Privacy Policy

AfriCraft Commerce Technologies Ltd (RC: 9453883) is a company registered in Nigeria, operating from Maitama Extension, Abuja, Nigeria. We operate the AfriCraft marketplace platform at craftafrika.com and related digital properties. For privacy matters, you can contact us at: • Email: info@craftafrika.com • WhatsApp: +234 811 690 3388 • Address: AfriCraft Hub, Maitama Extension, Abuja, Nigeria

We collect the following categories of personal data: Account Information: When you register, we collect your name, email address, password (encrypted), country, and optionally your phone number and profile photo. Purchase Information: When you place an order, we collect your shipping address, billing information (processed by Stripe or Paystack — we do not store card details), and order history. Vendor Information: If you register as a vendor, we additionally collect your shop name, shop description, bank account details for payouts, and product listings. Usage Data: We collect information about how you use our platform — pages visited, products viewed, search terms, and session duration — to improve our services. Communications: We retain records of messages you send through our platform, contact form submissions, and WhatsApp communications with our support team. Heritage Points Data: We maintain records of your Heritage Points transactions, tier status, referral activity, and redemption history. Newsletter Subscriptions: If you subscribe to our newsletter, we store your email address and subscription preferences.

We use your personal data for the following purposes: To provide our services: Processing orders, managing your account, facilitating communication between buyers and vendors, and operating the Heritage Points system. To process payments: Your payment information is passed securely to Stripe (international) or Paystack (African payments) for processing. We do not store payment card details on our servers. To send transactional communications: Order confirmations, shipping notifications, order status updates, and Heritage Points notifications are sent to the email address on your account. To send marketing communications: With your consent, we send our newsletter and promotional emails. You can unsubscribe at any time. To improve our platform: Usage data helps us understand how to improve the AfriCraft experience for buyers, vendors, and artisans. To comply with legal obligations: We may be required to process or retain certain data to comply with Nigerian law, tax regulations, and international legal requirements. To prevent fraud and ensure security: We monitor platform activity to detect and prevent fraudulent transactions, account abuse, and security threats.

For users in the European Economic Area (EEA) and United Kingdom, we process your data under the following legal bases: Contract performance: Processing necessary to fulfil your orders and provide our services. Legitimate interests: Improving our platform, fraud prevention, and sending service-related communications. Consent: Sending marketing emails and newsletters (you can withdraw consent at any time). Legal obligation: Retaining financial records as required by Nigerian tax law and applicable regulations.

We share your data only as necessary to provide our services: Artisan/Vendors: When you place an order, the relevant vendor receives your name, shipping address, and order details necessary to fulfil your purchase. Payment Processors: Stripe and Paystack receive payment information to process transactions. These providers have their own privacy policies and security standards. Shipping Partners: GIG Logistics and DHL receive shipping addresses and contact details to deliver your orders. Email Service Providers: We use SMTP email services to send transactional and marketing emails. Analytics: We use anonymised analytics data to understand platform usage. This data does not personally identify individual users. Legal Requirements: We may disclose data to law enforcement or regulatory bodies when required to do so by law or court order. We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

We retain your personal data for the following periods: Account data: For the duration of your account and 3 years after account deletion (for legal and dispute resolution purposes). Order and transaction records: 7 years (required by Nigerian tax law and financial regulations). Heritage Points history: For the duration of your account. Marketing email list: Until you unsubscribe or request deletion. Support communications: 2 years from last contact. Usage analytics: 26 months in anonymised form. When data is no longer needed, we delete it securely or anonymise it so it can no longer be associated with you.

Depending on your location, you may have the following rights regarding your personal data: Right of Access: You can request a copy of the personal data we hold about you. Right to Rectification: You can request that we correct inaccurate data. You can update most account information directly in your Profile settings. Right to Erasure: You can request deletion of your personal data, subject to our legal retention obligations. Right to Restrict Processing: You can request that we limit how we use your data in certain circumstances. Right to Data Portability: You can request your data in a structured, machine-readable format. Right to Object: You can object to processing based on legitimate interests, including profiling for marketing purposes. Right to Withdraw Consent: Where processing is based on consent (e.g., marketing emails), you can withdraw consent at any time. To exercise any of these rights, contact us at info.africraft@gmail.com. We will respond within 30 days.

AfriCraft uses cookies and similar technologies to: • Keep you logged in between sessions (authentication cookies) • Remember your preferences and cart contents (functional cookies) • Understand how users navigate the platform (analytics cookies) • Prevent fraud and ensure security (security cookies) Essential cookies (authentication, security) are required for the platform to function. Analytics cookies can be declined without affecting your ability to use AfriCraft. By using AfriCraft, you consent to our use of essential cookies. You can manage cookie preferences in your browser settings.

We take the security of your personal data seriously. Measures we employ include: • All data transmission is encrypted using TLS/HTTPS • Passwords are hashed using bcrypt (industry standard) — we cannot see your password • Payment card data is never stored on our servers — it is processed directly by Stripe and Paystack • Access to personal data is restricted to AfriCraft staff on a need-to-know basis • We conduct regular security reviews of our platform While we take reasonable precautions, no internet transmission is 100% secure. If you suspect your account has been compromised, contact us immediately.

AfriCraft is not intended for use by children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately and we will delete it.

AfriCraft is based in Nigeria. When you use our platform from the EEA, UK, or other jurisdictions, your data is transferred to Nigeria. We ensure appropriate safeguards are in place for such transfers. Our cloud infrastructure (database, hosting) uses Neon (PostgreSQL) and Vercel, both of which comply with international data protection standards.

We may update this Privacy Policy from time to time. Material changes will be communicated by email to registered users or by a prominent notice on the platform. The date of the latest revision is shown at the bottom of this page. Continued use of AfriCraft after changes are posted constitutes acceptance of the updated policy.

For privacy-related questions, data access requests, or complaints, contact us at: Email: info.africraft@gmail.com WhatsApp: +234 811 690 3388 Post: AfriCraft Commerce Technologies Ltd, Maitama Extension, Abuja, Nigeria We aim to respond to all privacy enquiries within 30 days. If you are in the EEA or UK and are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority (for UK users: the Information Commissioner's Office, ico.org.uk).