Privacy Policy

Folex Auto Market ("we", "us", "our", "the Platform") is committed to protecting your personal information. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we may share it with, how long we retain it, and what rights you have over your data. By using our Platform, you consent to the practices described in this policy. This policy applies to all visitors, buyers, sellers, dealers, advertisers, and any other person who uses or interacts with Folex Auto Market. Folex Auto Market acts as the data controller in respect of personal data collected through the Platform. The legal entity details for the data controller are set out in Section 19 (Contact and Data Controller Details).

The data controller responsible for your personal information is: Company name: [To be confirmed — Nigerian company registration (CAC) pending] CAC registration number: [To be confirmed] Registered address: [To be confirmed] Data protection contact: privacy@folexautomarket.com ⚠️ [LEGAL REVIEW REQUIRED] — The legal entity name, CAC registration number, registered address, and any appointed Data Protection Officer (DPO) must be confirmed before this policy is published. If Folex Auto Market operates through or is incorporated in more than one jurisdiction, the applicable data controller(s) for each jurisdiction should be identified and confirmed by legal counsel.

We collect information you provide directly and information generated by your use of the Platform. Account and profile information: full name, email address, phone number, WhatsApp number (if provided), account type or role (buyer, seller, dealer), account status, password (stored securely and never in plain text), and profile photo where provided. Buyer information: saved cars, recently viewed vehicles, enquiry messages and history, compare lists, saved search alerts, notification preferences, and price alert settings. Seller and dealer information: seller or dealer display name, business name, address, city and state, opening hours, dealership description, contact details (phone/WhatsApp), listing history, subscription plan, and account status. Vehicle listing information: make, model, year, mileage, condition, price, price type, body type, fuel type, transmission, colour, engine size, description, photos, partial VIN or chassis number, location (city and state), and seller contact details where shared. Enquiry and communication data: messages sent between buyers and sellers or dealers, enquiry chip selections, WhatsApp and call contact events (click-level only — not the content of calls or WhatsApp conversations), enquiry timestamps, and enquiry status. Dealer verification documents: proof of business ownership or registration, government-issued identification, proof of address, vehicle documents submitted for verification, and any other materials submitted as part of the dealer verification process. These documents are private and handled as described in Section 7. Fraud reports and safety data: fraud report submissions, report categories, evidence or screenshots uploaded, reporter identity (for follow-up where required), reported listing or user details, and admin actions taken. Support ticket data: name, email, support message, issue category, any attachments submitted, and resolution history. Payment and subscription data: subscription plan type, promotion or advert package purchased, payment reference numbers, transaction amounts, currency, payment status, and Paystack transaction metadata. We do not store full card numbers or CVV codes. Advertiser enquiry data: name, contact information, organisation or business name (if provided), enquiry message content, and advert package details discussed or purchased. Technical and usage data: IP address, browser type and version, device type and operating system, pages visited, session duration, referral source, cookie identifiers, and analytics data where consent is given or where analytics tools are in use.

We collect personal data through the following means: When you register or create an account: name, email, phone, WhatsApp number, and account role. When you create or submit a vehicle listing: listing details, vehicle photos, contact information, and VIN or chassis number. When you send an enquiry to a seller or dealer: message content, enquiry type, and contact preferences. When you submit a fraud or abuse report: report details, evidence, and reporter contact information. When you contact support: support ticket content, contact details, and any attachments. When dealers submit verification documents: business registration, identification, and supporting documents. When you make a payment: transaction data is shared with Paystack; we receive and store payment references, status, and associated subscription or promotion metadata. When you use buyer features: saved cars, compared vehicles, saved searches, and recently viewed vehicles are recorded against your account. When advertisers enquire or purchase ads: contact details, message, and advert enquiry data. When you browse the Platform: technical and usage data including IP address, device information, pages visited, and session data are collected automatically, and cookies are set as described in our Cookie Policy.

We use your information to: • Create and manage user accounts and role-based dashboard access • Publish, display, and moderate vehicle listings • Connect buyers with sellers and dealers and facilitate enquiries • Enable buyer features including saved cars, compare cars, saved searches, and recently viewed vehicles • Verify seller and dealer identity, documents, and business registration • Manage subscription plans, process payments via Paystack, and maintain payment records • Manage promotion and featured listing purchases and activation • Handle advertiser enquiries, advert purchases, and advert review • Detect, investigate, and prevent fraud, suspicious activity, and platform abuse • Review, investigate, and action fraud and abuse reports • Provide customer support and respond to support tickets • Send security alerts, listing notifications, account communications, and service updates • Improve Platform features, performance, and user experience • Comply with applicable legal obligations, respond to legal requests, and meet regulatory requirements We do not sell your personal information to third parties. We do not use your personal data to serve targeted third-party advertising without your explicit consent.

We process your personal data on the following legal bases: Contract / performance of service: to create and manage your account, publish listings, process enquiries, handle payments, and provide the marketplace service you signed up for. Legitimate interests: fraud prevention, platform safety, security monitoring, abuse detection, moderation, service improvement, and ensuring the integrity of the marketplace — where these interests are not overridden by your privacy rights. Consent: optional marketing communications (opt-in only), optional analytics cookies, and any processing for which we specifically ask for your consent. Legal obligation: where we are required to process or retain data under applicable Nigerian law, including financial record-keeping, responses to court orders, fraud investigation, and regulatory compliance. You may withdraw consent at any time by contacting privacy@folexautomarket.com or using your account settings. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. ⚠️ [LEGAL REVIEW REQUIRED] — The specific legal bases applicable under the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation (NDPR), and, if applicable, the UK General Data Protection Regulation (UK GDPR) should be confirmed by a qualified privacy lawyer before this policy is published. The applicability of UK GDPR depends on the jurisdiction of incorporation and the location of users, and must be determined by legal counsel.

As part of the dealer verification process, dealers may upload business and identity documents including, but not limited to: business registration certificates, government-issued identification, proof of business address, and any other materials required for verification. These documents are: • Used solely for the purpose of verifying the dealer's business identity, preventing fraud, ensuring platform safety, and meeting compliance requirements. • Stored in private, access-controlled storage and are not publicly visible or accessible. • Accessible only to authorised Folex Auto Market administrators for verification, moderation, dispute resolution, and compliance purposes. • Not shared with other users, buyers, or third parties except where required by law or with the dealer's explicit consent. Dealer verification documents may be retained beyond account deletion where required for fraud prevention, legal compliance, dispute resolution, regulatory obligations, or platform safety. ⚠️ [LEGAL REVIEW REQUIRED] — The specific retention periods for dealer verification documents should be confirmed in light of applicable Nigerian business, financial, and data protection law.

All payment transactions on the Platform are processed by Paystack or another third-party payment processor. Folex Auto Market does not store full card numbers, CVV codes, or other sensitive payment authentication data. We do store the following payment-related data to operate and audit the service: • Payment reference numbers and transaction IDs • Transaction amount and currency • Payment status (success, pending, failed, abandoned) • Subscription plan, promotion package, or advert package associated with the transaction • Timestamp and associated user account This payment metadata may be retained for accounting, fraud prevention, tax compliance, dispute resolution, subscription management, and applicable legal or regulatory requirements. ⚠️ [LEGAL REVIEW REQUIRED] — Payment data retention periods should be confirmed in light of Nigerian tax law, the Federal Inland Revenue Service requirements, and any other applicable financial record-keeping obligations.

We share your information only as necessary to operate the Platform. We do not sell personal data. Buyers and sellers or dealers: When you send an enquiry, your name and message are visible to the listing owner. Phone numbers and WhatsApp numbers are displayed on listings only if the seller has chosen to make them visible. Paystack: Payment processing is handled by Paystack, a Nigerian-based payment provider. We share transaction data (amount, reference, email) with Paystack to process payments. Paystack's own privacy policy applies to data they hold. Supabase: Our database, authentication, and file storage infrastructure provider. User data, private documents, fraud evidence, and support attachments are stored within Supabase infrastructure. Storage access is governed by access controls and is not publicly accessible by default. Vercel: Our hosting and deployment provider. Platform code and server functions run on Vercel infrastructure. Vercel may process request metadata including IP addresses as part of serving the Platform. Email service provider: Where we send transactional emails (account verification, notifications, alerts, support responses), those emails may be processed by a third-party email delivery service. We will update this policy with the provider's name once confirmed. Folex Auto Market administrators: Our admin team can access listing details, user profiles, fraud reports, support tickets, and private documents for the purpose of moderation, verification, and customer support. Legal and regulatory authorities: We may disclose information to Nigerian law enforcement, courts, regulatory authorities, or relevant government bodies where required by law or in response to a lawful request. Future service partners: If Folex Auto Market introduces vehicle inspection referral services or car finance information tools in the future, relevant data may be shared with those partners with appropriate notice and, where required, your consent. These features are not currently available. We do not share your information with advertising networks, data brokers, or third-party analytics providers without your explicit consent or as described in our Cookie Policy.

Some information on Folex Auto Market is visible to the public (including users who are not logged in). Other information is private and restricted. Publicly visible information includes: • Vehicle listing details: title, make, model, year, mileage, condition, price, body type, fuel type, location (city and state), description, and listing photos. • Seller or dealer display name and, for dealers, their dealership name and storefront. • Dealer profile information: business name, city, state, opening hours, and dealership description where provided. • Contact details (phone or WhatsApp) on listings — only if the seller or dealer has chosen to display them. • Partial VIN or chassis number where displayed on a listing. Private information — not visible to the public — includes: • Full account details, email address, and account role. • Buyer enquiry messages and history. • Saved cars, saved searches, compare lists, and recently viewed vehicles. • Dealer verification documents and uploaded business documents. • Fraud reports, support tickets, and admin actions. • Full VIN or chassis number (admin-only). • Payment records, subscription details, and transaction history. • Account status and moderation history.

The following are treated as private and sensitive marketplace records and are not publicly accessible: • Seller and dealer verification documents stored in private storage buckets. • Fraud report evidence, screenshots, and attachments. • Support ticket attachments and correspondence. • Full VIN or chassis numbers (only partial VIN may appear publicly). • Admin moderation records and actions. These records are used only for admin review, verification, fraud prevention, dispute resolution, and legal compliance. They are stored in private, access-controlled storage.

We retain your data for as long as your account is active and as required for the purposes described in this policy. Indicative retention periods are as follows: • Account data: retained while your account is active and for a period after deletion or deactivation, as required for fraud prevention, dispute resolution, legal compliance, or safety. • Listing data: retained while the listing is active; historical listing records may be retained for audit, dispute, and compliance purposes. • Enquiry data: retained for as long as required to support the transaction and for a reasonable period thereafter for dispute resolution purposes. • Payment records: retained for financial compliance, accounting, and tax purposes for a period consistent with applicable Nigerian law. • Fraud reports and safety evidence: may be retained for an extended or indefinite period for platform safety, legal proceedings, and compliance. • Support tickets: retained for a period after resolution for quality, dispute, and compliance purposes. • Dealer verification documents: see Section 7. • Technical and analytics data: retained per the cookie and analytics retention settings described in our Cookie Policy. Some data cannot be immediately deleted even after an account deletion request due to fraud prevention, legal compliance, dispute handling, payment accounting, and audit requirements. We will explain any such retention when processing your data request. ⚠️ [LEGAL REVIEW REQUIRED] — Specific retention periods should be confirmed by a qualified lawyer in light of the Nigeria Data Protection Act 2023, applicable Nigerian financial and tax laws, and any other relevant regulations before this policy is published.

We implement technical and organisational security measures including: • HTTPS encryption in transit for all Platform connections. • Password hashing — passwords are never stored in plain text. • Row-Level Security (RLS) on all database tables, restricting data access to authorised users only. • Private storage for sensitive documents including dealer verification files, fraud evidence, and support attachments. • Role-based access controls limiting which team members can view sensitive data. • Rate limiting on login and authentication endpoints. • Security alert notifications for new sign-ins and password changes. No system is completely secure. In the event of a data breach that poses a material risk to your rights or freedoms, we will notify affected users and relevant authorities as required by applicable law.

Subject to applicable law, you have the following rights regarding your personal data: • Access: request a copy of the personal data we hold about you. • Correction: request correction of inaccurate or incomplete data. • Deletion: request deletion of your account and associated data — subject to our data retention obligations and the process described in Section 15. • Restriction: request that we restrict processing of your data in certain circumstances. • Portability: receive certain data in a structured, machine-readable format. • Objection: object to processing based on legitimate interests. • Withdraw consent: withdraw marketing or analytics consent at any time through your account settings or by contacting us. • Complaint: if you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the relevant data protection authority. To exercise any of these rights, use our Data Request page at /data-request or contact privacy@folexautomarket.com. We will respond within a reasonable timeframe (typically 30 days) and may need to verify your identity before processing a request. ⚠️ [LEGAL REVIEW REQUIRED] — The applicable supervisory or data protection authority for complaints should be confirmed by legal counsel. This may be the Nigeria Data Protection Commission (NDPC) under the Nigeria Data Protection Act 2023 and/or the UK Information Commissioner's Office (ICO) under UK GDPR, depending on the jurisdiction of the operating entity and the location of users.

Users can request account deactivation or deletion by: • Visiting the Danger Zone section of their account Settings page and following the contact-support route, or • Emailing privacy@folexautomarket.com, or • Submitting a request at /data-request. Important — deletion is not immediate or automatic: Requesting account deletion does not mean all of your data is immediately and permanently erased. Some data may be: • Retained for fraud prevention, legal compliance, dispute resolution, accounting, payment records, regulatory requirements, or platform safety — as described in Section 12 (Data Retention). • Anonymised (where your personal identity is removed but non-identifiable data may remain for audit or analytics purposes) rather than deleted. We will confirm what data can be deleted, what must be retained and why, and the expected timeline when processing your deletion request. ⚠️ [LEGAL REVIEW REQUIRED] — The data deletion framework, including what must be retained and for how long under Nigerian law, should be confirmed by legal counsel before this policy is published.

We use cookies and similar technologies to operate the Platform. Essential session cookies are required for login, authentication, and security and cannot be disabled. Optional analytics cookies, which help us understand how the Platform is used, require your explicit consent before activation. We do not use advertising or behavioural tracking cookies by default. See our Cookie Policy at /cookie-policy for full details on the cookies we use, their purpose, and how to manage your preferences. Note: Any analytics tools currently implemented or introduced in the future will be described in the Cookie Policy. If no analytics tools are currently active, no optional analytics cookies will be set.

Folex Auto Market is not intended for children under the age of 18. Users must be of legal age to enter into contracts and conduct vehicle transactions in Nigeria. We do not knowingly collect personal data from minors. If we become aware that a child under 18 has registered or submitted personal data without appropriate consent, we will delete their account and associated data promptly. If you believe a minor has submitted data to the Platform, please contact us at privacy@folexautomarket.com.

Folex Auto Market uses third-party service providers — including Supabase (database and storage), Vercel (hosting), and Paystack (payment processing) — whose infrastructure may be located outside Nigeria. As a result, your personal data may be transferred to, stored in, or processed in countries outside of Nigeria. We take steps to ensure that such transfers are carried out in accordance with applicable data protection law and that appropriate safeguards are in place. ⚠️ [LEGAL REVIEW REQUIRED] — The legal basis and required safeguards for international data transfers under the Nigeria Data Protection Act 2023 (NDPA) — and, if applicable, UK GDPR — must be confirmed by a qualified privacy lawyer before this policy is published. This includes confirming whether transfer impact assessments, standard contractual clauses, adequacy decisions, or other mechanisms are required for each third-party provider used.

We may update this Privacy Policy from time to time to reflect changes in how we collect or use data, changes to the Platform, or changes in applicable law. We will notify users of material changes via email or Platform notification before or at the time the change takes effect. The version number and effective date at the top of this page show when the policy was last updated. Continued use of the Platform after changes constitutes acceptance of the updated policy.

For privacy enquiries, data access requests, complaints, or to exercise any of your data rights: Privacy email: privacy@folexautomarket.com Legal email: legal@folexautomarket.com Data request: /data-request Support: /contact-support Data controller legal entity details: • Company name: [To be confirmed — Nigerian company registration (CAC) pending] • CAC registration number: [To be confirmed] • Registered address: [To be confirmed] • Data Protection Officer (DPO): [To be confirmed or confirmed as not required — subject to legal review] ⚠️ [LEGAL REVIEW REQUIRED] — The legal entity name, CAC registration number, registered business address, and DPO requirement (if applicable under NDPA) must be confirmed and inserted before this policy is published. If the operating entity is incorporated in more than one jurisdiction, both entities' details may need to be included.