TrustBasket Vendor — Privacy Policy

TrustBasket operates a marketplace platform in Nigeria connecting local vendors with customers. This Policy covers the vendor-facing App. For the purposes of the NDPA, TrustBasket is the data controller of the personal data described below.

• Contact email: support@trustbasket.co
• Website: https://trustbasket.co

2.1 Information you provide directly

• Account information:

  • First name and last name
  • Business name
  • Business email address
• Business information (onboarding):

  • Business address and city
  • Business phone number
  • Business email address
  • Business location coordinates (latitude/longitude derived from the address you select)
  • Vendor category (e.g., laundry, market, pharmacy, restaurant)
  • Opening and closing hours
• Verification (KYC) documents:

  • CAC business number or any other business license number
  • Proof of business address
  • Business logo
• Bank and payout information:

  • Bank name and bank code
  • Account number and account name
  • Withdrawal/transaction PIN (stored securely; used to authorise withdrawals)
• Products and content:

  • Product/service listings, descriptions, prices, and product images you upload
• Team member information: If you invite team members, we collect the first name, last name, email address, phone number, and role you provide for each invitee. You are responsible for having their permission to share these details with us.

2.2 Information collected automatically

• Push notification token (Expo push token) so we can send order and account notifications to your device
• Device and technical information, such as device type, operating system, and app version
• Usage and transaction records, including orders received, order status changes, wallet balance, earnings, tips, refunds, and withdrawal history
• Authentication tokens stored on your device to keep you signed in

2.3 Information from your device (with permission)

• Camera — to take photos of products and capture verification documents
• Photo library — to select existing images for products, your logo, and documents
• Notifications — to deliver order alerts and account updates

You can decline or revoke these permissions in your device settings, though some features (such as uploading documents or receiving order alerts) will not work without them.

We do not collect your device's GPS location in the current version of the App. Business location coordinates come from the address you choose during onboarding.

We use your personal data to:

• Create and manage your vendor account, including sign-in, email verification (OTP), and password reset;
• Verify your identity and business (KYC) so that only legitimate businesses sell on the platform, and to comply with our legal and regulatory obligations;
• Verify your bank account and process payouts, including automated payouts, in-app withdrawal requests, and PIN-protected transactions;
• Operate the marketplace, including displaying your business profile, logo, products, opening hours, availability, and ratings to customers;
• Process and manage orders, including notifying you of new orders, pickup-code verification, and dispatch coordination;
• Send service communications, such as order alerts, payout confirmations, verification outcomes, and important account or policy updates, via push notification and email;
• Provide support and investigate complaints, disputes, and refund claims;
• Prevent fraud and abuse, including detecting suspicious transactions, enforcing our Terms & Conditions, and complying with anti-money-laundering obligations;
• Improve the App and our services, including diagnosing technical issues;
• Comply with legal obligations, including tax, financial, and regulatory requirements.

Under the NDPA, we rely on the following legal bases:

• Contract — most processing is necessary to provide the vendor services you signed up for (account, listings, orders, payouts);
• Legal obligation — KYC verification, financial record-keeping, and responses to lawful requests from authorities;
• Legitimate interests — fraud prevention, platform security, and service improvement, balanced against your rights;
• Consent — where required, for example for optional device permissions; you may withdraw consent at any time without affecting prior processing.

We do not sell your personal data. We share it only as follows:

• With customers on the platform: your business name, logo, category, address/area, opening hours, availability status, products, prices, and ratings are visible to customers. Your personal bank details, and KYC documents are never shown to customers.
• With payment and banking partners: licensed Nigerian payment processors and banking partners receive the details needed to verify your bank account and process payouts (e.g., account number, account name, bank code for verification).
• With service providers who process data on our behalf, including:

  • Cloud hosting and storage providers (our backend infrastructure and secure media storage for images and documents);
  • Push notification services (Expo and Firebase Cloud Messaging) to deliver notifications to your device;
  • Google Places services, which process the address text you type when selecting your business address.
• With dispatch partners: limited order and pickup information necessary to collect and deliver orders.
• Within your vendor team: team members you invite can see business information appropriate to their role.
• For legal reasons: with regulators, law enforcement, courts, or other authorities where required by law, or to protect the rights, safety, and property of TrustBasket, our users, or the public.
• Business transfers: if TrustBasket is involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction, subject to this Policy.

Where your data is transferred outside Nigeria (for example, to cloud infrastructure providers), we take steps to ensure it receives an adequate level of protection consistent with the NDPA.

We take the security of your data seriously, particularly your financial and verification data:

• Data is transmitted over encrypted connections (HTTPS/TLS);
• Passwords and transaction PINs are stored using secure hashing/encryption;
• Access to KYC documents and financial details is restricted to authorised personnel on a need-to-know basis;
• Authentication uses short-lived access tokens with refresh-token rotation;
• Withdrawals require your secret transaction PIN.

No system is completely secure. If we become aware of a data breach affecting your personal data, we will notify you and the Nigeria Data Protection Commission (NDPC) as required by law.

We keep your personal data only as long as necessary:

• Account and business data. After closure of account, we will retain your data for up to 5 years.
• KYC documents and financial/transaction records — retained after account closure for as long as required by Nigerian financial, tax, and anti-money-laundering regulations;
• Push tokens — until you log out, uninstall the App, or disable notifications;
• Other data — deleted or anonymised when no longer needed for the purposes described in this Policy.

Under the NDPA, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data (much of your profile and business information can be edited in the App);
• Delete your data, subject to legal retention obligations;
• Object to or restrict certain processing;
• Data portability — receive a copy of your data in a structured, commonly used format;
• Withdraw consent where processing is based on consent;
• Complain to the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated.

To exercise any of these rights, contact us using the details in Section 12. We will respond within the timelines required by law. We may need to verify your identity before acting on a request.

We send push notifications for orders, payouts, verification updates, and important account events. You can disable push notifications in your device settings at any time; however, you may miss time-sensitive order alerts if you do. We may still send you essential service emails (e.g., OTPs, security notices) that are necessary to operate your account.

The App is intended for business use by adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be communicated through the App, email, or push notification, and the “Last Updated” date above will be revised. Your continued use of the App after changes take effect constitutes acceptance of the updated Policy.

For privacy questions, requests, or complaints, contact:

• Email: support@trustbasket.co
• Website: https://trustbasket.co
• Phone number : +234 903 557 7860
• Address: St. pirans street, Jos, Plateau, Nigeria