This Notice explains how UkaMart Global Ltd (RC1532291) uses personal information, who receives it and how you can exercise your rights. It covers our website, apps, marketplace, Ukaah and available delivery services. Optional processing requires its own lawful permission; accepting the Terms of Use is not consent to advertising or location tracking.
1 Introduction
Personal data is information that identifies you or can reasonably be linked to you. This Notice applies to visitors, buyers, sellers, vendors, creators, affiliates, delivery recipients and people contacting us. Employment and recruitment processing may be covered by separate notices.
Only enabled services collect the information needed for their stated purposes. A reference to a service does not mean it is available in every location or to every age group.
2 Who controls your personal data
The controller is UkaMart Global Ltd (RC1532291), No. 49 Tetlow Road, Online Plaza (Opposite Haier Thermocool Showroom), Owerri, Imo State, Nigeria. Contact our privacy team at privacy@ukamart.com. This address handles privacy requests and escalations to the person responsible for data protection.
Independent sellers, payment providers and carriers may act as separate controllers for their own lawful activities. Their notices explain those activities. Their involvement does not remove UkaMart's responsibility for processing it controls.
3 Information you provide
We receive account and contact details, login and recovery information, profile details, addresses, preferences, listings, content, reviews, enquiries, messages and supporting documents you submit. Seller onboarding may require identity, business registration, tax and payout information appropriate to the seller's activity.
We also receive age and guardian-confirmation information where relevant. We use proportionate checks and restrict access to verification records. We do not use biometric identity checks or record calls.
Paystack processes payments through its checkout. UkaMart also receives bank transfers through the official order process and uses necessary payment and bank information for reconciliation, refunds and seller or earnings payouts. UkaMart does not store payment authentication secrets such as PINs, card security codes or one-time passcodes. Transaction references, amounts, statuses and necessary refund or payout account details are different from those secrets and may be processed to reconcile transactions and make authorised payments. Do not send payment secrets in messages.
We explain when information is necessary. Without it, we may be unable to fulfil an order, verify eligibility, resolve a claim or pay earnings. Optional profile information may be left blank.
4 Information collected automatically
Technical information includes IP address, device and browser details, app version, session identifiers, access times and security events. Activity information may include searches, product views, cart actions, checkout events, content viewing and interactions. An account identifier may link events to an account; an inference about your interests can be inaccurate.
Essential cookies and similar technologies support sign-in, security and requested functions. Optional analytics and advertising use Meta or Facebook, Google Analytics 4 and TikTok technologies only under the relevant privacy choices. A device permission is not consent to every SDK purpose. The technology notice presented with consent identifies the enabled purposes and provider choices.
5 Location information
An address you enter for delivery is separate from device GPS access. Approximate location may be inferred from an IP address or an area you select to show relevant services and assess account security.
Precise and background device location are separate processing activities. Before either is activated, the feature notice explains its purpose, when collection starts and stops, the recipients and the retention period. Background access requires a separate explanation and permission; permission while using the app does not authorise continuous background access.
You can refuse or revoke device location permission and enter an address or area manually where that meets the service need. Optional location access is not a condition of ordinary browsing. We do not publish your exact device location merely because you grant permission. Under-18 accounts do not use background location or location-based advertising.
6 Marketplace information
We process product, seller, order, delivery, payment, return, refund and dispute records to administer transactions. Sellers and providers supply relevant fulfilment and payment updates. Evidence may include photographs, device identifiers and correspondence relevant to the complaint.
Public listings and reviews are visible to their stated audience. We share a buyer's contact and delivery details with the parties who need them for the transaction, not with every seller or affiliate. A seller must not reuse order information for unrelated marketing without a lawful basis.
7 Ukaah information
We process uploaded videos, images, audio, captions, comments and relevant viewing or engagement records to deliver content and administer the service. Public posts can be copied by viewers; private viewing history does not become public merely because you watch a video.
Creators receive relevant performance information. Affiliate attribution connects qualifying activity to a campaign so that commissions can be calculated. Reports to affiliates use the minimum information needed and do not give unrestricted access to buyer identities or addresses.
8 Communications
We process messages and attachments to deliver communications and support transactions. Automated tools scan in-app messages for fraud and abuse indicators. We rely on our legitimate interest in protecting users and the service for proportionate safety scanning, subject to a documented necessity and balancing assessment and the additional requirements for children's data.
Authorised staff may review relevant flagged or reported messages. A flag is not proof of misconduct. You can object at privacy@ukamart.com; we assess the objection and explain any lawful reason for continuing necessary safety processing. We do not use message content for advertising audience matching.
OneSignal supports notifications. Communications also pass through the platform's messaging infrastructure. We do not claim that messages are inaccessible to UkaMart or end-to-end encrypted. Ordinary message and flagged-case retention are explained in section 16.
9 Purposes and lawful bases
Contractual necessity covers account administration, requested transactions, fulfilment, relevant support and earnings administration where you are a party to the contract. Processing information about another recipient requires its own basis; your contract does not automatically cover every person you name.
Legal obligation applies to records and disclosures required by applicable law. Legitimate interests support proportionate security, fraud prevention, dispute handling and service reliability after assessment of effects on users. Consent supports optional marketing, non-essential analytics, advertising and optional device location where required. We identify the particular purpose and basis rather than treating all bases as interchangeable.
We may use a legally permitted emergency basis to protect vital interests when necessary. We do not infer consent from silence, preselected switches or continued browsing.
10 Personalisation
Product and content recommendations may use your selected interests and relevant activity. Optional profiling is controlled separately from essential account or transaction functions. Paid placements and commercial relationships must be identified.
You can change available preferences or contact privacy@ukamart.com to object to personalisation based on legitimate interests. Refusing optional profiling allows an experience based on general relevance rather than optional behavioural signals. We do not use sensitive characteristics for advertising targeting.
11 Fraud detection and security
Login patterns, transaction changes, device information, listing records and relevant reports can indicate risk. A suspected account takeover or payment problem may trigger verification or a temporary restriction. Access to risk information is limited to authorised purposes.
Information disclosed in a review may be limited to protect other people or an investigation. We nevertheless provide enough explanation for a meaningful challenge where lawful.
12 Automated systems and human review
Automated systems may rank content and flag activity. Final bans, commerce restrictions and adverse payout decisions receive review by a person with authority to change the outcome. Urgent temporary safeguards may operate before that review.
You may explain your position, challenge an error and request human intervention at support@ukamart.com, or contact privacy@ukamart.com about data protection rights. We do not rely on this Notice to authorise a solely automated decision with legal or similarly significant effects that the law does not permit.
13 Marketing and audience matching
Marketing choices are separate for the channels and purposes offered. Necessary security, order and account messages are not promotional subscriptions. You can unsubscribe or write to privacy@ukamart.com, without closing your account.
Audience matching sends selected customer identifiers, such as an email address or telephone number, to Meta, Google or TikTok to match advertising audiences where you have specifically consented. The consent notice identifies the data and destination. Hashing an identifier does not make it anonymous. Provider event sharing for advertising is also covered by the advertising choice.
We stop future use for direct marketing when you object and request removal from audience lists within our control. Provider removal may require processing time, which we explain. Under-18 accounts are excluded from behavioural advertising and audience matching. Withdrawal does not invalidate processing already lawfully completed.
14 Sharing information
Laravel Cloud provides hosting and backups. Paystack processes payments. OneSignal supports push notifications. Meta or Facebook, GA4 and TikTok support the disclosed optional analytics or advertising purposes. Relevant data may also be handled by contracted technical support providers acting under appropriate restrictions.
Sellers and any carrier identified for a transaction receive only information necessary for their roles. Advisers, authorities and courts may receive information where lawfully justified. A business transfer may require limited disclosure with confidentiality and lawful safeguards. Public content is visible to its chosen audience.
We require appropriate security and processing terms from providers acting on our instructions. We do not permit UK entity staff to access Nigerian customer, vendor or order data. This restriction does not mean overseas service providers never process data.
15 International transfers
Hosting, communications, analytics and advertising can involve processing outside Nigeria. Before a restricted transfer, we establish a lawful mechanism, assess the relevant protection and apply the required contractual or other safeguards. Foreign access is included in this assessment.
Contact privacy@ukamart.com for the countries, recipients and transfer safeguards relevant to your information and an appropriate copy or explanation of the safeguards. Accepting this Notice is not blanket consent to transfers. A transfer cannot proceed merely because a provider is named here.
16 Retention and deletion
The following retention schedule applies once this Notice takes effect. A documented legal requirement or specific dispute may require a longer period for relevant records. We explain such retention on request, restrict its use and review the need regularly.
Account and profile data: while the account is active, then remove from active systems within 30 calendar days of verified closure, except separately retained records below. Public content: remove active displays within 7 calendar days of a valid deletion request; complete active-system deletion within 30 calendar days.
Order, payment, tax, payout and associated contract records: 6 years after the transaction or account settlement, whichever is later, subject to any longer legal requirement. Keep only the relevant evidence, not every unrelated message or identifier.
Ordinary messages: 12 months from the message date. Support and safety case files, including relevant flagged messages: 12 months after case closure, with evidence needed for an active legal claim retained under a documented hold. Routine security logs: 90 days unless an incident requires preservation.
Raw precise-location events: no longer than 30 days after the feature session ends. Relevant delivery evidence may instead form part of the transaction record. Optional analytics events: up to 14 months, followed by deletion or irreversible aggregation. Audience lists: review at least every 90 days and remove ineligible or withdrawn records.
Identity document copies: delete within 30 days of completed verification unless a specific legal requirement requires retention. Keep the verification result, essential reference and acceptance or guardian-consent evidence for the relevant account or transaction period. Consent evidence: 6 years after last reliance; minimal marketing suppression data: while needed to honour the opt-out, reviewed annually.
Laravel Cloud backup copies expire after 7 days. A restored backup must have previous deletion and suppression instructions reapplied before ordinary use. These backup limits do not replace the live-data schedule. Account deletion is different from uninstalling the app.
17 Security and incident response
We apply proportionate access controls, protected transmission, staff confidentiality, monitoring and backup controls. No system can eliminate all risk. We investigate suspected incidents, contain exposure and preserve relevant evidence.
Where a personal-data breach is likely to risk individuals' rights and freedoms, we notify the NDPC within the legally required period, including the applicable 72-hour requirement after awareness. We notify affected individuals without undue delay where the legal threshold is met and provide practical steps. We do not wait for a complete investigation when an initial notification is required.
18 Your rights
You may request access and a copy, correction, deletion, restriction or portability where applicable; object to legitimate-interest processing; withdraw consent; object to direct marketing; and exercise protections concerning automated decisions. You may complain without first exhausting our process.
Write to privacy@ukamart.com. We acknowledge within 2 business days and aim to complete requests within 30 calendar days of receipt, or sooner where law requires. If lawful identity checks or an extension are necessary, we explain promptly; we do not silently restart the deadline. Any permitted extension must be explained before the original deadline expires.
We use proportionate identity checks and normally charge no fee. Where law permits a refusal, restriction or fee, we explain the basis and complaint route. We provide the accessible remainder where another person's rights limit part of a request.
19 Children and guardian consent
Accounts are available from age 15. Users aged 15–17 require verified consent from a parent or legal guardian and age-appropriate safeguards. We ask the parent or guardian to confirm their authority and consent through a proportionate verification process before activating the child's account or processing dependent on that consent. An adult's ordinary tick box alone is not our verification process.
Under-18 users cannot sell, receive payouts, join Promote and Earn or host LIVE. An adult must place any purchase as the contracting buyer through their own account. A child's public posting requires the guardian's verified authorisation, including the limited content licence. We minimise precise location and restrict unsolicited adult contact.
Report an underage account or a child's privacy concern to privacy@ukamart.com. We restrict unsafe access and delete or otherwise lawfully handle the data. Necessary safeguarding evidence may be retained securely. We do not require every child to hold a government identity document if an appropriate lawful verification alternative is available.
20 Changes to this Notice
We display the version and effective date of the published Notice and notify users of material changes. We obtain fresh consent where required before starting a new optional purpose. A notice change does not retrospectively legitimise earlier processing.
21 Contact
Privacy requests and guardian enquiries: privacy@ukamart.com. General support: support@ukamart.com. Postal contact: Privacy Team, UkaMart Global Ltd (RC1532291), No. 49 Tetlow Road, Online Plaza (Opposite Haier Thermocool Showroom), Owerri, Imo State, Nigeria.
Do not email passwords, PINs or unnecessary identity documents. We provide a suitable route if further evidence is needed.
22 Complaints
You can complain to our privacy team or directly to the Nigeria Data Protection Commission through its current channels at https://ndpc.gov.ng/. These routes do not remove your right to seek a remedy from a competent court or another competent authority.
For these service targets, business days mean Monday to Friday excluding Nigerian public holidays. Calendar days include weekends and holidays. Any shorter mandatory legal deadline takes priority.