Privacy Policy

Last updated: 4 June 2026

FoodBank.ng (“we”, “us”, “our”) is committed to protecting your personal data. This policy explains what information we collect, how we use it, and your rights under the Nigeria Data Protection Act 2023 (NDPA 2023).

1. Who We Are

FoodBank Nigeria Limited is the Data Controller for personal data collected through the FoodBank.ng platform. We are incorporated in Nigeria and operate primarily in Oyo State. Our Data Protection Officer can be reached at support@foodbank.ng.

2. Information We Collect

We collect the following categories of personal data:

Account data: name, email address, phone number, and password (hashed never stored in plaintext).
Date of birth: collected at registration to verify you meet our 18-year minimum age requirement. Stored encrypted.
Identity data: National Identification Number (NIN) and Bank Verification Number (BVN), collected during KYC verification and stored encrypted using AES-256-GCM.
Employment data: ministry, employee ID, grade level, and payroll details for civil servant applicants only, with your explicit consent.
Financial data: transaction history, wallet balance, repayment records, and credit score. Payment card tokens are stored by Paystack and Fincra (PCI-DSS compliant) and never by us.
Order data: products purchased, delivery address, and order status.
Device & usage data: IP address, browser type, and pages visited, collected automatically via standard server logs.

3. How We Use Your Information

To create and manage your account.
To verify you are at least 18 years of age before granting access to our credit services.
To process food orders and facilitate BNPL repayments.
To verify your identity (KYC) using NIN and BVN.
To verify employment and facilitate salary deductions for civil servant plans.
To calculate and maintain your internal FoodBank.ng credit score.
To send order confirmations, payment reminders, and support communications.
To prevent fraud, detect duplicate accounts, and enforce our Terms of Service.
To improve our platform and analyse usage patterns (using anonymised data).

4. Legal Basis for Processing

We process your personal data under the following legal bases as set out in the NDPA 2023:

Contractual necessity: to provide the food credit service you signed up for.
Legal obligation: age verification, KYC, and financial record-keeping required by applicable law.
Legitimate interests: fraud prevention, duplicate account detection, and platform security.
Consent (NDPA 2023, Section 25): for certain processing activities (e.g., employment data for civil servant plans). You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Sharing Your Data

We share personal data only where necessary and with the following parties:

Paystack & Fincra: our payment processors (PCI-DSS compliant). They receive only what is needed to process payments.
Dojah: our identity verification provider, for NIN and BVN verification during KYC.
Logistics partners: name and delivery address only, to fulfil your order.
Government payroll systems: employment and deduction data for civil servant plans, with your explicit prior consent.

We never sell your personal data to third parties for marketing or any other purpose.

6. Data Retention

We retain your account and transaction data for as long as your account is active and for 7 years after account closure, as required by CBN regulations and NDPA 2023. After this period, personal identifiers are automatically anonymised so that the record can no longer be attributed to you. You may request deletion of non-financial data at any time; financial records required by law will be anonymised at the end of the statutory retention period.

7. Security

We take the security of your data seriously. Our measures include:

All data is transmitted over HTTPS with TLS encryption.
Passwords are hashed using bcrypt and never stored in plaintext.
Sensitive identity data (NIN, BVN, date of birth) is encrypted at rest using AES-256-GCM.
Identity hashes use HMAC-SHA256 to prevent duplicate registrations without exposing raw identity numbers.
Payment details are handled entirely by Paystack and Fincra and are never stored on our servers.
Access to personal data is restricted to authorised staff on a need-to-know basis.

8. Cookies

We use essential session cookies to maintain your login state. We do not use advertising, tracking, or analytics cookies. You can disable cookies in your browser settings, though this will prevent you from staying signed in.

9. Your Rights

Under the Nigeria Data Protection Act 2023 (NDPA 2023), you have the right to:

Access: obtain a copy of the personal data we hold about you.
Rectification: request correction of inaccurate or incomplete data.
Erasure: request deletion of your data (subject to legal retention requirements).
Restriction: object to or restrict certain processing activities.
Data portability: receive your data in a structured, machine-readable format.
Withdraw consent: withdraw previously given consent at any time.

We will respond to verified requests within 14 days as required by NDPA 2023. To exercise any of these rights, email our Data Protection Officer at support@foodbank.ng with the subject line “Data Rights Request”.

10. Regulatory Oversight

FoodBank.ng operates under the oversight of the Nigeria Data Protection Commission (NDPC), established under NDPA 2023. If you believe your data rights have been violated and we have not resolved your complaint satisfactorily, you may lodge a complaint directly with the NDPC at ndpc.gov.ng.

11. Changes to This Policy

We may update this policy periodically. We will notify you of material changes by email or via an in-app notification. Continued use of FoodBank.ng after changes take effect constitutes your acceptance of the revised policy.

12. Contact

Data Controller: FoodBank Nigeria Limited, Ibadan, Oyo State, Nigeria.
Data Protection Officer: support@foodbank.ng