Privacy Notice

Naija Home Food respects your privacy and is committed to protecting your personal data in accordance with the Nigeria Data Protection Act 2023, the Nigeria Data Protection Act General Application and Implementation Directive 2025 issued by the Nigeria Data Protection Commission, and other applicable data protection requirements.

This Privacy Notice explains how we collect, use, disclose, store, protect, retain, and otherwise process personal data when you visit our website, create an account, place orders, make payments, contact us, subscribe to updates, interact with our social media pages, or otherwise use our food ordering, delivery, customer support, and related services.

The NDPA establishes the NDPC as Nigeria's data protection regulator and provides rights and remedies for data subjects. The GAID provides operational compliance guidance under the NDPA.

For the purposes of applicable data protection law, Naija Home Food acts as a Data Controller in respect of personal data collected and processed through our website, ordering channels, delivery operations, customer support channels, marketing platforms, and related services.

Where we process personal data on behalf of another organisation, we may act as a Data Processor, subject to a written data processing agreement.

This Privacy Notice applies to personal data processed through:

• our website and mobile-accessible platforms;
• customer account registration and login;
• food ordering and delivery services;
• online payment and transaction processing;
• WhatsApp, email, phone, social media, and customer support interactions;
• newsletters, promotions, loyalty offers, surveys, and marketing communications;
• customer reviews, complaints, refund requests, and dispute resolution;
• vendor, supplier, rider, dispatch, and partner engagements;
• website cookies, analytics, device identifiers, and similar technologies.

Depending on how you interact with us, we may collect the following categories of personal data:

We collect personal data directly and indirectly through:

• account registration forms;
• checkout and order placement forms;
• payment confirmation systems;
• customer service channels;
• WhatsApp, phone calls, emails, and social media messages;
• cookies and similar tracking technologies;
• delivery partners, restaurants, vendors, or logistics service providers;
• payment processors and fraud prevention systems;
• surveys, feedback forms, promotions, and campaigns.

We process personal data only where we have a lawful basis under the NDPA, including consent, contract performance, legal obligation, legitimate interest, vital interest, and public interest where applicable. The NDPA recognises data subject rights including access, correction, erasure, restriction, withdrawal of consent, objection, and safeguards around automated decisions.

Where we rely on consent, we will ensure that consent is freely given, specific, informed, unambiguous, and capable of being withdrawn.

You may withdraw consent at any time by using the unsubscribe link, cookie preference tool, account settings, or by contacting us at tion@naijahomefood.com. Withdrawal of consent will not affect processing lawfully carried out before withdrawal.

We use cookies and similar technologies to operate our website, remember user preferences, improve functionality, analyse traffic, secure the website, and support marketing where permitted.

Cookies may include:

• strictly necessary cookies;
• performance and analytics cookies;
• functionality cookies;
• advertising or marketing cookies.

Non-essential cookies will be used only where required consent has been obtained. You may manage or withdraw cookie consent through our cookie banner, browser settings, or cookie preference centre.

A separate Cookie Notice should be made available on our website, setting out cookie names, providers, purposes, duration, and opt-out mechanisms.

We may send you promotional communications about our meals, offers, updates, loyalty programmes, events, or related services where you have consented or where permitted by law.

You may opt out at any time by:

• clicking the unsubscribe link in our emails;
• replying "STOP" or using the relevant opt-out instruction;
• updating your account preferences;
• contacting us at tion@naijahomefood.com.

We will not sell your personal data to unauthorised third parties for marketing purposes.

We may share personal data with carefully selected third parties where necessary and lawful, including:

• payment processors;
• delivery partners and riders;
• food vendors, restaurants, and fulfilment partners;
• hosting and cloud service providers;
• IT support and cybersecurity providers;
• analytics and marketing service providers;
• customer support and communication platforms;
• auditors, accountants, lawyers, consultants, and insurers;
• regulators, law enforcement agencies, courts, or public authorities where required by law.

Where third parties process personal data on our behalf, we will implement appropriate Data Processing Agreements and require them to process personal data only on documented instructions, maintain confidentiality, implement security controls, assist with data subject rights, and support breach notification obligations.

Some of our service providers, technology platforms, cloud providers, payment processors, analytics providers, or communication tools may process personal data outside Nigeria.

Where personal data is transferred outside Nigeria, we will ensure that such transfer is carried out in accordance with the NDPA and GAID, including by relying on adequacy decisions, contractual safeguards, binding corporate rules, approved codes or certifications, explicit consent, contract necessity, or other lawful transfer mechanisms. GAID addresses cross-border transfer, DPO, CAR, breach notification, lawful basis, and related compliance obligations.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction.

These measures may include:

• access controls and role-based permissions;
• password and authentication controls;
• encryption or secure transmission where appropriate;
• secure payment processing through approved providers;
• backups and recovery procedures;
• staff confidentiality obligations;
• vendor due diligence;
• security monitoring;
• incident response procedures;
• periodic review of security controls.

No website, platform, or electronic transmission is completely risk-free. However, we will take reasonable and proportionate steps to protect your personal data.

Where a personal data breach occurs, we will assess the nature, scope, likely impact, and risk to affected individuals.

Where required, we will notify the NDPC within the applicable statutory timeframe and communicate with affected individuals where the breach is likely to result in high risk to their rights and freedoms. The NDPA requires notification to the Commission where a breach is likely to result in risk to data subjects, with 72-hour notification commonly referenced in NDPA compliance guidance.

We will maintain internal records of personal data breaches, remedial actions, and lessons learned.

We retain personal data only for as long as necessary for the purposes for which it was collected, including to fulfil orders, provide services, comply with legal obligations, resolve disputes, enforce agreements, and maintain business records.

Where personal data is no longer required, we will securely delete, anonymise, archive, or restrict access to it.

Subject to applicable law, you have the right to:

• request confirmation that we process your personal data;
• access your personal data;
• request correction of inaccurate, incomplete, outdated, or misleading data;
• request deletion of your personal data where there is no lawful basis for continued retention;
• withdraw consent at any time;
• object to processing, especially direct marketing;
• request restriction of processing;
• request data portability where applicable;
• object to solely automated decisions that produce legal or similarly significant effects;
• lodge a complaint with the NDPC.

To exercise your rights, contact us at tion@naijahomefood.com.

We may request identity verification before acting on your request. We will respond within the timeframe required by applicable law.

Our services are intended for persons who are legally able to place orders and enter into transactions. We do not knowingly collect personal data from children without appropriate parental or guardian involvement.

Where we become aware that a child's personal data has been collected without appropriate authorisation, we will take reasonable steps to delete or restrict such data unless we have a lawful basis to retain it.

Where processing children's personal data is necessary, we will apply enhanced safeguards, age-appropriate transparency, and parental or guardian consent where required.

We do not intentionally use solely automated decision-making that produces legal or similarly significant effects on customers.

However, some third-party payment processors, fraud detection tools, or security systems may use automated checks to detect suspicious transactions, prevent fraud, or secure our platform. Where such processing materially affects you, you may contact us to request human review where applicable.

Our website may contain links to third-party websites, social media pages, payment platforms, or external services. We are not responsible for the privacy practices, security, or content of those third-party platforms.

You should review their privacy notices before submitting personal data to them.

To demonstrate accountability under the NDPA and GAID, we will maintain appropriate privacy governance records, which may include:

• Records of Processing Activities;
• Data Protection Impact Assessments where required;
• Data Processing Agreements with processors;
• data retention schedule;
• breach register;
• DSAR register;
• consent records;
• vendor risk register;
• cross-border transfer assessment records;
• staff privacy awareness records;
• compliance audit records where applicable.

Where Naija Home Food qualifies as a Data Controller or Processor of Major Importance, we will comply with applicable NDPC registration, audit, reporting, and compliance obligations.

If you have concerns about how we process your personal data, please contact us first:

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

We may update this Privacy Notice from time to time to reflect changes in our services, legal obligations, technology, vendors, or data processing activities.

Where material changes are made, we will take reasonable steps to notify users through our website, email, account dashboard, or other appropriate channels.

For questions, complaints, requests, or concerns regarding this Privacy Notice or our data protection practices, contact: