Teyweb Privacy Policy

Scope & Regulatory Roles (Data Controller vs. Data Processor)

To understand how your data is handled, it is essential to distinguish between the two distinct capacities in which Teyweb processes personal information:

• Teyweb as a Data Controller: We act as the Data Controller with respect to the personal information of visitors to our corporate website (teyweb.com), registered merchants who create an account to operate a store, merchant billing information, platform telemetry, and direct support interactions with our team.
• Teyweb as a Data Processor / Data Intermediary: When individuals ("Customers" or "Shoppers") browse, place orders, or submit payments on an independent merchant store powered by Teyweb, the Merchant operating that store is the primary Data Controller. Teyweb acts strictly as a Data Processor providing the cloud, catalog, checkout, and order routing software under the Merchant's instruction. If you are a customer of a merchant store, the Merchant's own privacy policy governs their collection and commercial use of your customer data.

1. Information We Collect

A. Information Provided by Merchants

When you register for a Teyweb merchant account and configure your online store, we collect:

• Account Registration Details: Legal business name, trade name, owner/director full name, email address, password (cryptographically hashed using bcrypt), and telephone number.
• Business & KYC Verification Credentials: To satisfy mandatory Anti-Money Laundering (AML), Counter-Financing of Terrorism (CFT), and Know-Your-Customer (KYC) requirements under Central Bank of Nigeria (CBN) regulations, we collect Corporate Affairs Commission (CAC) business registration numbers, National Identification Numbers (NIN), Bank Verification Numbers (BVN), government-issued photo identification cards (International Passport, Driver's License, Voter's Card), and proof of business address.
• Banking & Settlement Information: Nigerian Uniform Bank Account Numbers (NUBAN), commercial bank names, and account holder names verified via interbank resolution for automated sales payouts.
• Billing & Subscription Data: Subscription tier selections, payment card tokens, and billing transaction histories.
• Store Configuration & Assets: Product listings, pricing, digital media uploads, custom domain names, branding logos, and store policies.

B. Customer Information Collected on Behalf of Merchants

When a shopper purchases from or interacts with a Teyweb-powered store, our systems process on the merchant's behalf:

• Order & Fulfillment Details: Buyer name, delivery residential/office address, delivery instructions, phone number, and email address.
• Payment Information: Gateway transaction references, masked payment card identifiers (last 4 digits only; full card credentials and CVVs are processed directly by PCI-DSS certified payment processors and are never stored on Teyweb servers), and chosen payment method.
• Direct Bank Transfer Proof Slips: Where a customer chooses to pay via manual bank transfer, photos or PDF screenshots of bank transfer receipts uploaded by the buyer, securely stored in private cloud object storage for merchant payment verification.
• Customer CRM & History: Order histories, lifetime purchase totals, average order values, and abandoned cart identifiers recorded in the merchant's native customer directory.
• Reviews & Feedback: Ratings, text reviews, and customer service inquiries submitted to the store.

C. Technical, Telemetry & Analytical Information

When you visit Teyweb or any merchant store, we automatically process:

• Privacy-Safe Anonymized Visitor Fingerprints: Unique daily visitor sessions are tracked using a one-way cryptographic SHA-256 hash incorporating the visitor IP address, user-agent string, date, and a private platform salt. Raw IP addresses are not permanently retained in analytical reporting tables.
• Device & Browser Attributes: Device type (desktop, mobile, tablet), browser family, operating system, and screen resolution.
• Traffic Channels & Referrers: Source channels (e.g., Direct, Google, Instagram, Facebook, X/Twitter, TikTok, WhatsApp) and visited page URLs.
• System Performance & Security Logs: Request timestamps, error logs, rate-limiting counters, and session authentication states.

2. Lawful Bases for Processing

Under the NDPA 2023 (Section 25) and GDPR (Article 6), we only process personal data where an established lawful basis applies:

• Contractual Necessity: Processing required to create your account, host your store, process customer orders, disburse sales settlements, and provide customer support.
• Legal & Regulatory Obligations: Processing required to comply with statutory mandates, including KYC/AML verification under CBN directives, tax record-keeping under Federal Inland Revenue Service (FIRS) rules, and responding to lawful court orders.
• Legitimate Interests: Protecting the platform against fraud, enforcing store sanctions, maintaining network security, debugging technical issues, and computing aggregated store analytics.
• Consent: Sending promotional marketing communications, loading non-essential third-party tracking pixels, or participating in voluntary vendor outreach programs. You may withdraw consent at any time.

3. How We Use Personal Information

• Core Store Operations: Provisioning merchant storefronts, maintaining shopping cart sessions, generating digital invoices, and dispatching order notifications.
• Payment Settlements: Ingesting gateway webhooks, calculating platform fees, updating pending/available balances, and executing automated NUBAN payouts.
• Identity Verification & Fraud Prevention: Verifying merchant identity credentials via automated identity checks to prevent e-commerce fraud and financial scams.
• Platform Support & Maintenance: Diagnosing software errors, optimizing platform responsiveness, and maintaining database integrity.
• Multi-Channel Communications: Delivering transactional emails, SMS order alerts, WhatsApp fulfillment updates, and merchant platform announcements.

4. Third-Party Sub-Processors & Data Sharing

We share personal data exclusively with vetted sub-processors essential to operating our infrastructure:

• Cloud & Storage Infrastructure: Cloudflare, Inc. (Content Delivery Network, edge security, SSL certificate issuance via Cloudflare for SaaS, and encrypted object storage for assets and proof slips via Cloudflare R2).
• Payment Gateways: Flutterwave and Paystack (PCI-DSS compliant card processing, USSD channels, split payment settlement, and automated bank transfers).
• Identity & KYC Verification: Dojah Technologies Limited (Automated validation of CAC business registrations, National Identification Numbers, and Bank Verification Numbers).
• Banking Intermediaries: Nigerian Inter-Bank Settlement System (NIBSS) and licensed commercial banks (Real-time NUBAN bank account name resolution and electronic fund settlement).
• Email Delivery: Resend and Amazon Web Services (AWS SES / SMTP) for reliable transactional receipts, password resets, and broadcast messaging.
• SMS & Messaging Delivery: Africa's Talking (SMS dispatch and 2FA codes) and Meta Platforms (WhatsApp Cloud API) for real-time buyer order status tracking.
• Storefront Marketing & Analytics (Merchant-Configured): Where merchants activate third-party tags and buyers grant cookie consent, data may be received by Google LLC (Google Analytics / gtag.js) and Meta Platforms (Meta Pixel).
• Legal Authorities: We may disclose data when required by a subpoena, court order, or binding regulatory warrant issued by a competent Nigerian or international court.

5. Cookies & Tracking Technologies

Teyweb-powered stores employ a granular, privacy-first Cookie Consent Banner that categorizes cookies into four distinct tiers:

• Strictly Necessary Cookies: Essential for platform security, merchant authentication tokens, session persistence, CSRF security tokens, and shopping cart functionality. These cannot be disabled.
• Functional Cookies: Store preferences such as currency, language, display layout, and cookie consent state.
• Analytics Cookies: Measure aggregated platform performance and page interaction metrics.
• Marketing & Retargeting Cookies: Third-party pixels configured by merchants (such as Meta Pixel or Google Ads) to evaluate marketing campaign effectiveness. These are loaded only after the user grants explicit affirmative consent.

Shoppers can review, modify, or revoke their cookie preferences at any time by clicking the "Cookie Choices" trigger located in the storefront footer.

6. Administrative Impersonation for Technical Support

To troubleshoot technical errors, investigate failed order webhooks, or assist merchants with customer support requests, authorized Teyweb support engineers may temporarily access a merchant's administrative dashboard view.

All administrative impersonation events are recorded in immutable audit logs (AdminImpersonationLog), capturing the technician's administrative ID, the specific store ID, the justification reason, session start and expiration timestamps, IP address, user-agent, and the exact count of actions performed. Access is granted strictly on a least-privilege, need-to-know basis.

7. Data Retention & Deletion Schedules

We retain personal information strictly for as long as necessary to fulfill the purposes outlined in this policy:

• Merchant Account Records: Retained throughout the duration of your active store subscription. Upon a verified account deletion request, personal profile data and storefront listings are deleted within thirty (30) days.
• Financial, Tax & Settlement Ledgers: In accordance with Nigerian financial compliance standards, FIRS tax reporting mandates, and anti-money laundering laws, transaction logs, payout references, and VAT accounting records are preserved for a statutory minimum of five (5) to seven (7) years.
• KYC & Verification Documents: Identity verification audit references and CAC records are retained for the duration required by applicable anti-financial crime guidelines.
• Analytical Data: Pseudonymized visitor sessions and aggregated daily traffic metrics are retained in anonymized form for analytical benchmarking.

8. Data Security & Breach Notification

Teyweb implements defense-in-depth security measures to protect personal information against unauthorized access, loss, alteration, or disclosure:

• Cryptographic Encryption: High-grade TLS 1.3 encryption for all data in transit across public networks and AES-256 encryption for data at rest.
• Access Controls: Role-based access control (RBAC), multi-factor authentication (MFA/OTP), and strict network firewall segregation.
• PCI-DSS Compliance: Payment card numbers and CVVs are processed exclusively through certified Level 1 PCI-DSS payment gateways and never touch our application storage.
• 72-Hour Breach Notification: In the event of a security incident resulting in the accidental or unlawful destruction, loss, or unauthorized disclosure of personal data that presents a high risk to your rights, Teyweb will notify the Nigeria Data Protection Commission (NDPC) and affected data controllers within seventy-two (72) hours of confirming the incident.

9. Your Data Protection Rights

Depending on your jurisdiction and subject to applicable statutory limitations, you hold comprehensive rights regarding your personal information under the NDPA 2023, GDPR, and CCPA:

• Right to Information & Access: Obtain confirmation of whether your data is being processed and receive a portable copy of your personal records.
• Right to Rectification: Request prompt correction of inaccurate, outdated, or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where retention is no longer justified by law.
• Right to Restrict or Object: Restrict or object to specific processing activities, including direct marketing and profiling.
• Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format (such as JSON or CSV via our store backup tools).
• Right to Withdraw Consent: Revoke previously granted consent for marketing or non-essential cookies without affecting prior lawful processing.

To exercise any of these rights, please contact our Privacy Team at [email protected]. We will respond to all verified requests within thirty (30) calendar days.

10. Children's Privacy

Teyweb is an e-commerce platform designed strictly for users who are at least eighteen (18) years of age or the age of legal majority in their jurisdiction. We do not knowingly solicit or collect personal information from individuals under the age of 18. If we discover that personal information of a minor has been collected without verified parental or legal guardian consent, we will promptly delete that information from our systems.

11. International Data Transfers

While Teyweb Technologies Limited is incorporated and headquartered in the Federal Republic of Nigeria, our cloud infrastructure (including edge CDN and secure object storage) utilizes globally distributed data centers provided by Cloudflare and AWS. Whenever personal data is transferred across international borders, we ensure adequate cross-border safeguards are maintained, including Standard Contractual Clauses (SCCs), adequacy determinations, and compliance with Part VI of the NDPA 2023.

12. Updates to This Policy

We may periodically revise this Privacy Policy to reflect platform enhancements, new feature releases, legal requirements, or regulatory guidance. In the event of material modifications, we will provide at least thirty (30) days' advance notice via email or a prominent banner on the merchant dashboard prior to the changes taking effect. Your continued use of the platform following the effective date constitutes your acknowledgment of the updated policy.

13. Contact Information & Data Protection Officer

If you have questions, inquiries, or privacy concerns regarding this Privacy Policy or our data handling practices, please contact our dedicated Privacy Team: