Privacy Policy

1. Introduction

Briwill Limited ("Briwill", "we", "our", or "us") is committed to protecting your personal information and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard your information when you visit or use the Briwill e-commerce platform at briwill.co (the "Platform").

This Policy is issued in compliance with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation 2019 (NDPR), and all applicable Nigerian data protection laws administered by the Nigeria Data Protection Commission (NDPC).

By accessing or using our Platform, you acknowledge that you have read, understood, and agree to the collection and use of your information as described in this Privacy Policy. If you do not agree, please do not access the Platform.

INFORMATION WE COLLECT

2. Information We Collect

Information You Provide

We collect personal information you voluntarily provide when you:

  • Register an account on the Platform
  • Make or receive a purchase
  • Sign up as a seller
  • Subscribe to our newsletter or marketing communications
  • Contact our customer support team
  • Participate in surveys, promotions, or competitions

The personal information collected may include: full name, email address, phone number, delivery and billing address, date of birth (for age verification), national identification details where required by law, bank account or payment details, and business registration details (for sellers).

2.2 Information Collected Automatically

When you visit the Platform, we automatically collect certain technical and usage data, including:

  • IP address and approximate location data
  • Device type, browser type, and operating system
  • Pages visited, time spent, and links clicked
  • Referring website addresses
  • Session data and interaction logs
  • Cookies and similar tracking technologies (see Section 9)

2.3 Information from Third Parties

We may receive information about you from third parties, including payment processors, logistics partners, fraud detection services, and social media platforms if you connect your account to those services.

3. Lawful Basis for Processing

In accordance with the NDPA 2023, we process your personal data on one or more of the following lawful bases:

  • Contract: Processing is necessary to perform our contract with you (e.g. processing your order)
  • Legal obligation: Processing is required to comply with applicable Nigerian laws
  • Legitimate interests: Processing is necessary for our legitimate business interests, provided these are not overridden by your rights
  • Consent: Where you have given clear, informed, and freely given consent (e.g. marketing emails)

5. How We Share Your Information

We do not sell your personal information to third parties. We may share your information only in the following circumstances:

  • Sellers: When you make a purchase, we share your name, delivery address, and phone number with the relevant seller solely for order fulfillment purposes. Sellers are prohibited from using your data for any other purpose.
  • Payment Processors: We use licensed payment processors (such as Paystack, Flutterwave, or equivalent providers) to handle transactions. We do not store your raw card details. Please refer to your payment processor's privacy policy for details on how they handle your payment data.
  • Logistics Partners: We share delivery name, address, and phone number with our courier and logistics partners to facilitate delivery.
  • Analytics & Technology Providers: We use trusted third-party analytics and technology service providers (e.g. cloud hosting, customer support tools) who process data on our behalf and are bound by data processing agreements.
  • Legal & Regulatory Authorities: We may disclose your information to law enforcement, courts, regulators, or other government authorities where required by law or to protect the rights, property, or safety of Briwill, our users, or the public.
  • Business Transfers: In the event of a merger, acquisition, or sale of all or part of our business, your personal information may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Our standard retention periods are:

  • Account data: Retained for the duration of your account plus 2 years after account closure
  • Order and transaction data: Retained for 6 years in compliance with Nigerian tax and financial record-keeping laws
  • Marketing consent records: Retained for 3 years from the date of last consent
  • Customer support communications: Retained for 2 years
  • Fraud and security logs: Retained for 5 years

After the applicable retention period, your data is securely deleted or anonymised. You may request earlier deletion subject to our legal obligations — see Section 8.

7.International Data Transfers

Some of our third-party service providers (including cloud hosting and analytics services) may process your data outside of Nigeria. Where we transfer personal data internationally, we ensure that appropriate safeguards are in place in accordance with the NDPA 2023, including contractual protections (Standard Contractual Clauses) or transfers only to jurisdictions recognised as providing adequate data protection

8. Your Rights and Choices

Under the NDPA 2023 and NDPR, you have the following rights regarding your personal information:

  • Right of Access: Request a copy of the personal information we hold about you
  • Right to Rectification: Request correction of inaccurate or incomplete information
  • Right to Erasure: Request deletion of your personal information, subject to legal obligations
  • Right to Restrict Processing: Request that we limit how we use your data
  • Right to Data Portability: Receive your data in a structured, machine-readable format
  • Right to Object: Object to processing based on legitimate interests or for direct marketing
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact our Data Protection Officer at support@briwill.co.co. We will respond to all verified requests within 30 days. If you are dissatisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate, analyse, and improve our Platform. The categories of cookies we use are:

  • Essential Cookies: Necessary for the Platform to function. Cannot be disabled (e.g. shopping cart, login session).
  • Analytics Cookies: Help us understand how users interact with the Platform (e.g. Google Analytics). Can be disabled.
  • Marketing Cookies: Used to show you relevant advertisements on and off the Platform. Require your consent
  • Preference Cookies: Remember your settings and preferences for a better experience.

You can manage your cookie preferences through our Cookie Consent Banner when you first visit the Platform, or at any time via your browser settings. Note that disabling essential cookies may affect your ability to use certain features of the Platform.

10. Data-Security

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. Our security measures include:

  • SSL/TLS encryption for all data in transit
  • Encryption of sensitive data at rest
  • Regular security assessments and penetration testing
  • Role-based access controls limiting employee access to personal data
  • Secure data deletion procedures

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, in accordance with the NDPA 2023.

11. Children's Privacy

Our Platform is intended for users aged 18 and above. We do not knowingly collect personal information from persons under the age of 18. Age verification is required at the point of account registration. If you believe a person under 18 has provided us with personal information, please contact us immediately at privacy@briwill.com and we will take prompt steps to delete such information.

12. Data Protection Officer

Briwill has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection laws.

DPO Contact: support@briwill.co

General Privacy Queries: hello@briwill.co

Phone: Not Avaliable

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Where we make material changes, we will notify you by email (to the address on your account) or by a prominent notice on the Platform, and update the 'Last Updated' date at the top of this document. We encourage you to review this Policy periodically. Continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.

14. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC): ndpc.gov.ng