Privacy Policy

1.1 Information you provide to us

• Account information: first name, last name, email address, phone number, and password when you register. We may verify your email or phone number with a one-time passcode (OTP).
• Profile information: an optional avatar selected from a set of predefined options.
• Order information: items ordered, order notes, delivery addresses, and — for gift orders — the recipient's name, phone number, and delivery address (you must have the recipient's permission to share these).
• Payment and payout information: when you withdraw funds from your wallet, your bank account number and bank; a transaction PIN that you set. We do not collect or store your full card details — card payments are entered directly with our licensed payment processors.
• Communications: messages, complaints, and support requests you send us.
• Ratings and reviews: ratings and feedback you submit about vendors and dispatch partners.
• Referral information: a referral code, if you register with one.

1.2 Information collected automatically

• Location data: with your permission, your device's approximate or precise location while you are using the app, to show nearby vendors, set delivery addresses, and calculate delivery fees. You can withdraw this permission at any time in your device settings; some features (like nearby-vendor discovery) may then not work.
• Device and app information: device type, operating system and version, app version, language, and a push notification token if you allow notifications.
• Transaction and usage data: orders placed, wallet balance and transactions, tips given, screens viewed, and general in-app activity, together with timestamps and diagnostic logs.

1.3 Information from third parties

• Payment processors (Paystack, Payaza) send us confirmations of payments, refunds, and transfers (e.g., payment reference, amount, status).
• Bank verification services return the registered account name when you add a bank account for withdrawals, so we can confirm the account belongs to you.

We do not knowingly collect data from anyone under 18. See Section 9.

We use your personal data to:

We do not sell your personal data.

We share personal data only as needed to run the Service:

• Vendors receive the details needed to fulfil your order (your name, order contents, and delivery information).
• Dispatch partners receive the details needed to deliver your order (your name, phone number, delivery address, and order reference) — or the gift recipient's details for gift orders.
• Payment processors — Paystack and Payaza, both licensed Nigerian payment providers — process card payments, refunds, and bank transfers (including wallet withdrawals). Your payment details are handled under their own privacy policies.
• Service providers that help us operate the app, including cloud hosting, Google Firebase (app infrastructure and push notification delivery via Firebase Cloud Messaging/Apple Push Notification service), Expo (app updates and push notification delivery), and mapping providers (Google Maps, Mapbox) that render maps and locations in the app.
• Professional advisers and authorities where required by law, regulation, court order, or to protect our rights, users, or the public.
• Business transfers: if TrustBasket is involved in a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction; this Policy will continue to apply to it.

Each third party receives only the data it needs for its function.

Some of our service providers (for example, cloud hosting, Firebase, Expo, and mapping providers) may store or process data outside Nigeria. Where personal data is transferred outside Nigeria, we take steps to ensure it receives an adequate level of protection consistent with the NDPA, including transferring to jurisdictions or providers with appropriate safeguards.

We keep your personal data only as long as necessary for the purposes described in this Policy:

• Order, wallet, and payment records — for the period required by Nigerian financial, tax, and anti-fraud regulations, even after account deletion.
• Support communications — for as long as needed to resolve the issue and improve our service.

When you delete your account (Section 7), we delete or anonymize your personal data, except data we are legally required to retain or need for the establishment or defence of legal claims; we will retain it for up to 5 years.

We use technical and organizational measures to protect your data, including encryption of data in transit (HTTPS/TLS), authenticated API access, PIN protection for sensitive wallet actions, and access controls. Card details are handled by our PCI-DSS-compliant payment processors and never stored on our servers. No system is 100% secure, so we cannot guarantee absolute security — please keep your password, OTPs, and PIN confidential.

Under the NDPA, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data (you can edit your profile in the app under Profile → Manage Account);
• Delete your data — you can delete your account in-app via Profile → Manage Account, or by emailing us;
• Withdraw consent at any time where processing is based on consent (e.g., turn off location or push notifications in your device settings);
• Object to or restrict certain processing;
• Data portability — receive a copy of data you provided in a structured, machine-readable format;
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated.

To exercise any of these rights, contact us at trustbaskethq@gmail.com. We will respond within the timeframe required by law and may need to verify your identity first.

All permissions are optional — the app asks before using them, and you can change them at any time in your device settings.

The Service is intended for users aged 18 and above. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us at trustbaskethq@gmail.com and we will delete the account and its data.

Our website may use cookies and similar technologies for essential functionality and analytics. The mobile app uses locally stored tokens to keep you signed in. You can clear app data or sign out at any time.

We may update this Policy from time to time. The “Last updated” date at the top shows the latest revision. For material changes, we will notify you in the app, by email, or by push notification before the changes take effect. Continued use of the Service after the changes take effect means you accept the updated Policy.

If you have questions about this Policy or how we handle your data:

• Email: trustbaskethq@gmail.com
• Website: https://trustbasket.co
• Phone number : +234 903 557 7860
• Address: St. pirans street, Jos, Plateau, Nigeria

You may also contact the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng if you have concerns we have not resolved.