Privacy Policy

This notice covers the Debelu marketing site, marketplace accounts, stores, orders and related support interactions. Debelu determines how information is used to operate those services. A seller or a payment provider may have separate responsibilities for information it handles for its own purposes.

For a question or a privacy request, contact privacy@debelu.com. Use security@debelu.com for a suspected security incident. Do not email your password, login code, delivery PIN or unnecessary identity documents.

Account information can include your name, email address, selected campus and profile details. Store setup and seller review may require additional store, contact and verification information. Creating a basic account is not itself proof of identity or seller approval.

Listings can contain descriptions, prices, photos and availability information. Orders contain the selected products, parties, delivery or pickup details, payment references and progress. Support requests, messages, dispute evidence and privacy requests contain the information you choose or need to submit for that purpose.

The service can receive technical information such as request metadata, device or browser information, authentication/session activity and application errors. Activity records can include product interactions, favorites, order changes and the actions needed to investigate a problem.

Payment, authentication, delivery-message and other providers can return references, outcomes or technical events needed for the feature. Buyers, sellers or support staff may provide information relating to the same order. We should not collect unrelated private information merely because someone includes it in a report.

Information is used to create and maintain accounts, display relevant listings, operate stores, communicate order details, process payments and support handover. The relevant contractual basis applies only to information genuinely necessary for the service you request.

Support, dispute review and account recovery use the account or order record and the evidence needed to understand the issue. Security checks and investigation of misuse may rely on legitimate interests, subject to assessing necessity and the effect on the people involved.

Consent applies where an optional activity requires your choice, such as a separately offered marketing communication. You may withdraw consent without making earlier lawful processing unlawful. Contractual necessity is not a substitute for consent to an unrelated optional activity.

A legal obligation can require particular records or disclosure. Legitimate interests do not override rights automatically; the purpose and impact must be considered. Debelu should explain a materially different use before it begins and obtain a separate lawful basis where necessary.

Your published store details, product photos and listing content are intended to be viewed by other users. Do not place identity documents, home details, bank credentials or another person’s private information in a public listing.

The buyer and seller may receive the contact and fulfillment details needed for their order. That access is for the transaction, not permission to add someone to a marketing list, publish their information, or use it to harass them. Support and authorized staff may access records when their task requires it.

Payments are handled through the payment flow and its provider. Debelu uses payment references and results to connect the payment to the order, wallet and any refund or withdrawal. Do not send raw card credentials or bank authentication codes through messages or support attachments.

Infrastructure, monitoring, messaging and assistance providers may process information for the relevant feature. Read the service-provider information for purposes and role distinctions. A provider may also have independent legal duties; the same legal role does not apply to every service.

When you use Nduzi, the request and information needed to respond can be processed by an AI service. AI can also assist staff in drafting a support response using the relevant ticket and conversation content. Avoid including unrelated sensitive details in either channel.

AI output can be inaccurate. A suggestion does not establish stock, a refund decision or a legal entitlement. For a decision with a significant effect on you, ask support to explain the outcome and consider your account of the facts; do not treat a generated response as the only route for review.

Order, account-security and service messages can be necessary for the activity you requested. Optional channels or marketing should follow the choices offered for that channel. Where optional WhatsApp messaging is used, an opt-out record may be needed to prevent future unwanted messages.

Contact support if a notification preference is not available or a message appears to ignore your choice. Opting out of a marketing message does not cancel an order or prevent an essential account-security message. Do not send credentials when requesting a preference change.

Authentication can use cookies or browser storage to maintain the session. Theme preferences use local storage; service-worker or browser caches may keep resources for the website. These are different technologies with different removal controls.

Optional analytics or tracking must have an appropriate legal basis and notice. The Cookie Policy explains the current storage categories and browser controls. It does not imply that an advertising tracker or consent widget is active when it is not supplied by the feature.

Records are kept according to their purpose and any applicable obligation: for example, an active account, an unresolved order, fraud prevention, a dispute, accounting requirements or a legal claim. A record should not be retained indefinitely merely because storage is available.

A deletion request does not necessarily remove every financial, audit, shared-message or legally required record immediately. Backups and external providers may require a separate lifecycle. Ask for an explanation of retained categories and the relevant reason. Use the account-deletion guidance or contact privacy@debelu.com; no universal deletion period is promised here.

Infrastructure or service providers may process data outside Nigeria. A provider’s global presence does not itself prove that your data is stored in a particular country. You may ask privacy@debelu.com for information about the processing relevant to your request.

An international transfer requires a lawful basis and safeguards appropriate to Nigerian data-protection requirements. Contracts or other permitted mechanisms must support adequate protection; a claim that all information stays in Nigeria or Europe is not made by this notice.

Access restrictions, authentication and operational checks help reduce risk, but no online service can promise that unauthorized access or loss is impossible. Do not reuse a compromised password, share account access, or disclose a delivery PIN before inspection.

Report suspicious activity promptly with the relevant reference and a description. If a personal-data incident occurs, any notifications and response must follow the applicable legal requirements and the facts of the incident. No certification, audit status or absolute encryption guarantee is implied.

Depending on the circumstances, you can request information or access, correction, deletion, restriction, portability, objection, withdrawal of consent and review of a qualifying automated decision. These rights can have lawful limits, such as protecting another person’s information or retaining a required transaction record.

Send the request to privacy@debelu.com with enough information to locate the account or activity and explain what you want to do. Debelu may need proportionate identity verification and should explain any limit or refusal. You can also complain to the Nigeria Data Protection Commission; contacting Debelu first is not a condition for exercising a statutory remedy.

Debelu is designed for campus trading and is not a service directed at young children. Do not submit a child’s private information or use an account on someone else’s behalf without lawful authority. A campus selection or account registration does not verify a person’s age.

If information about a child has been submitted or a user cannot lawfully consent to the relevant processing, contact privacy@debelu.com so the situation can be assessed. The applicable parental or guardian requirements must be addressed; this notice does not create an automated age-check that the service does not perform.

A material change in data use should be explained before it applies, and further consent obtained when legally required. Check the relevant feature notice as well as this page. A policy update is not permission to use old data for an unrelated purpose without a lawful basis.

Read the Terms, Cookie Policy and Data Processing Addendum where applicable. For regulatory background, the NDPC FAQs explain Nigeria’s data-protection framework.