1. Personal Data We Collect and Lawful Bases

Under the NDPA 2023, we collect and process Personal Data based on lawful grounds including consent, contract performance, legal obligation, legitimate interests, and vital interests. Categories include:

• Identity Data: full name, BVN (where required for financial transactions), government-issued ID, date of birth.
• Contact Data: email address, phone number, residential/business address (Nigeria).
• Financial Data: bank account details, payment card information, transaction history.
• Technical Data: IP address, device identifiers, browsing activity on Xaysi platforms.
• Transaction Data: order history, vendor sales records, returns, and customer support interactions.

We process your data to facilitate marketplace transactions, prevent fraud, comply with Nigerian financial regulations, improve our services, and communicate important updates.

2. Your Rights as a Nigerian Data Subject

The Nigeria Data Protection Act 2023 grants you the following enforceable rights:

Right to Access (Section 34)

You may request confirmation of whether we process your personal data and obtain a copy of such data, including information about processing purposes and recipients.

Right to Rectification (Section 35)

You have the right to correct inaccurate or incomplete personal data without undue delay.

Right to Erasure (Right to be Forgotten) (Section 36)

You may request deletion of your personal data when the data is no longer necessary, consent is withdrawn, or processing is unlawful.

Right to Restriction of Processing (Section 37)

You can request limited processing of your data while we verify accuracy or lawful grounds.

Right to Data Portability (Section 38)

You may request to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

Right to Object (Section 39)

You may object to processing based on legitimate interests, direct marketing (including profiling), or processing for scientific/historical research.

Rights Related to Automated Decision-Making (Section 40)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects.

3. Exercising Your Rights Under NDPA 2023

To exercise any of the above rights, you may:

• Submit a request via your Xaysi account dashboard (where applicable).
• Contact our Data Protection Officer (DPO) directly at dpo@xaysi.ca or via the contact details in Section 8 below.
• Call our Nigeria support line: +234 1 227 8950 (Monday–Friday, 9am–5pm WAT).

We will respond to verified requests within 30 days as required by the NDPA. If we need additional time, we will notify you within the initial 30-day period. There is no fee for exercising your rights unless requests are manifestly unfounded or excessive.

4. Cross-Border Data Transfers

As a global marketplace, Xaysi may transfer personal data outside Nigeria to our servers or service providers. Under the NDPA 2023, we ensure adequate protection measures such as:

• Transfer to countries with adequate data protection laws as determined by NITDA.
• Standard Contractual Clauses (SCCs) or binding corporate rules for international transfers.
• Explicit consent from data subjects where required.

Data transferred outside Nigeria remains subject to the protections of this policy and applicable Nigerian law.

5. Data Retention and Security

We retain personal data only as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations (e.g., financial recordkeeping under Nigerian banking regulations), resolve disputes, and enforce our agreements.

Xaysi implements technical and organizational security measures including encryption, access controls, regular security audits, and staff training to protect against unauthorized access, alteration, or destruction of personal data — in compliance with NITDA’s security guidelines.

6. Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you and the Nigeria Data Protection Commission (NDPC) / NITDA within 72 hours of becoming aware of the breach, as required under the NDPA 2023.

7. Cookies and Digital Marketing

We use cookies and similar tracking technologies to enhance your experience on Xaysi. For Nigerian users, we obtain your consent before placing non-essential cookies (e.g., marketing or analytics cookies) in line with NITDA’s guidance on consent management. You may withdraw consent at any time via your browser settings or our cookie preference center.

8. Contact Our Data Protection Officer (DPO)

If you have questions, complaints, or wish to exercise your privacy rights, please contact our DPO:

• Email: dpo@xaysi.ca
• Nigeria Office Address: Xaysi Nigeria, 15A Bishop Aboyade Cole Street, Victoria Island, Lagos, Nigeria.
• Phone: +234 1 227 8950

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng if you believe your data protection rights have been violated.