Kataloq Privacy Policy & NDPR Compliance Notice

Effective Date: January 1, 2026

Data Controller: Vercura Systems (trading as Kataloq)

Data Protection Contact: `dpo@vercura.com`

Vercura Systems ("Vercura Systems", "we", "us", "our") values your privacy. This policy explains how we collect, use, process, and protect personal data across the Kataloq ecosystem in strict compliance with the Nigeria Data Protection Act (NDPA 2023) and the Nigeria Data Protection Regulation (NDPR).

1. What Information We Collect

1.1. Merchant Profile & Store Data: When you register a store on Kataloq, we collect your business name, legal entity name, email address, WhatsApp telephone number, store subdomain, national identity verification details (where required for escrow tiers), and bank account / settlement information.

1.2. Buyer Checkout Data: When a customer places an order, requests a quote, or initiates an inquiry, we collect their full name, phone number, delivery address, city, state, and payment references.

1.3. WhatsApp Authentication & Messaging: When using 1-tap passwordless login or order recovery notifications, your WhatsApp number is securely processed to transmit OTP verification codes and real-time order tracking links.

1.4. Technical & Telemetry Data: We collect IP addresses, device types, browser user agents, and behavioral events (page visits, catalog clicks, search terms, cart additions) to protect storefronts from malicious bot scrapers, optimize platform performance, and generate seller analytics.

2. How We Use Your Information

We use personal data strictly for legitimate business and operational purposes:

To provision, host, and power your custom online storefront.

To route automated WhatsApp order dispatch alerts, tracking links, and buyer updates.

To execute payment processing, escrow protection, and merchant settlements via licensed partners.

To prevent fraudulent transactions, automated scraping, and unauthorized account access.

To comply with statutory accounting, anti-money laundering (AML), and regulatory requirements.

3. Commercial Data Practices & Strategic Protections

3.1. No Standalone Sale to Data Brokers: Vercura Systems does not sell, rent, or lease your identifiable personal contact information (such as your direct phone number, email address, or street address) to third-party data brokers or predatory list-sellers for monetary compensation.

3.2. Internal Platform Discovery & Retail Media: To help merchants reach interested buyers, Vercura Systems may process aggregated, pseudonymous, or shopping interest trends to surface relevant merchant storefronts, sponsored catalog rankings, and discover recommendations within the Kataloq marketplace. We do not sell your personal identity to competing merchants.

3.3. Business Transfers & Corporate Transactions: In the event that Vercura Systems undergoes a corporate merger, acquisition, financing due diligence, reorganization, asset sale, or transition of service, user and customer information constitutes a transferable business asset, provided the receiving entity agrees to uphold equivalent data protection standards.

3.4. Financial & Value-Added Services: Where a merchant or buyer opts into value-added platform features (such as merchant working capital, credit underwriting, installment options, or integrated courier cargo insurance), relevant operational data is shared with licensed underwriting, banking, and insurance partners.

4. Data Sharing with Essential Service Providers

We share data only with vetted infrastructure partners bound by confidentiality and data processing agreements:

**Licensed Payment Processors:** Flutterwave and regulated acquiring banks (for card processing, instant bank transfers, and escrow safeguarding).

**Logistics & Courier Gateways:** Shipbubble and integrated couriers (for shipping quote calculations and parcel fulfillment).

**Communication Gateways:** Official WhatsApp Business API providers (for transaction notifications and OTP delivery).

**Statutory & Law Enforcement:** When strictly required pursuant to a valid judicial order or statutory obligation under the laws of the Federal Republic of Nigeria.

5. Your Data Protection Rights

Under the NDPA 2023, you have the right to:

Access the personal data held about you.

Request rectification of inaccurate, outdated, or incomplete records.

Request erasure ("right to be forgotten") of your account, subject to mandatory statutory retention rules for financial audit records.