Privacy policy

NinoMarket provides customer-relationship, sales, invoicing and team tools to businesses ("customers"). For the business data you put into NinoMarket, your company is the data controller and NinoMarket acts as data processor. For your account and billing details, NinoMarket is the controller.

Account details (name, email, job title), company details, the records your team enters (leads, customers, contacts, invoices, payments, tasks), billing records and payment references, support messages, and basic technical logs (errors, sign-in events).

We do not store card numbers. Card payments are processed by Paystack.

To provide the service, keep accounts secure, process subscription payments, give support, send service notices, and meet legal and tax obligations. We do not sell personal data and we do not use your business records for advertising.

Only service providers needed to run NinoMarket: secure cloud hosting and database, Paystack for payments, and (when enabled) email or WhatsApp messaging providers. Each processes data only on our instructions. Some providers may store data outside Nigeria; where they do, we rely on safeguards permitted by the NDPA.

Each company's records are separated at the database level. Staff of one company cannot see another company's customers, staff, invoices or performance. NinoMarket platform staff access company data only when needed for support, billing or security, and those actions are logged.

Business records are kept while your subscription is active and for 90 days after it ends, so you can renew or export. Billing and payment records are kept for at least 6 years for tax and accounting purposes. You can ask us to delete your company's data earlier, subject to those legal retention duties.

You may request access to, correction of, or deletion of your personal data, object to processing, or withdraw consent where processing relies on consent. Contact us through the support page. You may also complain to the Nigeria Data Protection Commission (NDPC).

Encrypted connections, role-based access, company-level data separation, audit logs of sensitive actions, and regular backups by our hosting provider. No system is perfectly secure; we will notify affected customers and the NDPC of qualifying breaches as required by law.