Maruchicart Privacy Policy

1.    INTRODUCTION

1.1 Background
Maruchicart is Africa’s evolving one-stop B2B trade and procurement marketplace where African suppliers and manufacturers join global suppliers to meet global buyers.

Our mission is to digitize the offerings and merchandize of Africa’s brick & mortar wholesale market clusters, specialized manufacturing clusters, SME manufacturers, and African creatives into an aggregate trade destination platform for Africa; by this, African supplier can compete with global suppliers on a unified platform, and by this accelerate trade and capital conversion and unlock new possibilities to increase Africa's contribution to the global non-oil merchandise.

Nigeria Data Protection Regulation 2019 ('NITDA Regulation'), which is the extant body of rules regulating the subject in Nigeria sets out legal obligation for organizations in regard to the processing of personal data.

1.2   Purpose and scope of this Policy

Maruchicart is committed to protecting and respecting the privacy of individuals.

This Privacy Policy outlines how Maruchicart collects, stores and uses personal information that it collects about customers, clients, vendors, prospects, and visitors to the Maruchicart websites.

This Privacy Policy is intended for circulation to our customers, suppliers, and other interested parties.

This Privacy Policy is intended for use in conjunction with the Maruchicart Data Protection Policy, the Terms of Website Use and the Cookies Policy. These documents set out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.

1.3   Lawful Basis for Processing

We will only process your data if there is a lawful basis for such processing. The lawful basis for processing
Personal Data will be one of the following:

•    Consent. You have given Maruchicart clear and specific consent for processing your data.
• Contract. You, or the organisation you work for, have entered into a contract with us in which the processing of your data is required for transactions
• Legal obligation. We need to process your data in order to comply with a common law or statutory obligation.
• Legitimate interests. We have a legitimate interest in processing your data in circumstances where it would be reasonable for you to expect such data processing and where there is a minimal privacy
impact. Some direct marketing activities may be based on legitimate interests. Where legitimate interest is deemed to apply, Maruchicart will have carried out a Legitimate Interest Assessment.

1.4   Contact details:

For the purpose of data protection legislation, the data controller is Maruchicart E-commerce Services Limited registered with corporate affairs commission, Nigeria with RC. No. 1802338.

1.5   Maruchicart Website
It is possible that our websites contain links to other sites. Maruchicart is not responsible for the privacy practices or the content of such websites. The websites may also include comment fields, chat rooms, forums, message boards, and news groups. Please remember that any information that is disclosed in these areas becomes public information and you should exercise caution when deciding to disclose your personal information.

2.    HOW WE GET YOUR PERSONAL DATA

2.1   Information about you that you give us

(a)  when filling in forms on our websites;
(b)  by corresponding with us by phone, email, chats or otherwise;
(c)  by calling one of our support helplines, where calls may be recorded;
(d) when you register to use our websites; 
(e)  when you subscribe to our services;
(f)  when you place an order on one of our websites;
(g) when you, leave reviews for products, participate in discussion boards or other social media functions on our websites;
(h) when you enter a competition, promotion or survey; 
(i)  when you attend an Maruchicart activity, such as a seminar and exhibition;
(j)  when you report a problem with our websites; and
(k)  when you participate in a market research panel run by Maruchicart

The information you give us may include your name, address, e-mail address and phone number, organization, job role or title, business registration information, standards, licenses, financial and credit card information, and some interests / preferences.

2.2   Information about you that we collect

Visits to websites

With regard to each of your visits to our websites we will automatically collect the following information:

(a) technical information, including your login information, the Internet protocol (IP) address used to connect your computer to the Internet, browser type and version, time zone setting, browser plug-in types and versions, operating system, and platform; and
(b) information about your visit, including the full Uniform Resource Locators (URL), clickstream to, through and from our site (including date and time), products you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page platform and any phone number used to call our customer service number.
CCTV

When you visit our physical offices and warehouses, Maruchicart may record CCTV footage of you as part of our security policy.

3.    HOW WE USE YOUR PERSONAL DATA

3.1   Information you give us

We will use the information you give us:

(a)   to carry out our obligations arising from any contracts entered into between you and us and to provide you with the information, products and services that you request from us;
(b)   to provide you with information about other goods and services we offer that are similar to those that you have already purchased or enquired about where we have a legitimate business purpose to do so;
(c)   where relevant, to provide you with a support newsletter for the product(s) you have purchased.
This may include updates, future roadmaps, technical articles, product information, transactions notifications, promotions, Education, Greetings & Compliments. You can unsubscribe from these at any time.
(d)   to notify you about changes to our service;
(e)   to ensure that content from our site is presented in the most effective manner for you and for your computer; and
(f)    to notify you about any recalls of goods that you have or may have purchased from Maruchicart;

3.2   Information we collect about you
We will use the information we collect about you:

(a)   to administer our websites and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
(b)   to improve our websites to ensure that content is presented in the most effective manner for you and for your computer;
(c)   to allow you to participate in interactive features of our services, when you choose to do so; 
(d)   as part of our efforts to keep our websites safe and secure;
(e)   to measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising content to you; and
(f)    to make suggestions and recommendations to you and other users of our websites about goods or services that may interest you or them.

IP addresses

The Internet protocol (IP) address used to connect your computer to the Internet. We use your IP address for the following purposes:

1.  Ops issue triage: if you notify us of an issue, or our monitoring identifies an issue, then the information within the servers’ logs is used to identify the root cause and, wherever possible, identify a fix.
2.  Issue trending: this provides us with aggregated trend data so we can monitor the quality of the service year-on-year.
3.  Application usage data: we use server logs to review system usage, both for issue triage and for service reporting year-on-year.
4.  Service analytics data: we use relevant applications to gather analytical data.

Cookies

We use cookies on our websites to improve your experience on the websites, mainly so that we don't have to ask you for your information on every page you visit. It also allows us to personalize the information shown to be closer to your interests.

We (or third-party data processors acting on our behalf) may collect, store, and use your personal information for individual website experience improvement.

3.3   Marketing

We collate the information collected about you or provided by you in order to offer you a more tailored marketing experience but always where we either have your consent or where Maruchicart have a legitimate business purpose to do so.

For marketing purposes, we may collect, store, and use the following kinds of personal data:

(a) information about your computer and about your visits to and use of this website (including your IP address, geographical location, browser type, referral source, length of visit and number of page views);
(b) information that you provide to us for the purpose of registering with us (including name, company, telephone number and email address); and
(c) any other information that you choose to send to or tell us.

We will use this information to provide you, or permit selected third parties to provide you, with information about goods or services we feel may interest you. If you are an existing customer, we will only contact you with information about goods and services similar to those which were the subject of a previous sale or negotiations of a sale to you. If you are a new customer, and where we permit selected third parties to use your data, we (or they) will contact you by electronic means only if you have consented to this. If you are happy for us to use your data in this way, or to pass your details on to third parties for marketing purposes, please tick the relevant box situated on the form on which we collect your data. You can unsubscribe from receiving these at any time.

If your email address is linked to a business account, we may process your data on the basis of legitimate interests. However, it is possible that we would also recognise your email as belonging to an individual and, in that scenario, we would process your data only if you have given consent. It is possible for one email address to be against both business and personal classifications.

For example, MsKsticks@gmail.com is linked to a religious organisation account. Maruchicart will market to you in your business capacity on the basis of legitimate interests until you unsubscribe to these emails. Additionally, since the email address is classified as also belonging to an individual, we will market to you in your personal capacity only if we have received your consent to do so. Your consent may be withdrawn at any time.

3.4   Sharing with Third Parties

Maruchicart may share your data with trusted third parties using one of the following lawful bases:

•  Consent: where you have provided consent for your data to be shared.

•  Legitimate Interests: where sharing the data is in Maruchicarts’s legitimate business interests and not outbalanced by the need to protect your individual rights to privacy

•  Contract: where sharing your data is required for the performance of a contract.

•  Legal obligation: where sharing your data is required in order to comply with law.

Where data is shared to fulfil our contractual obligations, and Maruchicart is acting as a data processor, enquiries as to the scope and nature of such data sharing should be raised, in the first instance, with the data controller.

We may share your data with trusted third parties for the following reasons:

(a) We may share your data with third parties directly involved in the provision of Maruchicart’s products and services where you have requested those products and services, e.g. delivery companies.
(b) We may share your data with third parties indirectly involved in the provision of Maruchicart’s products and services, e.g., service providers for our websites and email providers.

(c) We may share your data with third parties that help us to improve the quality of the products and services that we provide. Such third parties may include:

•  Survey providers
•  Data analytics and matching providers
•  Market research organisations
•  Event registration providers and PR partners

and your data will be processed in accordance with their privacy policy or the terms of Maruchicart’s agreement with these third parties. However, data sharing of this kind may be excluded in some contracts where Maruchicart is acting as a data processor.

If you have provided explicit consent, we may share your data with third parties in order that you can be contacted to complete surveys, so we can study how our customers use our products and services and improve our offering accordingly. You are not obliged to complete any survey sent to you and may request that past reviews be deleted.

Where you have provided explicit consent to receive marketing communications, we may also share your data with third parties involved in the delivery of such communications.

Maruchicart will never sell your data to third parties.

Other than when we are sharing your data in order to comply with our legal obligations, all third parties that may access your data are subject to the following conditions:
•  A contract, and relevant data processing agreement, will be in place.
•  Data must only be processed for specific purposes and in accordance with Maruchicart’s instructions.
•  Appropriate security measures must be in place to protect your data.
•  Data provided or accessed will be minimised, and where appropriate, pseudononymised.
•  The data must not be used for the third party’s own purposes.
•  Data must be deleted when it is no longer required or at the end of the contract.
•  Where you request this, we will ask third parties to delete your data from their systems.

4.    DISCLOSURE OF YOUR INFORMATION
Sharing your personal information

You agree that we have the right to share your personal information with:

(a)   Any member of the Maruchicart group, which means our subsidiaries, our ultimate holding company and its subsidiaries
(b)   Selected third parties including:
• business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you;
• advertisers and advertising networks that require the data to select and serve relevant adverts to you and others provided we have a lawful basis to do so;
• analytics and search engine providers that assist us in the improvement and optimisation of our websites; and
• credit reference agencies for the purpose of assessing your credit score where this is a condition of us entering into a contract with you.

Disclosure to third parties

We will disclose your personal information to third parties:

(a)   In the event that we sell or buy any business or assets, in which case we will disclose your personal data to the prospective seller or buyer of such business or assets;
(b)   If any Maruchicart or any of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
(c)   If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use or terms and conditions of supply and other agreements; or to protect the rights, property, or safety of Maruchicart and its subsidiary, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

5.    WHERE WE STORE YOUR PERSONAL DATA

The data that we collect from you may be transferred to, and stored at third party cloud-hosted environments, e.g. AWS, Microsoft Azure and other third party data centres, using secured servers.

6.    HOW YOUR DATA IS PROTECTED

Security

Maruchicart uses a range of security measures in order to protect Personal data, managed through a Group Information Security Framework, based on ISO 27001, the international standard for information security management.
A wide range of technical controls are used, including but not limited to:
•  Data encryption
•  Anti-virus and anti-malware software
•  Network monitoring
•  Access management
•  Vulnerability scanning and penetration testing
A wide range of non-technical controls will be used, including but not limited to:

•  Physical security controls in our offices
•  Security policies, including Data Classification & Handling, Data Protection, etc.
•  Security training
The implementation of such controls may vary between specific products and services and service area . 
Security: websites

All websites have security measures in place to protect the loss, misuse, and alteration of the information under our control. Where necessary Maruchicart will inform law enforcement agencies or other relevant organisations regarding misconduct.

All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted and utilize technologies to ensure compliance. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our websites, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our websites; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorized access.

7.   YOUR DATA PROTECTION RIGHTS

Individuals’ Rights

In accordance with data protection legislation, Maruchicart recognises that data subjects have specific rights that must be protected and observed.

Right to be informed

Maruchicart provides employees, customers and other third parties with information about how personal data is collected, processed and managed. Maruchicart seeks to provide this information in language that is clear, concise, and intelligible. This information is intended to be easily accessible for internal and external users.

Right of access

Maruchicart provides data subjects with access to the personal data that it manages as a data controller. 
Right to rectification

Maruchicart recognizes the right of individuals to have inaccurate or incomplete data to be amended.

Right to erasure

Maruchicart recognises the right of individuals to request for their data to be deleted or removed where there is no compelling reason for its continued processing. Maruchicart will, in all cases, follow the statutory guidance on how and when such a request should be observed.

Right to data portability

Where the right of portability applies, Maruchicart will provide data in a form that is structured, commonly used and in a machine-readable form. In most cases, this will be the CSV format.

Right to object

Maruchicart recognises the right of individuals to object to the processing of their personal data, where such objections are allowable under data protection legislation.

Rights related to automated decision-making including profiling

Maruchicart does not use automated decision making where such decisions have a significant effect on data subjects.

Withdrawing consent

You have the right to ask us not to process your personal data for marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by not checking certain boxes on the forms we use to collect your data.

The “My Account” dashboard will be created for you upon registration of Maruchicart account that will give you
access to an area to decide your preferences for communication.

Each time you receive electronic marketing information from us, you have the option to decline to receive further communication from us.

To stop receiving email communications from Maruchicart in the future, you can:
1.    click on the opt-out link in the email and follow the instructions; or
2.    Click “UNSUBSCRIBE” and choose preference

If you change your preferences, we will endeavor to ensure our systems reflect this within one (1) week of receiving your alteration.

Please note that if you terminate your Maruchicart account, but have also subscribed to newsletters, for example, you must additionally unsubscribe from these in order to cease receiving communication. This also applies to any third parties you have agreed we can share your information with.

To prevent you receiving such communications from Maruchicart in the future, you can send a letter clearly identifying yourself and asking that we remove you from our contact lists to hello@maruchicart.com.

Third party websites

Our websites may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

9.    SUBJECT ACCESS REQUESTS

The Data Protection Law gives you the right to access information held about you. Your right of access can be exercised in accordance with such legislation.

Upon receipt of a written request to our Data Protection Officer and upon validation of the requestor’s identity, Maruchicart will within one (1) month:

(a)   confirm whether any of your personal data is being processed.
(b)   provide a description of the personal data, the reasons it is being processed and whether it is given to any other organisations; and
(c)   if it is not disproportionate to do so, provide copies of the information comprising the data.

If the request is particularly complex or numerous, Maruchicart may extend the period for repose by up to two (2) months. If the request is manifestly unfounded or excessive, Maruchicart may charge a fee or refuse to respond.
If disclosing the personal data will adversely affect the rights and freedoms of others, Maruchicart may withhold such personal data. This may extend to intellectual property and trade secrets.

10.   CHANGES TO OUR PRIVACY POLICY
Any changes we make to the Privacy Policy in the future will be posted on each website. Please check back frequently to see any updates or changes to this Privacy Policy.

11.   MARUCHICART CAREERS PRIVACY STATEMENT
We understand that when searching for employment a large amount of personal and highly confidential data is disclosed and we take our responsibility to protect this very seriously. 

Information we may collect
We collect information contained in your CV or submitted with your application form or personal information form such as name, address, home phone number, work phone number, mobile phone number(s), e-mail addresses and general contact information to facilitate communication with you. We also collect additional personal information such as your CV.

We collect and may disclose statistical information gathered as a whole (e.g., total number of applicants and applicant origin) for internal reporting purposes. However, we never disclose information that identifies any individual for such purposes.
We do not knowingly solicit information from children, and we do not knowingly market our services to children. If you opt to provide date of birth, sex, marital status or nationality information, this information is gathered for diversity monitoring and reporting only and will not be used in the recruitment and selection process.

This document will be reviewed no less than yearly. It may be updated as part of the review process.