INDOSABEST LTD ("we", "our", "us") is incorporated in Nigeria and operates from 46 Wambai Salihu Street, Azare, Bauchi State. This Privacy Policy explains how we handle your personal data across our three currently live products: Indosabest VAS (bill payments), INDOSA Social (community forum), and Indosabest Marketplace (peer-to-peer commerce with NIPOST delivery). By creating an account or using any of these products, you consent to the practices described herein.
Our Core Commitment
We never sell your personal data. We collect only what is necessary. We store it securely. You have full rights over it under the Nigeria Data Protection Act.
SECTION 1
Information We Collect
All Products
Account Data: Full name, email address, username, phone number, and password hash. Collected at registration and required for all three products.
Device & Technical Data: IP address, browser type, device model, operating system, and session timestamps — used for security monitoring and fraud prevention.
Wallet Data: Current balance, top-up history, and transaction records. Card details are never stored in our system.
Indosabest VAS
KYC Identifiers:
Bank Verification Number (BVN) and/or National Identification Number
(NIN) — collected only when required by CBN or NCC regulations
for high-value transaction tiers. Encrypted at rest and used
exclusively for identity verification and other legitimate business purposes.
Transaction Data: Service type
(airtime, data, electricity, exam pins), amount, recipient phone number or
meter number, DisCo/network name, and delivery timestamp are all stored in our system
for fraud prevention, track record and compilance purposes.
Content Data: Posts, comments, votes, community memberships, and any media you upload. This content is public by default within the platform according to the community's visibility settings.
Social Graph: Who you follow and who follows you. This data is used to personalise your feed.
Moderation Records: If you report content or receive a moderation action, we log the report, the decision, and any appeals for accountability purposes.
Indosabest Marketplace
Listing Data: Product title, description, price, photos, category, and seller location shared when you list an item for sale.
Shipping Data: Seller-proposed shipping cost, buyer-confirmed shipping cost, NIPOST office drop-off details, and the NIPOST tracking ID provided by the seller after delivery to the post office.
Delivery Address: Buyer's delivery address or designated NIPOST pick-up location — shared only with the seller to the minimum extent required to complete the transaction.
Escrow Records: Payment hold status, NIPOST tracking validation results, and fund-release timestamps — retained for dispute resolution and financial audit.
SECTION 2
How We Use Your Information
Service Delivery: Processing airtime/data/electricity/exam PIN orders; displaying community posts; facilitating marketplace listings, shipping negotiations, and NIPOST-validated escrow payments.
Transaction Notifications: Sending receipts, delivery confirmations, tracking updates, escrow hold/release alerts, and moderation notices via email, SMS, or in-app notification.
Customer Support: Investigating failed transactions, resolving disputes between buyers and sellers, and responding to moderation appeals.
Platform Improvement: Analysing aggregated, anonymised usage patterns to improve performance, reliability, and features. Individual behaviour is never sold to advertisers.
Legal & Regulatory Compliance: Meeting CBN, NCC, EFCC, and NDPA obligations — including Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) requirements.
Fraud Prevention: Monitoring transactions for suspicious patterns, validating NIPOST tracking IDs before releasing escrow funds, and protecting users from scams.
SECTION 4
Data Security
Encryption
All data in transit is encrypted. Sensitive fields (BVN/NIN) are encrypted at rest.
Secure Servers
Data stored on access-controlled servers with regular penetration testing and security audits.
MFA Available
Multi-factor authentication is available for your account. We strongly recommend enabling it.
Data Minimisation
We collect only what is needed. Unused or expired data is deleted on schedule.
Access Controls
Staff access to user data is role-based, logged, and limited strictly to need-to-know.
Escrow Validation
Marketplace funds are only released after NIPOST tracking confirmation — protecting both buyers and sellers.
Security Disclaimer
No system is 100% immune to threats. In the event of a data breach affecting your personal data, we will notify you and the Nigeria Data Protection Commission (NDPC) within the timeframes required by the NDPA.
SECTION 5
Your Legal Rights
Under the Nigeria Data Protection Act (NDPA), you have the following rights. To exercise any of them, email our Data Protection Officer. We respond within 30 days.
Right to Access
Request a full copy of the personal data we hold about you.
Right to Rectification
Request correction of inaccurate or incomplete information in your profile.
Right to Erasure
Request deletion of your account and data, subject to our legal retention obligations (e.g. 7-year transaction records).
Right to Object
Object to processing for marketing at any time. We honour such requests immediately.
Right to Portability
Receive your data in a structured, machine-readable format to transfer to another provider.
Right to Withdraw Consent
Withdraw consent for non-essential processing at any time, which may limit some features.
SECTION 7
Data Retention
Active Accounts: Personal data is retained for the full duration your account is active.
Transaction Records: VAS and Marketplace financial records are retained for 7 years as required by Nigerian tax and accounting law.
INDOSA Social Content: Posts and comments you delete are removed from public view immediately but may be retained in anonymised moderation logs for up to 12 months for safety purposes.
Closed Accounts: Most personal data is purged within 90 days of account closure. Financial records subject to legal retention are kept but isolated from active systems.
Legal Hold: Data may be retained beyond normal schedules if subject to an active legal investigation, court order, or regulatory inquiry.
SECTION 8
Changes to This Policy
We update this policy when our practices, products, or applicable law changes. When we make material changes, we will update the "Last Updated" date, post a prominent notice on the platform, notify you by email, and — where required by law — seek your renewed consent.
Children's Privacy
Our services are not intended for anyone under 18. If you believe a minor has created an account, contact us immediately and we will delete their data promptly.
Regulatory Compliance
Data Protection Officer
For privacy concerns, data access requests, or to exercise your rights under the NDPA, contact our DPO directly. We respond within 30 days.
Email
support@indosabest.com
Mailing Address
46 Wambai Salihu Street, Azare, Bauchi State, Nigeria
Response Time
Within 30 days of receiving your request
This Privacy Policy was last updated January 2026 and governs all use of Indosabest VAS, INDOSA Social, and Indosabest Marketplace. INDOSABEST LTD · Azare, Bauchi State, Nigeria.