Privacy Policy

1. PRELIMINARY PROVISIONS

1.1 This Privacy Policy (the "Policy") sets out the basis upon which Emani Technologies Limited, registration number RC 7231120, having its registered or principal place of business at No. 2 Osholake Street, T.M. Meadows Estate, Ebute Metta, Lagos State, Nigeria and trading under the name Emani ("Emani", "we", "us" or "our"), collects, receives, records, organises, structures, stores, adapts, retrieves, consults, uses, discloses, transmits, restricts, erases or otherwise processes Personal Data in connection with the Platform and the Services.

1.2 This Policy is issued pursuant to, and shall be construed in accordance with, the Nigeria Data Protection Act 2023 (the "NDPA"), the Nigeria Data Protection Act General Application and Implementation Directive 2025 (the "GAID"), and all subsidiary legislation, regulatory directives, codes, standards and binding requirements applicable to the processing of Personal Data in Nigeria from time to time (collectively, "Applicable Data Protection Law").

1.3 By accessing or using the Platform, establishing or administering an Account, submitting Personal Data to us, placing or fulfilling an Order, using SafeCheckout, communicating with us or otherwise using any Service, you acknowledge that you have received and had the opportunity to review this Policy. Where Applicable Data Protection Law requires consent for a particular Processing Activity, such consent shall be requested separately and shall not be inferred solely from your continued use of the Platform.

1.4 This Policy constitutes a privacy notice and does not create contractual rights beyond those conferred by Applicable Law. Nothing herein shall operate to exclude, restrict or derogate from any right, remedy or protection which may not lawfully be excluded, restricted or derogated from.

2. STATUS AND IDENTITY OF THE DATA CONTROLLER

2.1 In respect of the Processing Activities for which Emani determines the purposes and means of Processing, Emani acts as a Data Controller within the meaning of the NDPA.

2.2 Certain third parties, including regulated payment-service providers, identity-verification providers, financial institutions, delivery-service providers and communications providers, may process Personal Data as independent or joint controllers where they determine their own purposes and means of Processing or discharge separate statutory or regulatory obligations. Any such Processing shall also be governed by the applicable third party's privacy notice.

2.3 Nothing in this Policy shall be construed as rendering Emani the controller of Processing undertaken independently by a Vendor, Buyer or other User outside the purposes and means determined by Emani. Each Vendor shall be solely responsible for ensuring that its independent collection and use of Buyer Personal Data complies with Applicable Data Protection Law.

2.4 Privacy enquiries, Data Subject Requests and complaints may be submitted to privacy@emani.app. General service enquiries should be submitted to support@emani.app.

3. INTERPRETATION

3.1 In this Policy, unless the context otherwise requires:

"Account" means a Buyer, Vendor, administrator, representative or other account maintained on or in connection with the Platform.

"Applicable Law" means all laws, regulations, judicial decisions, regulatory requirements and binding rules applicable to Emani, a User, a transaction or a Processing Activity from time to time.

"Buyer", "Vendor", "Order", "Payment Partner" and "SafeCheckout" shall have the meanings ascribed to them in the Emani Terms of Service.

"Consent" means a freely given, specific, informed and unambiguous indication of a Data Subject's wishes by a statement or clear affirmative action, where consent constitutes a valid lawful basis under Applicable Data Protection Law.

"Data Subject" means an identified or identifiable natural person to whom Personal Data relates.

"Personal Data" means any information relating to an identified or identifiable natural person and includes any information defined as personal data under Applicable Data Protection Law.

"Platform" means the Emani website, web or mobile applications, account interfaces, order pages, checkout services, SafeCheckout, Emani Balance, vendor tools and all associated systems operated by or on behalf of Emani.

"Processing" or "Process" means any operation or set of operations performed upon Personal Data, whether or not by automated means.

"Sensitive Personal Data" has the meaning prescribed by Applicable Data Protection Law and includes any category accorded enhanced protection by law.

"Services" means all services, functionality, communications, support and transaction-management facilities supplied by or on behalf of Emani through or in connection with the Platform.

3.2 References to legislation include such legislation as amended, consolidated, re-enacted or replaced from time to time. The words "including", "includes" and "in particular" shall be construed without limitation.

4. SCOPE AND APPLICATION

4.1 This Policy applies to Personal Data processed in connection with:

• access to or use of the Platform;
• registration, verification, operation, security or closure of an Account;
• the creation, acceptance, payment, fulfilment, delivery, cancellation, return or refund of an Order;
• the administration of SafeCheckout, Emani Balance, payouts, reversals, complaints and Disputes;
• Vendor onboarding, product listings, inventory tools, customer-management tools and optional image-enhancement functionality;
• customer support, legal, compliance, fraud-prevention and risk-management activities; and
• email, SMS, WhatsApp, telephone, push notification, social-media and other communications relating to the Services.

4.2 This Policy does not apply to the independent Processing Activities of any third-party website, application, social-media platform or service merely because the Platform contains a link to or integration with that service. You are responsible for reviewing the privacy notice applicable to each such third party.

5. CATEGORIES OF PERSONAL DATA PROCESSED

5.1 The categories of Personal Data processed by Emani shall depend upon the capacity in which a Data Subject interacts with the Platform, the Services used, the applicable risk profile and any legal or regulatory requirement. Such Personal Data may include the categories specified in this Clause 5.

5.2 Identity, contact and Account data

Names, telephone numbers, email addresses, residential, business and delivery addresses, dates of birth, profile photographs, social-media handles, usernames, Account type and status, communication preferences, authorised representatives, team members, authentication records, one-time password records, device-session records and protected cryptographic representations of passwords.

5.3 Vendor, business and beneficial-ownership data

Business names, trading names, business descriptions, contact particulars, Corporate Affairs Commission information, registration and tax identifiers, constitutional or supporting documents, ownership and control information, representative authority, product information, inventory information, transaction history, risk classification, Account limits and verification status.

5.4 Identity-verification and compliance data

Where reasonably necessary and lawful, Bank Verification Numbers, National Identification Numbers, Corporate Affairs Commission details, identity-document information, addresses, dates of birth, biometric or liveness results supplied by an authorised verification provider, name-match and account-match results, sanctions or politically exposed person screening results, fraud indicators, compliance determinations, provider references, masked identifiers and verification timestamps.

5.5 Order, payment and financial data

Order descriptions, items, quantities, prices, fees, delivery charges, Order status, payment amounts, transaction references, payment method type, confirmations, failures, reversals, refunds, releases, payouts, Emani Balance ledger entries, payout-account details, bank name, account number, account-holder name, verification result and chargeback or recovery information.

5.6 Emani does not ordinarily receive or retain complete payment-card credentials where such credentials are collected directly by a regulated payment processor. Any payment information displayed to Emani may be tokenised, masked or otherwise limited to information reasonably required for reconciliation, support, risk management and legal compliance.

5.7 Transaction, delivery and Dispute data

Order communications, delivery instructions, recipient details, courier or logistics records, tracking information, delivery codes, timestamps, proof of delivery, photographs, videos, audio recordings, correspondence, witness accounts, expert reports, return records, inspection results, settlement communications and decisions relating to a complaint, refund or Dispute.

5.8 Technical and usage data

Internet Protocol addresses, device identifiers, browser and operating-system information, application version, referral source, pages or features accessed, clickstream and navigation events, login records, approximate location inferred from technical information, cookies, software-development-kit data, diagnostics, crash reports, audit trails and security events.

5.9 Communications and support data

Messages, emails, telephone call information, support requests, feedback, survey responses, marketing preferences, complaints, legal correspondence and any documents or information voluntarily supplied to Emani.

5.10 You shall not submit Personal Data which is irrelevant or excessive for the purpose for which it is requested, including complete payment-card credentials, passwords or unrelated identity documents. Where a submission contains unnecessary Personal Data, Emani may redact, restrict, return or securely delete that information, subject to Applicable Law.

6. SOURCES OF PERSONAL DATA

6.1 Emani may obtain Personal Data:

• directly from the Data Subject;
• from a Buyer, Vendor, Account administrator or authorised representative;
• automatically from a device, browser, cookie, software-development kit or use of the Platform;
• from Paga or another regulated Payment Partner;
• from banks, payment processors, identity-verification providers, fraud-prevention providers and public or official registers;
• from delivery, logistics, communications, cloud-hosting and customer-support providers;
• from social-media platforms or integrations expressly connected or used by a User;
• from another party to an Order or Dispute; and
• from a regulator, court, law-enforcement authority, professional adviser or other lawful source.

6.2 Where a person provides Personal Data relating to another Data Subject, that person represents and warrants that it has lawful authority to do so, has provided any notice required by Applicable Data Protection Law and has not supplied information which is misleading, excessive or obtained unlawfully.

7. PURPOSES AND LAWFUL BASES OF PROCESSING

7.1 Emani shall Process Personal Data only for specified, explicit and legitimate purposes and upon one or more lawful bases recognised under Applicable Data Protection Law.

7.2 Performance of a contract and pre-contractual measures

Emani may Process Personal Data where necessary to enter into or perform the Emani Terms of Service, administer an Account, facilitate an Order, operate SafeCheckout, process a payment instruction or payout, arrange supported delivery, provide support, administer a refund or return, resolve a Dispute, maintain transaction records or otherwise provide a Service requested by the Data Subject.

7.3 Compliance with legal and regulatory obligations

Emani may Process Personal Data where necessary to comply with obligations relating to data protection, payment services, anti-money laundering, counter-terrorist financing, sanctions, consumer protection, taxation, accounting, record retention, court orders, regulatory directives, law-enforcement requests and other requirements imposed by Applicable Law.

7.4 Legitimate interests

Emani may Process Personal Data where necessary for a legitimate interest pursued by Emani or a third party, provided that such interest is not overridden by the Data Subject's rights, freedoms or reasonable expectations. Relevant interests may include securing the Platform, preventing and investigating fraud, enforcing contractual rights, defending legal claims, improving service reliability, conducting proportionate analytics, managing operational risk, protecting Users and maintaining accurate business records.

7.5 Before relying upon legitimate interests for a material Processing Activity, Emani shall assess the necessity and proportionality of the Processing and balance the relevant interest against the likely impact upon Data Subjects. A Data Subject may object to such Processing in accordance with Clause 19.

7.6 Consent

Emani may rely upon Consent where required or appropriate, including for certain marketing communications, optional cookies, optional integrations, optional image-enhancement functions or the Processing of Sensitive Personal Data where no other lawful basis is available. Consent may be withdrawn at any time without affecting the lawfulness of Processing undertaken before withdrawal.

7.7 Other lawful bases

Where permitted by Applicable Data Protection Law, Emani may Process Personal Data to protect the vital interests of a Data Subject or another person, to perform a task carried out in the public interest, or upon any other lawful basis applicable to the relevant circumstances.

7.8 Where Emani proposes to Process Personal Data for a purpose materially incompatible with the purpose for which it was obtained, Emani shall provide any additional notice and obtain any Consent required by Applicable Data Protection Law before commencing such Processing.

8. IDENTITY VERIFICATION, KYC AND SENSITIVE PERSONAL DATA

8.1 Emani or an authorised provider may request identity, business, beneficial-ownership or financial-account information where reasonably necessary for Account verification, payment-service onboarding, fraud prevention, risk management, statutory compliance or the protection of Users.

8.2 Bank Verification Numbers, National Identification Numbers, biometric or liveness information and other protected identifiers shall be requested only where supported by a lawful basis and proportionate to the relevant purpose. At or before collection, Emani shall disclose, to the extent required by Applicable Law, whether the information is mandatory, the purpose for which it is required, the provider performing the verification, the categories of information returned to Emani and the consequences of failing to provide the information.

8.3 Where reasonably practicable, Emani shall retain a verification outcome, provider reference or masked identifier instead of a complete identifier. Complete identifiers shall not be stored for longer than is reasonably necessary for the relevant lawful purpose.

8.4 Sensitive Personal Data shall be subject to enhanced access controls, confidentiality measures, retention restrictions and any additional safeguard required by Applicable Data Protection Law.

9. PAYMENT PARTNER AND FINANCIAL PROCESSING

9.1 Regulated payment and account services made available in connection with the Platform are provided by Pagatech Limited or such other duly authorised Payment Partner as may be disclosed to Users.

9.2 Emani is not a bank, does not accept deposits and does not itself issue electronic money. The Payment Partner may collect or independently Process Personal Data for account opening, payment execution, reconciliation, fraud prevention, regulatory reporting and the discharge of its own legal obligations.

9.3 Emani and the Payment Partner may exchange Account identifiers, contact details, verification information, transaction references, payment status, payout information, refund instructions, fraud indicators and complaint records to the extent reasonably necessary for the provision, security and regulation of payment-related services.

9.4 The Payment Partner's terms and privacy notice shall apply to Processing undertaken by it as an independent controller. Nothing in this Policy purports to describe or limit any independent statutory duty of the Payment Partner.

10. ARTIFICIAL INTELLIGENCE AND AUTOMATED PROCESSING

10.1 Emani may deploy artificial-intelligence or machine-assisted tools to enhance product images at a User's request, detect prohibited or fraudulent activity, classify support or Dispute material, construct chronologies, identify potentially relevant records or prepare summaries for human review.

10.2 Artificial-intelligence output may be incomplete, inaccurate or inappropriate and shall not, without meaningful human consideration, constitute the final determination of a Dispute involving Held Funds. An authorised reviewer shall assess the relevant original evidence and remain responsible for the determination.

10.3 Emani shall not subject a Data Subject to a decision based solely upon automated Processing which produces legal or similarly significant effects except where such Processing is lawful and the safeguards required by Applicable Data Protection Law have been implemented.

10.4 Where a qualifying automated decision is made, the Data Subject may request meaningful information concerning the logic and likely consequences of the Processing, request human intervention, present a position and contest the decision, subject to Applicable Law and the protection of confidential security controls and third-party rights.

10.5 Users shall not submit confidential, Sensitive Personal Data or third-party material to an optional artificial-intelligence feature unless reasonably necessary, authorised and expressly requested for the relevant purpose.

11. DISCLOSURE AND RECIPIENTS OF PERSONAL DATA

11.1 Emani may disclose Personal Data, strictly to the extent reasonably necessary and lawful, to:

• Buyers, Vendors, authorised representatives and other parties to an Order or Dispute;
• Paga and other regulated payment, banking or financial-service providers;
• identity-verification, anti-fraud, screening and compliance providers;
• delivery, logistics, messaging, email, SMS, WhatsApp, cloud-hosting, security, analytics and customer-support providers;
• professional advisers, insurers, auditors, accountants and prospective or actual financiers;
• a purchaser, investor, successor or other participant in a bona fide merger, acquisition, financing, restructuring or transfer of all or part of Emani's business or assets, subject to appropriate confidentiality restrictions;
• courts, regulators, law-enforcement bodies, tax authorities and other public authorities where disclosure is required or lawfully requested; and
• any other person where the Data Subject has authorised the disclosure or Applicable Law otherwise permits it.

11.2 Service providers acting on Emani's instructions shall be engaged under contractual terms requiring confidentiality, appropriate security, purpose limitation and compliance with Applicable Data Protection Law. Emani shall take reasonable steps to assess and supervise such providers in a manner proportionate to the nature and risk of the Processing.

11.3 Emani does not sell Personal Data. Emani shall not disclose Personal Data to a Vendor for unrelated marketing or independent commercial exploitation without an appropriate lawful basis.

11.4 A Vendor receiving Buyer Personal Data shall use it solely for lawful Order fulfilment, delivery, customer service, returns, legal compliance and any other purpose separately authorised by the Buyer. A Vendor shall not sell, scrape, enrich, disclose or use such Personal Data for unsolicited marketing contrary to Applicable Law.

12. INTERNATIONAL TRANSFERS

12.1 Personal Data may be stored in or accessed from jurisdictions outside Nigeria where Emani or a service provider maintains infrastructure or personnel.

12.2 Emani shall undertake an international transfer only where permitted by Applicable Data Protection Law and shall, as applicable, rely upon an adequacy decision, appropriate contractual safeguards, binding corporate rules, an approved certification mechanism, explicit Consent in legally permitted circumstances, necessity for contract performance, the establishment or defence of legal claims, or another recognised transfer basis.

12.3 Emani shall assess the nature of the Personal Data, the purpose and duration of the transfer, the destination jurisdiction, the recipient, the availability of enforceable rights and the technical, organisational and contractual safeguards applicable to the transfer. Supplementary safeguards may include encryption, pseudonymisation, access restrictions, data minimisation and contractual restrictions on onward transfer.

12.4 Further information concerning the safeguards applicable to a relevant transfer may be requested through privacy@emani.app, subject to lawful confidentiality, security and third-party restrictions.

13. DATA RETENTION AND DELETION

13.1 Emani shall retain Personal Data only for so long as is reasonably necessary for the purpose for which it was collected, to satisfy a legal, regulatory, accounting or reporting requirement, to establish, exercise or defend a legal claim, to prevent fraud or to enforce the Emani Terms of Service.

13.2 Subject to any longer period required or justified by Applicable Law, Emani shall ordinarily apply the following retention criteria:

• Account and profile data: for the duration of the Account and for such limited period thereafter as is required for closure, reactivation prevention, fraud control, audit and legal claims;
• identity and verification records: for the duration required by the applicable verification, payment, anti-money laundering or regulatory obligation, with complete identifiers deleted or masked earlier where practicable;
• Order, payment, payout, refund and accounting records: for the period required by applicable financial, tax, accounting, consumer-protection and limitation laws;
• Dispute, chargeback, delivery and evidential records: until final resolution and expiry of any applicable review, chargeback, complaint or limitation period;
• support and communications records: for the period reasonably necessary to resolve the matter, assure quality, prevent abuse and maintain evidence of the communication;
• security, audit and fraud-prevention logs: for a risk-proportionate period reasonably necessary to detect, investigate and prevent abuse; and
• marketing records: until Consent is withdrawn or an objection is received, after which a minimal suppression record may be retained to honour the preference.

13.3 Upon expiry of the applicable retention period, Personal Data shall be securely deleted, anonymised or placed beyond operational use, except to the extent continued retention is required or permitted by Applicable Law.

13.4 Account closure shall not require Emani to erase records which must lawfully be retained or which are reasonably required for an unresolved Order, payment, payout, refund, Dispute, fraud investigation, regulatory matter or legal claim.

14. SECURITY AND CONFIDENTIALITY

14.1 Emani shall implement and maintain technical and organisational measures appropriate to the nature, scope, context and purposes of Processing and to the likelihood and severity of risk to Data Subjects. Such measures may include encryption in transit and at rest where appropriate, access controls, authentication controls, role-based permissions, logging, network and application security, vulnerability management, backups, incident-response procedures, staff confidentiality obligations, vendor due diligence and periodic control review.

14.2 No transmission or storage system is completely secure. Accordingly, Emani does not warrant that unauthorised access, loss or misuse can never occur; provided that nothing in this Clause 14.2 shall exclude or limit any duty or liability which may not lawfully be excluded or limited.

14.3 Each User shall maintain the confidentiality of passwords, one-time codes and device access, use reasonable security precautions, promptly notify Emani of suspected compromise and refrain from transmitting credentials or unnecessary Sensitive Personal Data through ordinary support channels.

15. PERSONAL DATA BREACHES

15.1 Emani shall maintain procedures for identifying, assessing, containing, investigating and remediating an actual or suspected Personal Data breach.

15.2 Where notification to the Nigeria Data Protection Commission or an affected Data Subject is required by Applicable Data Protection Law, Emani shall make such notification within the applicable statutory period and shall include the information required by law, taking into account the nature and consequences of the breach and the measures taken or proposed in response.

15.3 Emani may notify an affected Data Subject where notification is reasonably necessary to enable protective action even if notification is not strictly mandated, provided that any notice shall be coordinated with law enforcement or another competent authority where legally required.

16. COOKIES AND SIMILAR TECHNOLOGIES

16.1 Emani may use cookies, local storage, pixels, tags, software-development kits and comparable technologies for authentication, security, fraud prevention, preference management, service functionality, performance measurement and analytics.

16.2 Technologies strictly necessary for the operation or security of the Platform may be used without Consent where Applicable Law permits. Non-essential analytics, advertising or similar technologies shall be deployed only upon an appropriate lawful basis and, where required, after Consent has been obtained through the cookie controls made available on the Platform.

16.3 A User may modify available cookie preferences or browser settings; however, disabling a necessary technology may impair or prevent use of a feature. Withdrawal of Consent shall not affect the lawfulness of prior Processing.

17. DIRECT MARKETING AND COMMUNICATIONS

17.1 Emani may send transactional or service communications reasonably necessary for Account security, Orders, payment status, payouts, delivery, Disputes, legal notices and material service changes. Such communications are not promotional and may continue notwithstanding a marketing opt-out where reasonably necessary to perform a contract or comply with Applicable Law.

17.2 Promotional communications shall be sent only upon a lawful basis. A recipient may withdraw Consent or object at any time by using the unsubscribe facility or contacting Emani. Emani may retain a minimal suppression record to ensure that the preference is respected.

17.3 Emani shall not condition the supply of a Service upon Consent to unrelated direct marketing where such Consent would not be freely given.

18. DATA ACCURACY AND DATA MINIMISATION

18.1 Emani shall take reasonable steps to ensure that Personal Data is adequate, relevant, limited to what is necessary and, having regard to the purposes for which it is Processed, accurate and kept up to date where necessary.

18.2 Users shall provide complete and accurate information and shall update Account, identity, delivery and payout information promptly. Emani may verify, correct, restrict or request supporting evidence in respect of information reasonably believed to be incomplete, inaccurate, misleading or fraudulent.

19. RIGHTS OF DATA SUBJECTS

19.1 Subject to Applicable Data Protection Law and any lawful exemption, a Data Subject may have the right to:

• obtain confirmation as to whether Emani Processes Personal Data concerning the Data Subject and obtain access to such Personal Data and prescribed supplementary information;
• request correction of inaccurate Personal Data and completion of incomplete Personal Data;
• request erasure of Personal Data where continued Processing is not lawfully justified;
• request restriction of Processing in circumstances prescribed by law;
• object to Processing based upon legitimate interests or undertaken for direct marketing;
• withdraw Consent at any time where Processing is based upon Consent;
• receive eligible Personal Data in a structured, commonly used and machine-readable format and request transmission to another controller where applicable;
• request human intervention, express a point of view and contest a qualifying automated decision; and
• lodge a complaint with the Nigeria Data Protection Commission or another competent supervisory authority.

19.2 A request may be submitted to privacy@emani.app and should describe the right sought to be exercised and the Personal Data or Processing Activity concerned. Emani may request information reasonably necessary to verify identity, authority and the security of the request.

19.3 Emani shall respond within the period prescribed by Applicable Data Protection Law. Where a request is manifestly unfounded, excessive, repetitive, prejudicial to another person's rights or subject to a lawful exemption, Emani may refuse the request or charge a reasonable fee to the extent permitted by law and shall provide the reasons and available complaint route.

19.4 Data Subject rights are not absolute. Emani may retain or continue to Process Personal Data where necessary to comply with a legal obligation, protect another person's rights, prevent fraud, maintain transaction integrity, establish or defend a legal claim, or rely upon another lawful ground recognised by Applicable Data Protection Law.

20. CHILDREN

20.1 The Platform is intended solely for persons aged eighteen years or older. Emani does not knowingly permit a person under eighteen years to establish a Buyer or Vendor Account or use a regulated payment feature.

20.2 If Emani becomes aware that a child's Personal Data has been collected contrary to Clause 20.1 or Applicable Law, Emani shall take reasonable steps to erase or restrict such Personal Data, subject to any lawful requirement to preserve transaction, safeguarding, fraud-prevention or legal-claim records.

21. CHANGES TO THIS POLICY

21.1 Emani may amend this Policy from time to time to reflect changes in Applicable Law, regulatory guidance, the Platform, the Services, Processing Activities or security practices.

21.2 The amended Policy shall state its effective date and shall apply prospectively. Where an amendment materially affects a Data Subject's rights or the manner in which Personal Data is Processed, Emani shall provide reasonable notice through the Platform, email or another appropriate channel. Where Consent is required for a new or materially different Processing Activity, Emani shall obtain such Consent separately.

22. CONTACT, COMPLAINTS AND SUPERVISORY AUTHORITY

Data Controller: EMANI , trading as Emani

Registration Number: RC 7231120

Registered or Principal Address: LAGOS, NIGERIA

Privacy: privacy@emani.app

Legal: legal@emani.app

Support: support@emani.app

22.1 A person dissatisfied with Emani's handling of Personal Data or a Data Subject Request may submit a complaint to privacy@emani.app. Emani may escalate the matter for internal legal or compliance review and shall respond within a reasonable period or such period as Applicable Law requires.

22.2 Without prejudice to any other remedy, a Data Subject may complain to the Nigeria Data Protection Commission at https://ndpc.gov.ng or any other competent authority.