Data protection

1. Purpose of the application

CoSellers is a shop book. It gives businesses digital tools for product and inventory management, sales recording, stock tracking, customer and supplier records, business reports, staff accounts, barcode scanning, and sign-in security.

It is meant to replace paper sales books and paper stock records.

2. Definitions

Personal Data means information relating to an identified or identifiable person.

Processing means collecting, recording, storing, using, changing, sharing, or deleting Personal Data.

User means a person who creates an account or uses CoSellers.

Business Customer means a shop, company, or other business using the application.

Data Controller decides why and how Personal Data is used. Data Processor handles Personal Data for a Data Controller.

Third-Party Service Provider means an outside service used to run, host, or protect the application.

3. Roles of the parties

When a Business Customer stores information about staff, customers, or suppliers, that Business Customer is usually the Data Controller of that information.

The operator of CoSellers is a Data Processor when it stores that information for the shop.

For the User's own account details, the operator of the application may be the Data Controller.

Each party must follow the data protection laws that apply to them.

4. Categories of personal data

Account information may include full name, email, telephone number, sign-in details, user role, and shop affiliation.

Business information may include shop name, contact details, address, and account information.

Customer and supplier information a shop chooses to type may include name, telephone, email, address, and purchase or sales history.

Staff information a shop types may include name, contact details, role, login details, and shop activity.

Transaction records may include goods, quantities, sales, prices, purchases, expenses, dates, product codes, and barcodes.

The application does not require a shop to collect extra personal information that it does not need.

5. Processing purposes

Personal Data may be used to create and manage accounts, sign people in, give access to features, keep the shop book, keep transaction records, give support, keep the application working, detect fraud or misuse, keep the application safe, fix faults, follow the law, and send important service messages.

Personal Data will not be used for purposes that do not match this Agreement and the Privacy Notice.

6. Lawful basis for processing

Where the law requires a lawful basis, processing may rest on a contract, a legal duty, a legitimate interest, consent, protection of vital interests, or another basis the law allows.

Where we rely on consent, you can withdraw it later. That does not undo work already done, such as a payment that already went through.

7. Data minimisation

We aim to process only Personal Data that is reasonably needed to run the application.

Business Customers must enter information that is appropriate, correct, and needed for their shop.

Do not type sensitive or extra personal information unless a feature truly needs it and the law allows it.

8. Accuracy of personal data

We take reasonable steps to keep Personal Data we control accurate.

Business Customers must keep the information they type accurate. Users can update many details in the application.

9. Data security

We use reasonable technical and organisational measures against unauthorised access, disclosure, loss, destruction, alteration, and other threats.

This may include sign-in controls, role-based access, database protection, encryption where appropriate, secure connections, monitoring, backups, and updates.

No internet system is completely safe. Users accept that electronic systems carry some risk.

10. User responsibilities

Keep passwords and PINs secret. Do not share them. Use the application lawfully. Give accurate information. Protect the phone or computer you use. Report suspected unauthorised access. Make sure information you type was collected lawfully.

Business Customers decide what they collect from customers, staff, and suppliers, and must have a lawful basis for it.

11. Third-party service providers

Trusted providers may help host, store, sign people in, send email or SMS codes, take payments, and protect the application.

Depending on features, this may include Supabase, Vercel, Termii, WhatsApp, Google (only if you choose Google sign-in), and Paystack.

Providers may process Personal Data only as needed to provide their service, under their terms and security practices.

12. International data transfers

Some providers may store or process information outside Nigeria or outside the country where you live.

Where Personal Data is transferred abroad, we seek appropriate safeguards and follow applicable law.

Using a cloud shop book may involve international processing.

13. Data retention

Personal Data is kept only as long as reasonably needed for the purpose, unless the law requires or allows a longer period.

How long depends on the type of information, the purpose, the law, the shop status, and security needs.

When it is no longer needed, it may be deleted, anonymised, or securely disposed of, subject to the law.

14. Account closure and data deletion

If an account is closed, Personal Data may be deleted or anonymised, subject to legal retention, fraud prevention, disputes, and backups.

Business Customers may request deletion of Personal Data processed for them, subject to legal and technical limits.

15. Data subject rights

Subject to the law, a person may ask to see Personal Data, correct it, delete it, restrict or object to some uses, withdraw consent where consent is the basis, or receive information about processing.

Send requests through Contact customer service and say you are making a data protection request.

16. Business customer responsibilities

Business Customers must collect Personal Data lawfully, give privacy notices where required, obtain consent where the law requires it, answer requests from their own customers or staff, give access only to authorised people, keep internal access under control, and not upload extra sensitive information.

17. Data breach and security incidents

If we confirm a security incident involving Personal Data, we will investigate, contain it, assess impact, take corrective steps, and notify people or authorities where the law requires it.

Business Customers remain responsible for notifying their own affected people where the law requires it.

18. Government and law enforcement requests

We may disclose Personal Data if the law, a court, a regulator, or a lawful authority requires it.

Where the law allows, we will try to limit disclosure to what is reasonably needed.

19. Prohibited use

Do not process Personal Data unlawfully, collect information without a lawful basis, upload harmful software, open another person's account, bypass security, commit fraud, use the application for unlawful surveillance, or store information that breaks the law.

Serious or unlawful misuse may lead to a locked or closed account.

20. Children's data

CoSellers is for businesses and their authorised users. It is not for children under 18. Do not create an account for a child or knowingly store a child's personal information.

21. Changes

This Agreement may change if the application, the law, providers, or business practice changes.

Important changes will be shown by a new date at the top. The updated version applies from that date. We may ask you to read and agree again.

22. Governing law

This Agreement is interpreted with the Nigeria Data Protection Act 2023, as applicable. If you live in another country, other requirements may also apply.

23. Contact

Application: CoSellers. For questions or complaints about Personal Data, use Contact customer service on the sign-in page or in the app.

24. Acceptance

By tapping I agree, you confirm you have read this Data protection agreement to the end, you understand it, and you want to create a CoSellers account. The Privacy Notice and Cookies Policy also apply.

If you tap I disagree, you will go back to the sign-in page and no new account will be created from this step.

A person creating an account for a shop confirms they have the authority to accept this Agreement for that shop.