Privacy Policy

WotShop is operated by Advanced Information Solutions Limited (“WotShop”, “we”, “us” or “our”). This Privacy Policy explains how we handle personal data when you visit WotShop, create or join a merchant account, operate a shop, place an order, open an invoice, contact support, or otherwise use our services.

It should be read with our Terms of Service and any privacy information supplied by the merchant whose storefront you use.

WotShop is a data controller for information used to create and secure WotShop accounts, administer plans, provide support, run the platform, comply with law and improve our own service.

A merchant is generally the controller of its storefront customer, order, delivery, CRM and invoice data. For that information, WotShop generally acts as the merchant’s data processorand processes it to provide the tools selected by that merchant. Merchants are responsible for giving their customers appropriate privacy information and having a lawful basis for using customer data.

• Account data: name, email address, phone number, authentication information, team role and account identifiers.
• Business data: business name, description, WhatsApp number, address, state, registration and tax numbers, branding, bank-transfer instructions and plan information.
• Customer and order data: customer name, phone number, delivery address, landmark, state, notes, ordered items, amounts, discounts, delivery choice and order history.
• Invoice and payment records: invoice details, tax and withholding figures, payment method and status, deposits, and payment evidence or notes a user chooses to upload. WotShop does not currently collect payment-card credentials or process the underlying bank transfer.
• Store and operational data: products, stock records, customer tags, internal merchant notes, delivery zones, discounts and activity records linked to a user.
• Uploaded content: business logos, cover images, product images, stamps, signatures and payment-proof images.
• Technical and support data: IP address and basic browser, device, request, error, security and support information produced when the Service is used.

We receive data directly from merchants, staff and customers when they complete forms, upload files or contact us; automatically when the Service is used; from a merchant who adds a customer or team member; and from an identity provider when a user chooses a supported sign-in option. Merchants may also create orders, invoices or customer records based on an existing business relationship.

• Contract: to create accounts, run storefronts, process order instructions, produce invoices, manage plans, provide support and deliver requested features.
• Legitimate interests: to secure the Service, prevent fraud, diagnose errors, understand product performance, administer businesses and improve WotShop, where those interests are not overridden by individual rights.
• Legal obligation: to respond to lawful requests, keep required records and comply with applicable tax, consumer, privacy and other laws.
• Consent: where the law requires consent, including optional marketing or non-essential device storage if introduced. Consent may be withdrawn without affecting earlier lawful processing.
• Merchant instructions: when we process customer and order data as a processor to provide the merchant’s chosen features.

A published storefront is public. Its business name, description, logo, cover image, WhatsApp contact, general address, products, prices, availability, delivery zones and related shop information may be viewed without signing in and shared through links or QR codes.

Bank-transfer instructions entered by a merchant may be shown to customers after checkout or on an invoice. Merchants should provide business payment information only and should not publish personal information they do not want customers to see.

We may share personal data only as reasonably necessary with:

• the merchant and authorised team members responsible for the relevant storefront, order or invoice;
• cloud hosting, database, authentication, storage and technical service providers that process data for us under appropriate obligations;
• professional advisers, auditors or insurers where needed to protect legitimate business or legal interests;
• regulators, courts, law-enforcement bodies or other recipients where required by law or necessary to protect rights and safety; and
• a successor in a merger, restructuring or sale, subject to appropriate confidentiality and legal safeguards.

When a user taps a WhatsApp link, information the user chooses to send is handled by WhatsApp under its own terms and privacy policy. WotShop does not read or store the resulting WhatsApp conversation merely because the link was opened. We do not sell personal data or share it for third-party behavioural advertising.

Some cloud or technical providers may process or back up data outside Nigeria. Where personal data is transferred internationally, we use a lawful transfer mechanism and appropriate safeguards required by the Nigeria Data Protection Act 2023, such as an adequacy basis, contractual protections, or another permitted exception. You may contact us for more information about safeguards relevant to your data.

We keep personal data for as long as the relevant account or merchant relationship remains active and as reasonably necessary to provide the Service. We may keep some records longer to meet legal, tax, accounting, security, fraud-prevention or dispute requirements.

Retention depends on the kind of record, why it is needed, legal requirements and the instructions of the merchant that controls it. When data is no longer required, we delete or anonymise it within a reasonable period, subject to limited backup cycles and lawful preservation. Account closure or deletion requests can be sent to our contact email; they are assessed against these obligations and the rights of other parties.

We use reasonable technical and organisational safeguards designed to protect personal data, including authentication, access controls, tenant separation, restricted administrative access, private file access controls and activity records. Access within a merchant account is limited according to the user’s role.

No online service can guarantee absolute security. Users must protect their passwords, devices and staff access, and promptly tell us about suspected compromise. If a personal-data breach occurs, we will assess it and notify affected people and the Nigeria Data Protection Commission where required by law.

Subject to applicable law, you may have the right to:

• ask whether we process your personal data and obtain access to it;
• correct inaccurate or incomplete data;
• request deletion of data that is no longer lawfully required;
• restrict or object to certain processing;
• receive eligible data in a portable format;
• withdraw consent where processing relies on consent; and
• complain to the Nigeria Data Protection Commission.

To exercise a right, email benedictolomu@gmail.com and describe your request. We may need to verify your identity and authority. If the request concerns data held for a particular merchant, contact that merchant first; we will assist the merchant where WotShop acts as its processor. Rights may be limited where the law requires retention or an exemption applies. We will respond within the period required by applicable law.

WotShop uses essential browser storage and similar technologies needed for sign-in, security, session continuity, cart contents and shop preferences. We do not currently use third-party behavioural advertising trackers. If we introduce non-essential analytics, advertising cookies or similar tracking, we will provide appropriate information and consent controls before using them where required.

Merchant accounts are for people aged 18 or older who are authorised to act for a business. WotShop is not designed to collect personal data directly from children. Merchants must not knowingly use the Service to collect a child’s data without the consent or other legal authority required by Nigerian law. Contact us if you believe a child’s data has been provided improperly.

• Tell customers clearly how their data will be used and identify the merchant as controller.
• Collect only data needed for a lawful business purpose and keep it accurate.
• Do not use order phone numbers for unrelated marketing without a valid lawful basis.
• Protect dashboard access, limit staff permissions and remove former staff promptly.
• Respond to customer rights requests and notify us where our assistance is required.
• Do not place sensitive or excessive personal information in free-text notes or public shop fields.

Send privacy questions, rights requests or complaints to benedictolomu@gmail.com. Please include enough detail for us to identify the relevant account, shop or order without sending more personal data than necessary.

If you are dissatisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission through its official channels at ndpc.gov.ng.

We may update this Policy when our practices, Service or legal obligations change. We will post the new version here and revise the date above. We will provide reasonable additional notice of material changes through the Service or account contact details where appropriate.

The organisation responsible for this Policy is Advanced Information Solutions Limited, 26A, Peter Chidolue Crescent, Patnasonic Estate, Mbora, Abuja, Nigeria. Privacy contact: benedictolomu@gmail.com.