AskAm privacy notice

Version: Value
Effective date: Value

1. Who is responsible for personal data

Value, Value, Value is the
controller for personal data described in this notice unless a specific
transaction says otherwise.

Privacy contact/Data Protection Officer: Value, Value,
Value.

AskAm must complete and record whether it is a data controller or processor of
major importance and whether it must register with the Nigeria Data Protection
Commission or appoint a Data Protection Officer. This notice does not itself
satisfy those obligations.

2. Scope

This notice covers customers using WhatsApp, suppliers and their team members,
delivery agents, prospective suppliers, admin/operations staff, support
contacts, and visitors to AskAm-controlled web pages or applications.

Third parties such as WhatsApp/Meta, a Baileys-linked WhatsApp account,
Paystack, banks, app stores, and a supplier may process data for their own
purposes under their notices. AskAm's notice does not replace theirs.

3. Personal data AskAm processes

Depending on the relationship, AskAm may process:

• Identity and contact: name, phone/WhatsApp number, email, business name,

staff role, and support contact details.

• Supplier due diligence: CAC/registration details, licences,

category-specific evidence, verification status, document metadata and
uploaded documents, operating hours, and team authorization.

• Orders and communications: text requests, category and zone choices,

interactive-list selections, catalogue lines and quantities, quotes,
substitutions, order references, messages needed for fulfilment, complaints,
dispute evidence, and resolution notes. AskAm does not accept image, audio, or
voice messages as order input, although a customer may separately provide
proportionate evidence through an approved support channel.

• Location and delivery: selected service zone, address or place details,

a precise WhatsApp location only when deliberately shared, supplier operating
centres/radii, foreground supplier-app location readings, accuracy and
capture time, delivery route/status, and logistics contact details. AskAm
does not use customer or supplier background tracking in the current product.

• Transaction and bank records: amounts, fee breakdown, payment reference

and status, refunds, disputes/chargebacks, ledger and reconciliation entries,
supplier bank name, resolved account name, encrypted account data, last four
digits, transfer recipient/reference, and payout status. AskAm does not store
full payment-card credentials, PINs, or banking passwords.

• Device, security, and technical: supplier-app push token, device/platform

metadata, IP address, session and authentication records, OTP attempts,
webhook/provider message IDs, audit logs, error/availability logs, and fraud
or abuse signals.

• Preferences and consent: accepted terms/privacy versions,

communication preferences, consent or objection records, and withdrawal
time.

• Derived operational data: supplier eligibility/ranking reasons,

response and fulfilment performance, marketplace metrics, and exception
status. AskAm should not infer sensitive traits unrelated to the transaction.

AskAm will not request NIN, BVN, health diagnosis, prescription, biometric, or
other sensitive data unless a separately approved feature has a documented
legal basis, necessity assessment, security design, retention rule, and clear
notice.

4. Sources

AskAm obtains data:

• directly from the person through WhatsApp, the supplier app, admin portal,

support, or submitted documents;

• from an authorized supplier owner, field agent, or team administrator;

• from suppliers, riders, or logistics providers fulfilling an order;

• from Paystack, banks, WhatsApp/Meta, Evolution, Expo, maps/geocoding, hosting,

and notification providers;

• from CAC, NAFDAC, PCN, or another lawful public/verification source; and

• from AskAm's order, security, audit, and support systems.

A person providing another adult's data must be authorized and should give
that person this notice.

5. Purposes and lawful bases

AskAm will identify the applicable lawful basis under the Nigeria Data
Protection Act for each deployed processing activity. The proposed register is:

| Purpose | Typical data | Proposed lawful basis |
| ------------------------------------------------------------------------- | --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
| Receive requests, match suppliers, collect quotes, form and fulfil orders | phone, request, category, zone/location, quote, delivery | Contract or steps requested before contract |
| Process payments, refunds and supplier payouts | transaction, bank, order, ledger | Contract and legal obligation |
| Supplier onboarding and regulated-category checks | identity, business and licence documents | Contract, legal obligation, and legitimate interests in marketplace safety |
| Authenticate users and deliver service messages | phone/email, OTP, session, device token | Contract and legitimate interests in secure service delivery |
| Prevent fraud, abuse, counterfeit goods and security incidents | transaction, device, audit, risk indicators | Legal obligation and legitimate interests, balanced against individual rights |
| Resolve complaints, disputes and chargebacks | communications, delivery/payment evidence | Contract, legal obligation, legitimate interests, and legal claims |
| Precise location matching | deliberately shared customer location or foreground supplier location | Contract/steps requested by the person; consent where required for device permission |
| Meet accounting, tax, regulator and law-enforcement duties | identity and transaction records | Legal obligation |
| Measure service health and improve operations | minimized order, response, outcome and technical data | Legitimate interests, with aggregation/minimization where possible |
| Marketing | contact and preference | Consent or another documented lawful basis permitted by law; never assumed from transactional use |

Consent is not used where processing is objectively required to perform an
order or legal duty. Where AskAm relies on consent, it must be specific,
informed, affirmative, recorded, and as easy to withdraw as to give. Withdrawal
does not make earlier lawful processing unlawful.

AskAm must document a legitimate-interest assessment before relying on that
basis for a new activity.

6. Matching and automated decisions

AskAm uses configured rules to determine eligible suppliers and rank candidates
using category, service area or distance, active/live status, opening hours,
capacity, response availability, and other approved operational signals.

The rules determine which suppliers receive an invitation; they do not make a
medical diagnosis, determine creditworthiness, or remove a customer's legal
rights. A customer or supplier may request human review of a material matching,
suspension, or dispute decision through Value.

Before introducing machine-learning scoring, personalized pricing, biometric
identity, credit decisions, or another decision with legal or similarly
significant effects, AskAm must complete a data protection impact assessment,
provide the required explanation and safeguards, and update this notice.

7. Sharing

AskAm shares only what is reasonably necessary with:

• eligible suppliers receiving a request and the selected supplier fulfilling

it;

• supplier staff and delivery/logistics providers assigned to the order;

• Paystack, banks, card/payment networks, and fraud/chargeback participants;

• Meta/WhatsApp or an approved Evolution deployment for messaging;

• Expo and mobile platform services for supplier push notifications;

• map/geocoding providers for location search and matching;

• cloud hosting, database, storage, monitoring, email, and security providers;

• professional advisers, auditors, insurers, and investors under appropriate

confidentiality and minimization;

• regulators, courts, law enforcement, or other recipients where legally

required or necessary to establish, exercise, or defend legal claims; and

• a buyer or successor in a genuine corporate transaction, subject to lawful

safeguards and notice where required.

AskAm does not sell personal data. AskAm does not give every broadcast supplier
a customer's precise location or full identity: supplier messages should use
the minimum area/request information needed to quote, with more delivery detail
shared only after selection and payment where necessary.

The processor register, contracts, data locations, and sub-processors must be
approved before production and reviewed at least annually.

8. International transfers

Some providers may process data outside Nigeria. Before a transfer, AskAm must
identify the destination and recipient role, confirm an applicable lawful
transfer basis or adequacy mechanism, execute required contractual safeguards,
assess the recipient and government-access risk, apply minimization/security,
and record the transfer.

[LEGAL/PRIVACY REVIEW: complete and publish the actual country/provider list or a maintained link after the deployment architecture is final.]

9. Retention

AskAm keeps personal data only for as long as necessary for the stated purpose,
legal/accounting obligations, fraud and dispute defence, safety, and enforceable
contracts. Proposed periods are in the internal
[Retention schedule](data-retention-schedule.md).

The public summary should state, after approval:

• incomplete conversation/request data: Value;

• completed order and transaction records: Value;

• supplier due-diligence records: Value;

• support/dispute records: Value;

• security/audit logs: Value; and

• backups: Value.

AskAm may retain a restricted record longer for an active dispute,
chargeback, fraud investigation, court/regulator preservation requirement, or
legal claim. When the reason ends, AskAm deletes, anonymizes, or securely
destroys the data. A deletion request cannot require AskAm to erase a record it
must lawfully keep, but processing should be restricted where appropriate.

10. Individual rights

Subject to applicable law, a person may ask AskAm to:

• confirm whether AskAm processes their data and provide access and required

information;

• correct inaccurate or incomplete data;

• delete data or restrict processing;

• object to processing, including direct marketing;

• withdraw consent;

• receive portable data where applicable;

• obtain safeguards concerning qualifying automated decisions; and

• complain to the Nigeria Data Protection Commission or seek another lawful

remedy.

Send a request to Value. AskAm may verify identity
proportionately and ask for clarification. AskAm will acknowledge within
[PROPOSED: 2 business days] and respond within the period required by current
law. If more time is lawfully needed, AskAm will explain why and give an update.
AskAm does not charge unless permitted for a manifestly unfounded or excessive
request.

Authorized agents must show authority. AskAm will not disclose one person's
data to another merely because they share a phone or business.

11. Security

AskAm uses risk-appropriate measures intended to protect confidentiality,
integrity, availability, and accountability, including role-based access,
authenticated sessions, encryption of supplier payout-account data, private
document routes, environment-managed secrets, signed webhooks, idempotent
financial events, audit trails, backups, monitoring, and incident response.

No system is perfectly secure. People should protect OTPs, passwords, devices,
payment details, and delivery codes, and report suspected compromise to
Value. AskAm staff will never ask for a card PIN, banking
password, or OTP through WhatsApp.

12. Personal-data breaches

AskAm maintains an incident and breach register. It will assess an incident
promptly, contain it, preserve evidence, and notify the Nigeria Data Protection
Commission within the legally required period where the breach is likely to
create the relevant risk. The Nigeria Data Protection Act provides a 72-hour
notification requirement in the applicable circumstances. AskAm will inform
affected people as required, using clear information about likely effects and
protective steps.

13. Children

AskAm's current service is for adults. AskAm does not knowingly profile or
market to children. A regulated feature involving children would require a
separate age/authority design, child-rights assessment, privacy notice, and
legal approval before launch.

14. Marketing and cookies

Transactional messages needed for an order are distinct from marketing.
Marketing preferences and opt-outs must be respected across supported
channels.

The current admin portal is an internal authenticated tool. If AskAm launches a
public website using non-essential cookies, advertising pixels, or behavioral
analytics, it must deploy a truthful cookie notice/preference control and update
this section before collection begins. Strictly necessary security/session
technologies should be described but should not be presented as optional if the
service cannot function without them.

15. Changes and complaints

AskAm may update this notice to reflect law, providers, or product changes. A
material change will receive reasonable notice and, where required, renewed
consent or acceptance. Older versions remain available from [POLICY ARCHIVE URL].

Contact AskAm first at Value so the privacy team can investigate.
This does not limit the right to contact the Nigeria Data Protection Commission:
[https://ndpc.gov.ng/](https://ndpc.gov.ng/).