Privacy Policy

eAuction Nigeria collects only the personal data necessary to operate a secure, regulated auction platform. Depending on how you interact with us, this includes:

• Account data: Full name, email address, phone number, and the password hash created at registration
• KYC & identity documents: Government-issued photo ID (NIN slip, passport, or driver's licence), proof of address, BVN confirmation, and a liveness selfie — required for regulatory compliance
• Payment data: Transaction references, payment status, and bank account details for refunds. Card and bank details are processed by Paystack and are never stored on our servers
• Auction activity: Bids placed, auctions won or listed, deposit history, and communications with other parties
• Device & usage data: IP address, browser type, operating system, referring URLs, and pages visited — collected automatically when you use the Platform
• Communications: Support tickets, emails, and messages you send us

We use your personal data strictly to operate, improve, and protect the Platform:

• Account management: Creating and maintaining your account, authenticating your identity, and keeping your profile current
• Auction operations: Processing bids, recording outcomes, managing deposits, and facilitating buyer–seller transactions
• Regulatory compliance: Verifying identity under AML/CFT obligations and reporting to NFIU and other authorities where required by law
• Payments: Processing winning-bid payments and issuing refunds through Paystack
• Communications: Sending transactional emails (bid confirmations, receipts, auction results) and responding to support requests
• Security & fraud prevention: Detecting and blocking suspicious activity and enforcing platform policies
• Platform improvement: Analysing aggregated, anonymised usage patterns to improve features and fix issues

We do not sell your personal data. Marketing communications are opt-in only and can be withdrawn at any time from your account settings.

Under the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023, we rely on the following lawful bases to process your personal data:

• Contract performance: Processing necessary to register your account, execute bids, and fulfill auction obligations you have entered into
• Legal obligation: KYC/AML verification, fraud reporting to NFIU, and retention of financial records as required by Nigerian law
• Legitimate interests: Platform security, fraud detection, abuse prevention, and internal analytics — where these interests are not overridden by your rights
• Consent: Optional marketing emails and non-essential cookies — withdrawable at any time without affecting prior processing

We share your data only where necessary and with appropriate safeguards in place. Recipients include:

• Paystack: Payment processing, including card tokenisation and bank transfers. Paystack is PCI-DSS compliant and governed by its own privacy policy
• Identity verification providers: Third-party KYC services that cross-reference your ID and BVN against national databases
• Cloud infrastructure: Hosting and storage providers operating within Nigeria or in jurisdictions with equivalent data protection standards
• Regulatory authorities: NITDA, NFIU, EFCC, or other bodies where we are legally required to disclose information
• Transaction counterparties: Limited details (name and contact) shared with the other party only upon successful completion of a sale

We do not share data with advertisers or data brokers. All third-party processors are bound by data processing agreements restricting their use of your data to the specific service they provide.

We use cookies and similar technologies to keep the Platform functional and to understand how it is used:

• Strictly necessary cookies: Required for login sessions, security tokens, and core Platform functionality. These cannot be disabled without breaking the service
• Preference cookies: Remember your settings, such as saved searches or notification preferences, across visits
• Analytics cookies: Aggregate, anonymised data on page visits and feature usage to help us improve the Platform. We do not use Google Analytics or third-party ad trackers

On your first visit you will be shown a cookie consent banner. You may accept or decline non-essential cookies at that point, or update your preferences at any time via your account settings.

As a data subject under the NDPR, you have the following rights regarding your personal data held by eAuction Nigeria:

• Right of access: Request a copy of the personal data we hold about you, including its purpose and who it has been shared with
• Right to rectification: Ask us to correct inaccurate or incomplete data — minor profile changes can be made directly in your account settings
• Right to erasure: Request deletion of your personal data where it is no longer necessary, subject to legal retention obligations
• Right to restrict processing: Ask us to pause processing while a dispute or complaint is being resolved
• Right to data portability: Receive your data in a structured, machine-readable format and transfer it to another service where technically feasible
• Right to object: Object to processing based on legitimate interests; objection to direct marketing takes immediate effect
• Right to withdraw consent: Where processing is consent-based, withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact our DPO. We will respond within 30 days. Identity verification may be required. Rights may be limited where legal obligations or third-party rights apply.

We retain personal data only for as long as necessary for the purpose collected, or as required by Nigerian law:

• Active account data: Retained for the lifetime of your account plus 12 months after closure to resolve post-closure disputes
• KYC & identity documents: Retained for 5 years from the date of last transaction, in line with the Money Laundering (Prevention and Prohibition) Act 2022
• Financial & payment records: Retained for 7 years from the transaction date as required by FIRS and Companies Income Tax Act obligations
• Audit logs & security records: Retained for 2 years to support fraud investigations and security audits
• Marketing preferences: Retained until you withdraw consent or delete your account, whichever comes first

When retention periods expire, data is securely deleted or anonymised. You may request early deletion by contacting our DPO, subject to the legal minimums above.

We implement technical and organisational measures proportionate to the risk of processing your personal data:

• TLS/SSL encryption for all data in transit — HTTP traffic is automatically redirected to HTTPS
• AES-256 encryption for sensitive data stored at rest, including KYC documents and payment tokens
• Bcrypt password hashing — we never store, log, or transmit plain-text passwords
• Role-based access controls (RBAC) — staff access to personal data is strictly limited and individually logged
• Multi-factor authentication (MFA) enforced for all administrative and privileged access
• Regular security audits and penetration tests conducted by independent professionals on a scheduled basis

The Platform is intended exclusively for users aged 18 and above. We do not knowingly collect or process personal data from anyone under 18. Our registration flow requires explicit age confirmation, and KYC verification includes government-issued ID checks that independently confirm age.

If you are a parent or guardian and believe your child has registered or shared personal data with us, please contact us immediately. We will investigate promptly and, where confirmed, delete the child's data and close the account without delay.

For privacy questions, data subject requests, consent withdrawals, or concerns about how we handle your data, contact our Data Protection Officer:

If after engaging with us you remain unsatisfied, you have the right to file a formal complaint with Nigeria's Data Protection Bureau:

You may also review our Terms & Conditions for the full legal framework governing your use of the Platform.