Data Privacy Policy

Digital African Woman Network Limited ("DAW", "we", "us", or "our") is committed to protecting the privacy and personal data of every Cooperative Member, Seller, and Buyer who uses our Platform. We have built our data handling practices to comply with the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Regulation ("NDPR"), and, where applicable, the EU/UK General Data Protection Regulation ("GDPR") and other relevant African data protection laws, including Kenya's Data Protection Act, South Africa's POPIA, and Ghana's Data Protection Act.

In practice, this compliance commitment means we:

• Only process Personal Data where we have a valid legal basis to do so (consent, contract, legal obligation, or legitimate interest);
• Collect the minimum data necessary for each purpose and do not sell Personal Data to third parties;
• Use encryption in transit and at rest, access controls, and regular security assessments to protect data;
• Bind our Third-Party Service Providers, including payment processors and cloud hosting providers, to appropriate data protection and confidentiality obligations;
• Apply recognised safeguards, such as standard contractual clauses, to any international transfer of Personal Data;
• Honour data subject rights requests (access, rectification, erasure, restriction, portability, objection, and consent withdrawal) within statutory timelines;
• Notify the Nigeria Data Protection Commission (NDPC) and affected Users of any data breach that poses a risk to their rights and freedoms, in line with statutory timelines;
• Maintain a designated Data Protection Officer as the point of contact for all privacy-related enquiries.

This section summarises our compliance posture; the remainder of this Policy sets out, in detail, how and why we process your Personal Data.

This Data Privacy Policy ("Policy") explains how DAW collects, uses, shares, stores, and protects Personal Data belonging to everyone who interacts with the DAW platform, mobile application, website, and related services (together, the "Platform").

This Policy applies equally to all categories of Users, including:

• Cooperative Members: individuals who register on the Platform to access community, training, mentorship, networking, or informational resources.
• Sellers: individuals or businesses who register to list, market, or sell goods and/or services through the Platform, including women-owned businesses and entrepreneurs.
• Buyers: individuals or organisations who use the Platform to browse, purchase, or pay for goods and/or services offered by Sellers.

By accessing or using the Platform in any of these capacities, you agree to the collection and use of information in accordance with this Policy. If you do not agree with any part of this Policy, you should discontinue use of the Platform.

The Platform is operated by Digital African Woman Network Limited. For the purposes of applicable data protection laws, DAW acts as the Data Controller for Personal Data processed through the Platform, except where a Seller independently determines the purposes of processing data about their own customers, in which case the Seller may act as an independent Data Controller for that specific data.

• "Personal Data": any information relating to an identified or identifiable natural person.
• "Processing": any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Sensitive Personal Data": data revealing identity documents, financial account details, biometric data, or other categories classified as sensitive under applicable law.
• "Data Subject": the individual to whom Personal Data relates (i.e. a Cooperative Member, Buyer, or Seller).
• "Third-Party Service Providers": external companies engaged by DAW to support Platform operations, such as payment processors, cloud hosting providers, and analytics providers.
• "Applicable Data Protection Laws": the Nigeria Data Protection Act 2023 and the NDPR, the EU/UK GDPR where applicable, and other relevant African data protection laws.

• Directly from you, when you register, complete a profile, list a product, place an order, or contact us.
• Automatically, through cookies, log files, and similar technologies as you use the Platform (see Section 13).
• From third parties, such as identity verification providers, payment processors, or publicly available business registries, used to confirm Seller information.

• Consent: where you have given clear consent for us to process your Personal Data for a specific purpose (e.g. marketing communications).
• Contractual necessity: where processing is necessary to perform our contract with you, such as facilitating a purchase or a Seller payout.
• Legal obligation: where processing is required to comply with a legal or regulatory obligation, such as KYC/anti-fraud checks.
• Legitimate interests: where processing is necessary for our legitimate interests (e.g. Platform security, fraud prevention, service improvement), provided these interests are not overridden by your rights.

• To create and manage your Cooperative Member, Buyer, or Seller account.
• To process orders, payments, refunds, and Seller payouts.
• To verify Seller identity and business legitimacy, and to prevent fraud.
• To provide customer support and respond to enquiries or complaints.
• To personalise your experience, including product recommendations and relevant training or mentorship opportunities.
• To send transactional notifications (e.g. order confirmations, shipment updates) and, where you have opted in, marketing communications.
• To monitor, analyse, and improve Platform performance, security, and user experience.
• To comply with applicable legal, tax, and regulatory obligations.
• To detect, investigate, and prevent fraudulent, unauthorised, or illegal activity on the Platform.

We do not sell your Personal Data. We may share Personal Data with the following categories of recipients, only as necessary for the purposes described in this Policy:

Because some of our Third-Party Service Providers (including Microsoft Azure) may process data on servers located outside Nigeria and outside your country of residence, your Personal Data may be transferred internationally. Where this occurs, we ensure appropriate safeguards are in place, such as standard contractual clauses, adequacy determinations, or equivalent measures recognised under the NDPR, GDPR, and other applicable African data protection laws, to ensure your data continues to receive an adequate level of protection.

• For as long as your account remains active on the Platform.
• For Sellers, transaction and identity verification records may be retained for a minimum period after account closure to comply with tax, anti-fraud, and financial regulatory requirements.
• Where required, to resolve disputes, enforce our agreements, or comply with legal obligations.

Once retention is no longer necessary, we securely delete, anonymise, or aggregate the relevant data.

We implement appropriate technical and organisational measures designed to protect Personal Data against unauthorised access, alteration, disclosure, or destruction, including encryption of data in transit and at rest, access controls, regular security assessments, and secure hosting through Azure. However, no method of transmission or storage is completely secure, and while we strive to protect your Personal Data, we cannot guarantee its absolute security.

The Platform uses cookies and similar technologies to recognise you, remember your preferences, keep you logged in, and gather analytics on Platform usage. You can control or disable cookies through your browser settings; however, doing so may affect certain Platform functionality.

• Access: request confirmation of, and access to, the Personal Data we hold about you.
• Rectification: request correction of inaccurate or incomplete Personal Data.
• Erasure: request deletion of your Personal Data, subject to legal or contractual retention requirements.
• Restriction: request that we limit the processing of your Personal Data in certain circumstances.
• Data portability: request a copy of your Personal Data in a structured, commonly used, machine-readable format.
• Objection: object to processing based on legitimate interests or for direct marketing purposes.
• Withdraw consent: withdraw previously given consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Lodge a complaint: lodge a complaint with the Nigeria Data Protection Commission (NDPC) or another applicable supervisory authority in your jurisdiction.

To exercise any of these rights, please contact us using the details in Section 21. We may need to verify your identity before actioning your request.

The Platform is intended solely for individuals aged 18 years and above. We do not knowingly collect Personal Data from anyone under the age of 18. If we become aware that we have inadvertently collected Personal Data from a person under 18, we will take reasonable steps to delete such data promptly. If you believe a minor has provided us with Personal Data, please contact us immediately at daw@digitalafricanwoman.com.

• Verification documents are used strictly for identity confirmation, fraud prevention, and regulatory compliance, and are stored securely with restricted internal access.
• A Seller's business name and public storefront details may be visible to Buyers; personal identification documents are never publicly displayed.
• Sellers are independently responsible for complying with applicable consumer protection and data protection obligations in respect of any Buyer data they receive to fulfil an order, and must not use such data for unrelated marketing without the Buyer's consent.

Buyer payment details are processed directly by our licensed payment processors (Paystack/Vigipay) and are not retained in full by DAW. Buyers' delivery and contact information is shared with the relevant Seller solely to the extent necessary to fulfil an order, and Sellers are contractually prohibited from using this information for any other purpose.

Where you have opted in, we may send you newsletters, promotional offers, or updates about DAW programmes and marketplace opportunities. You may withdraw your consent and unsubscribe at any time using the link provided in each communication or by contacting us directly.

The Platform may contain links to third-party websites or services not operated by DAW. We are not responsible for the privacy practices of such third parties, and we encourage you to review their respective privacy policies before providing any Personal Data.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission and/or other applicable regulatory authorities, and affected Users, in accordance with the timelines and requirements prescribed under Applicable Data Protection Laws.

If you have questions, concerns, or requests regarding this Policy or the processing of your Personal Data, please contact our Data Protection Officer:

• Entity: Digital African Woman Network Limited
• Attention: Data Protection Officer
• Email: daw@digitalafricanwoman.com
• Address: 42 Local Airport Road, Vibranium Valley, Ikeja, Nigeria

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify Users of material changes via the Platform or by email, and will indicate the effective date at the top of this Policy. Continued use of the Platform after such changes constitutes acceptance of the revised Policy.

This Policy is governed by the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Regulation, without prejudice to any additional rights Users may have under the GDPR or other applicable African data protection laws based on their location.