1. Controller and contact
Will need to cover
- Data controller entity per country (to be confirmed)
- Data protection officer / privacy contact where required
- Supervisory authority details per jurisdiction
2. Data we collect
Will need to cover
- Account data: name, email, phone, locale, country
- Order, pickup, delivery and address data
- Payment records (OJA does not store full card numbers; providers process card data)
- Seller and business verification data — documents stored privately; only last-4 / references of identity numbers
- Dispute evidence, support requests, reviews
- Device, log and cookie data
3. Purposes and lawful bases
Will need to cover
- Purposes: providing orders and Group Buys, verification, fraud prevention, support, payments and payouts, legal compliance, service improvement
- Lawful bases per jurisdiction — NDPR/NDPA (Nigeria), GDPR/UK GDPR, CCPA/CPRA and other US state laws, etc. — to be confirmed by counsel
4. Sharing
Will need to cover
- With sellers: only what's needed to fulfil an order
- With couriers: only deliveries assigned or offered to them
- Group Buy: other buyers' identities are never shown
- Processors: hosting, payments, messaging (email/SMS/WhatsApp), storage — list to be maintained
- Authorities where legally required
5. International transfers
Will need to cover
- Countries where data is processed
- Transfer safeguards (e.g. standard contractual clauses) as required per jurisdiction
6. Retention
Will need to cover
- Retention periods per data category
- Financial, tax and compliance records retained for periods required by law, even after account deletion
- Anonymization of order history after deletion where possible
7. Your rights
Will need to cover
- Access, correction, deletion, portability, objection and restriction — scope differs by jurisdiction
- Export and deletion requests via /account/privacy
- Opt-out rights (e.g. CCPA sale/sharing) if applicable
- Complaints to a supervisory authority
8. Security, children and changes
Will need to cover
- Security measures (summary)
- Minimum age and children's data
- Cookie notice and preferences
- How changes to this notice are communicated
Questions about this draft? Contact OJA support.