Privacy Policy

This notice covers the Debelu marketing site, marketplace accounts, stores, orders and related support interactions. Debelu Digital Technologies Limited (RC 9299179), incorporated in Nigeria, is the controller for the personal data it uses to operate these services. A seller or a payment provider may have separate responsibilities for information it handles for its own purposes.

For a question or a privacy request, contact privacy@debelu.com. Use security@debelu.com for a suspected security incident. Do not email your password, login code, delivery PIN or unnecessary identity documents.

Account information can include your name, email address, selected campus and profile details. Store setup and seller review may require additional store, contact and verification information. Creating a basic account is not itself proof of identity or seller approval.

Listings can contain descriptions, prices, photos and availability information. Orders contain the selected products, parties, delivery or pickup details, payment references and progress. Support requests, messages, dispute evidence and privacy requests contain the information you choose or need to submit for that purpose.

If you join a campus launch waitlist or apply as a founding vendor, we use your name, WhatsApp number or email address, hostel or area, what you sell, any Instagram handle you add and the campaign link you arrived from. We use these details to review applications and contact you about that campus launch, and we do not share them with sellers. Ask privacy@debelu.com to remove you from a launch list.

The service can receive technical information such as request metadata, device or browser information, authentication/session activity and application errors. Activity records can include product interactions, favorites, order changes and the actions needed to investigate a problem.

Payment, authentication, delivery-message and other providers can return references, outcomes or technical events needed for the feature. Buyers, sellers or support staff may provide information relating to the same order. We should not collect unrelated private information merely because someone includes it in a report.

Information is used to create and maintain accounts, display relevant listings, operate stores, communicate order details, process payments and support handover. The relevant contractual basis applies only to information genuinely necessary for the service you request.

Support, dispute review and account recovery use the account or order record and the evidence needed to understand the issue. Security checks and investigation of misuse may rely on legitimate interests, subject to assessing necessity and the effect on the people involved.

Consent applies where an optional activity requires your choice, such as a separately offered marketing communication. You may withdraw consent without making earlier lawful processing unlawful. Contractual necessity is not a substitute for consent to an unrelated optional activity.

A legal obligation can require particular records or disclosure. Legitimate interests do not override rights automatically; the purpose and impact must be considered. We will explain a materially different use before it begins and identify a lawful basis, obtaining fresh consent where required.

Your published store details, product photos and listing content are intended to be viewed by other users. Do not place identity documents, home details, bank credentials or another person’s private information in a public listing.

The buyer and seller may receive the contact and fulfillment details needed for their order. That access is for the transaction, not permission to add someone to a marketing list, publish their information, or use it to harass them. Support and authorized staff may access records when their task requires it.

Payments are handled through the payment flow and its provider. Debelu uses payment references and results to connect the payment to the order, wallet and any refund or withdrawal. Do not send raw card credentials or bank authentication codes through messages or support attachments.

Infrastructure, monitoring, messaging and assistance providers may process information for the relevant feature. Read the service-provider information for purposes and role distinctions. A provider may also have independent legal duties; the same legal role does not apply to every service.

When you use Nduzi, the request and information needed to respond can be processed by an AI service. AI can also assist staff in drafting a support response using the relevant ticket and conversation content. Avoid including unrelated sensitive details in either channel.

AI output can be inaccurate. A suggestion does not establish stock, a refund decision or a legal entitlement. For a decision with a significant effect on you, ask support to explain the outcome and consider your account of the facts; do not treat a generated response as the only route for review.

Order, account-security and service messages can be necessary for the activity you requested. Optional channels or marketing should follow the choices offered for that channel. Where optional WhatsApp messaging is used, an opt-out record may be needed to prevent future unwanted messages.

Contact support if a notification preference is not available or a message appears to ignore your choice. Opting out of a marketing message does not cancel an order or prevent an essential account-security message. Do not send credentials when requesting a preference change.

Authentication can use cookies or browser storage to maintain the session. Theme preferences use local storage; service-worker or browser caches may keep resources for the website. These are different technologies with different removal controls.

Optional analytics or tracking must have an appropriate legal basis and notice. The Cookie Policy explains the current storage categories and browser controls. It does not imply that an advertising tracker or consent widget is active when it is not supplied by the feature.

Records are kept according to their purpose and any applicable obligation: for example, an active account, an unresolved order, fraud prevention, a dispute, accounting requirements or a legal claim. A record should not be retained indefinitely merely because storage is available.

A deletion request does not necessarily remove every financial, audit, shared-message or legally required record immediately. Backups and external providers may require a separate lifecycle. Ask for an explanation of retained categories and the relevant reason. Use the account-deletion guidance or contact privacy@debelu.com; no universal deletion period is promised here.

Infrastructure or service providers may process data outside Nigeria. A provider’s global presence does not itself prove that your data is stored in a particular country. You may ask privacy@debelu.com for information about the processing relevant to your request.

An international transfer requires a lawful basis and safeguards appropriate to Nigerian data-protection requirements. Contracts or other permitted mechanisms must support adequate protection; a claim that all information stays in Nigeria or Europe is not made by this notice.

Access restrictions, authentication and operational checks help reduce risk, but no online service can promise that unauthorized access or loss is impossible. Do not reuse a compromised password, share account access, or disclose a delivery PIN before inspection.

Report suspicious activity promptly with the relevant reference and a description. If a personal-data incident occurs, any notifications and response must follow the applicable legal requirements and the facts of the incident. No certification, audit status or absolute encryption guarantee is implied.

Depending on the circumstances, you can request information or access, correction, deletion, restriction, portability, objection, withdrawal of consent and review of a qualifying automated decision. These rights can have lawful limits, such as protecting another person’s information or retaining a required transaction record.

Send the request to privacy@debelu.com with enough information to locate the account or activity and explain what you want to do. Debelu may need proportionate identity verification. We will respond within the period required by applicable law and explain a lawful extension, limit or refusal. Request only the verification needed; do not send an identity document unless it is specifically requested through an appropriate channel. You can also complain to the Nigeria Data Protection Commission; contacting Debelu first is not a condition for exercising a statutory remedy.

Debelu is designed for campus trading and is not a service directed at young children. Do not submit a child’s private information or use an account on someone else’s behalf without lawful authority. A campus selection or account registration does not verify a person’s age.

If information about a child has been submitted or a user cannot lawfully consent to the relevant processing, contact privacy@debelu.com so the situation can be assessed. The applicable parental or guardian requirements must be addressed; this notice does not create an automated age-check that the service does not perform.

A material change in data use should be explained before it applies, and further consent obtained when legally required. Check the relevant feature notice as well as this page. A policy update is not permission to use old data for an unrelated purpose without a lawful basis.

Read the Terms, Cookie Policy and Data Processing Addendum where applicable. For regulatory background, the NDPC FAQs explain Nigeria’s data-protection framework.

We may preserve or disclose relevant information where required by a valid legal process, to establish or defend a legal claim, or where another lawful basis justifies a necessary response to fraud or a serious safety risk. We assess the request, limit disclosure to its lawful purpose and give notice where legally permitted and appropriate. A request from another user does not automatically entitle them to private records.

A seller who independently uses buyer information is responsible for that use and its own legal duties. A seller must not add you to a marketing list merely because you placed an order. Report misuse to privacy@debelu.com. The platform’s review of a complaint does not remove your right to approach the NDPC.

Information needed for account security, a requested transaction or a legal obligation may be necessary to provide that feature. If you choose not to supply necessary information, we will explain the affected feature rather than treat the choice as consent to an unrelated use. Optional marketing and optional tracking must be distinguished from necessary service activity.

We assess retention by record type and purpose, including unresolved orders, statutory accounting obligations, fraud prevention and legal claims. Ask us for the period or criteria relevant to your record and an explanation of any retained data following an erasure request. A limitation of liability in another contract does not reduce a statutory data-protection right.