above shows when it last changed. Material changes will be communicated on the Platform or by email.

12. Contact us

For questions about this Policy or your personal data, contact our data protection team:
Digimart NG Concepts (trading as Digimart NG)
Email: support@digimart.ng
Website: www.digimart.ng