Contact Us
Privacy Policy
Last updated: April 2026
Effective date: April 2026
Tibu.ng is committed to protecting your personal information in accordance with the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act 2023. This policy explains what data we collect, how we use it, and your rights as a data subject.
1. Who We Are (Data Controller)
Tibu.ng is the Data Controller for personal information collected through this platform. If you have any questions about how we handle your data, contact our Data Protection Officer at:
📧 privacy@tibu.ng
🌐 tibu.ng/support
2. What Data We Collect
2.1 Registration Data
When you create an account, we collect:
- Full name
- Phone number
- Email address
- State and city of residence
2.2 Identity Verification Data (NIN Verification)
For sellers who complete NIN verification, we collect:
- National Identification Number (NIN)
- A live selfie image captured at the time of verification
- The verification result (pass/fail) and reference ID from our KYC provider
Important: We do not permanently store your NIN ID document photos or selfie images after verification is complete. We retain only your verification status, the KYC provider's reference ID, and the timestamp of verification. Raw biometric data is processed by our licensed KYC provider and is not retained by Tibu.
2.3 Listing Data
When you post a listing, we collect:
- Item title, description, price, condition, and category
- Photos you upload (watermarked and stored on our CDN)
- Location (city/state level — we do not collect your precise GPS coordinates)
2.4 Communications Data
When you use Tibu's in-app messaging:
- Message content, timestamps, and sender/receiver IDs
- Messages are retained for 12 months and are encrypted at rest
- Messages are only accessible to the parties in the conversation and to Tibu support staff when a formal dispute is raised
2.5 Usage Data
We automatically collect:
- IP address and approximate location (city level)
- Device type, operating system, and browser
- Pages visited, listings viewed, and actions taken on the platform
- Search queries entered on Tibu.ng
2.6 Payment Data
For promoted listing purchases, payment is processed through Paystack or Flutterwave. Tibu does not store your card details. Payment processors handle all sensitive financial data under their own privacy policies and PCI-DSS compliance.
2.7 Reviews & Ratings
Reviews you submit are publicly visible on seller profiles and are permanently associated with your username.
3. How We Use Your Data
We use your personal data for the following purposes:
| Purpose | Legal Basis |
|---|---|
| Creating and managing your account | Performance of contract |
| Verifying your identity (NIN verification) | Legal obligation / Legitimate interests |
| Displaying your listings to buyers | Performance of contract |
| Processing promoted listing payments | Performance of contract |
| Sending transactional notifications (new messages, listing updates) | Performance of contract |
| Detecting fraud, fake listings, and scam accounts | Legitimate interests |
| Improving the platform and fixing bugs | Legitimate interests |
| Sending marketing emails about new features (with opt-in) | Consent |
| Complying with legal obligations (court orders, regulatory requests) | Legal obligation |
4. Who We Share Your Data With
We do not sell your personal data to third parties.
We share data with the following categories of service providers, strictly for the purpose of operating Tibu.ng:
Identity Verification Providers
Prembly, Smile Identity, or Youverify — for NIN verification processing. These providers are licensed by the NIMC and operate under their own data protection policies.
Payment Processors
Paystack or Flutterwave — for processing promoted listing payments.
Cloud Infrastructure
Cloudflare R2 / AWS S3 — for storing listing photos. All photos are stored encrypted.
Analytics
Anonymised usage data may be processed by analytics tools to help us understand platform performance.
Legal & Regulatory
We may disclose your data to Nigerian law enforcement, courts, or regulatory bodies (including the FCCPC and NITDA) when required by law, court order, or to prevent fraud and criminal activity.
5. Public Information
The following information is publicly visible on Tibu.ng and can be seen by any visitor:
- Your display name and seller profile
- Your listings and listing photos
- Your verification badge status (Verified / Unverified)
- Your star rating and reviews received
- Your general location (city/state only)
Your phone number is displayed on your listings but with the last 4 digits blurred until a buyer taps "Show Number."
6. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Until account deletion + 6 months |
| Listing data | Until listing deletion + 6 months |
| Verification records (status + reference ID only) | Duration of account |
| In-app messages | 12 months from message date |
| Payment transaction records | 7 years (Nigerian tax law requirement) |
| Fraud investigation records | 5 years |
| Anonymised usage analytics | Indefinitely |
When you delete your account, your personal data is removed within 30 days, except where retention is required by law (e.g. transaction records).
7. Your Rights as a Data Subject
Under the NDPR and Nigeria Data Protection Act 2023, you have the right to:
Access — Request a copy of the personal data we hold about you.
Correction — Request correction of inaccurate or incomplete data.
Deletion — Request deletion of your personal data (subject to legal retention requirements).
Portability — Request your data in a structured, commonly used format.
Objection — Object to processing based on legitimate interests.
Withdraw Consent — Withdraw consent for marketing emails at any time via the unsubscribe link.
To exercise any of these rights, email: privacy@tibu.ng
We will respond to all data subject requests within 30 days. We may ask you to verify your identity before processing your request.
8. Data Security
Tibu.ng implements the following security measures:
- All data transmitted between your device and Tibu.ng is encrypted using TLS 1.2 or higher
- Listing photos are stored encrypted at rest on Cloudflare R2 / AWS S3
- In-app messages are encrypted at rest in our database
- NIN and biometric data is processed by licensed providers and not retained by Tibu
- Payment card data is never stored on Tibu servers (processed entirely by Paystack/Flutterwave)
- Administrative access to user data requires multi-factor authentication
- All admin data access is logged and auditable
Despite these measures, no internet service is 100% secure. In the event of a data breach affecting your rights, we will notify you and the relevant Nigerian authorities within 72 hours as required by law.
9. Children's Privacy
Tibu.ng is not intended for users under 18 years of age. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, contact us at privacy@tibu.ng and we will remove the account promptly.
10. Third-Party Links
Tibu.ng may contain links to external websites. This Privacy Policy does not apply to those sites. We recommend reviewing the privacy policy of any external site you visit.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice on the platform. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of Tibu.ng after changes are posted constitutes acceptance.
12. Complaints
If you believe your data rights have been violated, you may lodge a complaint with:
National Information Technology Development Agency (NITDA)
Data Protection Compliance Organisation (DPCO) complaints process
📧 info@nitda.gov.ng
🌐 nitda.gov.ng
You may also contact us directly at privacy@tibu.ng to resolve any concerns before escalating.
13. Contact
📧 privacy@tibu.ng
🌐 tibu.ng/support