Last updated 31 August 2026
Data Protection and Processing Agreement for CoSellers. Effective date: 31 August 2026.
1. Purpose of the application
CoSellers is a shop book. It gives businesses digital tools for product and inventory management, sales recording, stock tracking, customer and supplier records, business reports, staff accounts, barcode scanning, and sign-in security.
It is meant to replace paper sales books and paper stock records.
2. Definitions
Personal Data means information relating to an identified or identifiable person.
Processing means collecting, recording, storing, using, changing, sharing, or deleting Personal Data.
User means a person who creates an account or uses CoSellers.
Business Customer means a shop, company, or other business using the application.
Data Controller decides why and how Personal Data is used. Data Processor handles Personal Data for a Data Controller.
Third-Party Service Provider means an outside service used to run, host, or protect the application.
3. Roles of the parties
When a Business Customer stores information about staff, customers, or suppliers, that Business Customer is usually the Data Controller of that information.
The operator of CoSellers is a Data Processor when it stores that information for the shop.
For the User's own account details, the operator of the application may be the Data Controller.
Each party must follow the data protection laws that apply to them.
4. Categories of personal data
Account information may include full name, email, telephone number, sign-in details, user role, and shop affiliation.
Business information may include shop name, contact details, address, and account information.
Customer and supplier information a shop chooses to type may include name, telephone, email, address, and purchase or sales history.
Staff information a shop types may include name, contact details, role, login details, and shop activity.
Transaction records may include goods, quantities, sales, prices, purchases, expenses, dates, product codes, and barcodes.
The application does not require a shop to collect extra personal information that it does not need.
5. Processing purposes
Personal Data may be used to create and manage accounts, sign people in, give access to features, keep the shop book, keep transaction records, give support, keep the application working, detect fraud or misuse, keep the application safe, fix faults, follow the law, and send important service messages.
Personal Data will not be used for purposes that do not match this Agreement and the Privacy Notice.
6. Lawful basis for processing
Where the law requires a lawful basis, processing may rest on a contract, a legal duty, a legitimate interest, consent, protection of vital interests, or another basis the law allows.
Where we rely on consent, you can withdraw it later. That does not undo work already done, such as a payment that already went through.
7. Data minimisation
We aim to process only Personal Data that is reasonably needed to run the application.
Business Customers must enter information that is appropriate, correct, and needed for their shop.
Do not type sensitive or extra personal information unless a feature truly needs it and the law allows it.
8. Accuracy of personal data
We take reasonable steps to keep Personal Data we control accurate.
Business Customers must keep the information they type accurate. Users can update many details in the application.
9. Data security
We use reasonable technical and organisational measures against unauthorised access, disclosure, loss, destruction, alteration, and other threats.
This may include sign-in controls, role-based access, database protection, encryption where appropriate, secure connections, monitoring, backups, and updates.
No internet system is completely safe. Users accept that electronic systems carry some risk.
10. User responsibilities
Keep passwords and PINs secret. Do not share them. Use the application lawfully. Give accurate information. Protect the phone or computer you use. Report suspected unauthorised access. Make sure information you type was collected lawfully.
Business Customers decide what they collect from customers, staff, and suppliers, and must have a lawful basis for it.
11. Third-party service providers
Trusted providers may help host, store, sign people in, send email or SMS codes, take payments, and protect the application.
Depending on features, this may include Supabase, Vercel, Termii, WhatsApp, Google (only if you choose Google sign-in), and Paystack.
Providers may process Personal Data only as needed to provide their service, under their terms and security practices.
12. International data transfers
Some providers may store or process information outside Nigeria or outside the country where you live.
Where Personal Data is transferred abroad, we seek appropriate safeguards and follow applicable law.
Using a cloud shop book may involve international processing.
13. Data retention
Personal Data is kept only as long as reasonably needed for the purpose, unless the law requires or allows a longer period.
How long depends on the type of information, the purpose, the law, the shop status, and security needs.
When it is no longer needed, it may be deleted, anonymised, or securely disposed of, subject to the law.
14. Account closure and data deletion
If an account is closed, Personal Data may be deleted or anonymised, subject to legal retention, fraud prevention, disputes, and backups.
Business Customers may request deletion of Personal Data processed for them, subject to legal and technical limits.
15. Data subject rights
Subject to the law, a person may ask to see Personal Data, correct it, delete it, restrict or object to some uses, withdraw consent where consent is the basis, or receive information about processing.
Send requests through Contact customer service and say you are making a data protection request.
16. Business customer responsibilities
Business Customers must collect Personal Data lawfully, give privacy notices where required, obtain consent where the law requires it, answer requests from their own customers or staff, give access only to authorised people, keep internal access under control, and not upload extra sensitive information.
17. Data breach and security incidents
If we confirm a security incident involving Personal Data, we will investigate, contain it, assess impact, take corrective steps, and notify people or authorities where the law requires it.
Business Customers remain responsible for notifying their own affected people where the law requires it.
18. Government and law enforcement requests
We may disclose Personal Data if the law, a court, a regulator, or a lawful authority requires it.
Where the law allows, we will try to limit disclosure to what is reasonably needed.
19. Prohibited use
Do not process Personal Data unlawfully, collect information without a lawful basis, upload harmful software, open another person's account, bypass security, commit fraud, use the application for unlawful surveillance, or store information that breaks the law.
Serious or unlawful misuse may lead to a locked or closed account.
20. Children's data
CoSellers is for businesses and their authorised users. It is not for children under 18. Do not create an account for a child or knowingly store a child's personal information.
21. Changes
This Agreement may change if the application, the law, providers, or business practice changes.
Important changes will be shown by a new date at the top. The updated version applies from that date. We may ask you to read and agree again.
22. Governing law
This Agreement is interpreted with the Nigeria Data Protection Act 2023, as applicable. If you live in another country, other requirements may also apply.
23. Contact
Application: CoSellers. For questions or complaints about Personal Data, use Contact customer service on the sign-in page or in the app.
24. Acceptance
By tapping I agree, you confirm you have read this Data protection agreement to the end, you understand it, and you want to create a CoSellers account. The Privacy Notice and Cookies Policy also apply.
If you tap I disagree, you will go back to the sign-in page and no new account will be created from this step.
A person creating an account for a shop confirms they have the authority to accept this Agreement for that shop.