Data Policy

Kasoowa Limited (RC 8713980), which operates KASDAQ, is the data controller for the personal information described in this policy. That means we decide what is collected and why, and we are answerable for it.

Our registered address is 136 NTA Road, Port Harcourt, Rivers State, Nigeria. Written correspondence about your data may be sent there, though email reaches us faster.

This policy explains what we collect, why we collect it, who else sees it, how long we keep it, and what you can require us to do about it. It applies to everyone who uses KASDAQ, and it forms part of our Terms of Use.

Questions, requests and complaints about your data go to privacy@kasdaq.io. We answer data-rights requests within 30 days.

We collect only what the marketplace needs to work. Grouped by why it exists:

We do not ask for card details, we do not use advertising or tracking cookies, we do not buy personal data from anyone, and we do not build profiles of you for advertising.

We verify you against a Nigerian bank account you already have. That is the whole of it — there is no document to upload, no government identifier to enter, and nothing to wait for.

You give us your legal first and last name when you register. When you verify, you choose your bank and enter your ten-digit account number. We put that number to your bank through Paystack, the bank replies with the name the account is held in, and we compare it with the name on your profile. If the two are the same person, you are verified there and then — nothing is queued for review and nothing sits pending.

A Nigerian bank account is not anonymous. Your bank identified you when it opened the account and still holds that record; what we hold is an account number your bank has confirmed is yours. The identity behind it is as real as any, and it stays where it already was — with your bank.

What we keep from that process is the outcome and the date, the bank and account number you nominated, the account name your bank returned, and your confirmation that the account is your own and you have access to it. That account is also where your sale proceeds are sent, which is why it must be in your name — we do not pay a third party's account, whoever they are to you.

A bank account can be verified on one KASDAQ account only. If the number you enter is already verified elsewhere we refuse it and point you to support, where you can tell us why it is yours.

Paystack — licensed by the Central Bank of Nigeria — makes the enquiry for us and receives the bank code and account number in order to make it. It remains our payment processor for collecting and sending money. It no longer performs any identity check on our behalf beyond asking your bank whose account this is.

We do not match faces. Nothing on KASDAQ compares one photograph with another, and no facial recognition is used at any point. The photograph is shown to one person — the one you are about to meet — so they can recognise you, and kept as a record of who met.

Every deal on KASDAQ ends with two people meeting in person. Before that meeting, each of you takes a photograph of your own face through the app, and each of you is shown the other's. At the meeting you are each asked one question: is the person in front of you the person on your screen. Either of you can answer no, which stops the handover and brings us in. Nobody is penalised for answering no.

The camera must be live — the app will not accept a photograph from your gallery, and it checks that the picture is moving so that a photograph held up to the lens is refused. The time is recorded, and an approximate location if your device offers one, rounded to about 100 metres. If you refuse the location prompt the photograph is still accepted; we do not require it.

If you are sending somebody else to collect or deliver — a relative, a driver, a colleague — you photograph them rather than yourself, and you give us their name and a phone number. The other party sees that they are meeting a nominee rather than you. What happens at that meeting remains yours: you nominated them.

A photograph of a face is sensitive personal data under the Nigeria Data Protection Act 2023, and we treat it that way. We ask for it only once a deal is agreed and a meeting is due; it is stored privately rather than on a public address, and is never published, never attached to a listing, never used for advertising, and never given to any other user beyond the one person you are meeting. We log every time your photograph is opened, and show you that log.

It is deleted 90 days after the handover. We keep it longer only where that handover is in dispute, has been reported to us, or is the subject of a police enquiry — and then only until that is closed. If a handover is disputed or a device is reported stolen, we may give these photographs to the police or to a bank investigating a payment.

You can decline. The step is not optional for a handover, so declining means that deal does not complete — tell us and we will unwind it and return the money. It does not affect your account standing.

Under the Nigeria Data Protection Act 2023 we must have a lawful basis for each use. Ours are:

We do not use your data to make any automated decision that has a legal effect on you without a human being involved. Listing photographs are screened automatically, but a strike or a suspension is reviewable by our team, and you can appeal it.

Conversations between buyers and sellers are monitored. Our support team can read any conversation, and can be invited into one to mediate a dispute. Messages are recorded permanently and are not deleted or edited by either party.

This is not incidental — it is how the marketplace stays safe. The most common frauds on any peer-to-peer platform begin with a message asking to move the deal elsewhere, and the transcript is the evidence we use when the two of you disagree about what was agreed.

Automated checks flag messages that appear to contain contact details or an attempt to arrange payment off-platform. Flagged messages are still delivered exactly as written — we do not rewrite or silently drop what you send.

Please treat the conversation as a business record rather than a private chat, and do not use it for anything unrelated to the deal.

Other users. The person on the other side of a deal sees your first name, your general location, your listing content, your ratings and completion history, and whatever you write in the conversation. They never see your email address, your phone number, your bank details or your exact address unless you choose to reveal them — which we ask you not to do.

Service providers. We use a small number of providers to run the service. Each receives only what its job requires, and each is bound to use it only for that purpose:

Law enforcement and regulators. We disclose data where we are legally required to, and where we reasonably believe it is necessary to prevent or investigate a crime — in particular dealing in stolen devices. We do not require a court order before cooperating with a genuine police investigation into a stolen item, and we will preserve the listing, the transcript and the payment trail.

A sale of the business. If the business is reorganised, sold or merged, data may transfer to the acquirer, who would be bound by this policy or one no less protective. You would be told.

We do not sell your personal data. We have never sold it and we will not.

Some of our providers — our hosting, database, email and image-screening providers — operate servers outside Nigeria, so some of your data is processed abroad.

Where that happens, we rely on the transfer conditions permitted by the Nigeria Data Protection Act: the provider is in a jurisdiction with adequate protection, or is bound by contractual terms requiring a standard of protection equivalent to Nigerian law, including on security, onward transfer and deletion.

Your identity verification is handled by Paystack in Nigeria, and the enquiry behind it goes to your own Nigerian bank.

Under the Nigeria Data Protection Act 2023 you have the right to:

• know what we hold about you, and get a copy of it;
• correct anything inaccurate — most of it you can edit yourself in Settings;
• erase your data, where we have no lawful reason to keep it;
• object to processing based on our legitimate interests, and to withdraw consent where consent is the basis — for notifications and location, at any time, without giving a reason;
• restrict processing while a dispute about accuracy or lawfulness is resolved;
• receive your data in a portable form, and ask us to send it to another controller;
• complain to the Nigeria Data Protection Commission if you think we have got it wrong.

To exercise any of these, email privacy@kasdaq.io from the address on your account. We will confirm receipt, may need to verify who you are, and will respond within 30 days. There is no charge.

Account closure and erasure is currently handled by request rather than by a button in the app. Email us and we will close the account, cancel anything open, return any money we are holding to the bank account we hold for you, and erase your personal data other than the financial records we are legally required to retain. We are building this into Settings; until then, the email route is the one that works and we treat it with the same urgency.

Some of this you can do yourself right now, in Settings: turn notifications off, which deletes the push addresses for your devices; change your profile photo, your location and your payout bank account. Your verified name is the one exception — it is the name your bank returned for your account, and only we can correct it, because the account was accepted on the basis that the two match.

Some things cannot be erased on request. We cannot delete a conversation the other party to a deal is also entitled to rely on as evidence, and we cannot delete the financial record of a completed sale.

• Everything travels over encrypted connections, and is encrypted where it is stored.
• Access to your data is restricted at the database level, per user, so one user's request cannot read another's rows even if the application has a fault.
• Passwords are stored only as hashes. Nobody at KASDAQ can see your password.
• Verification stores an outcome and a bank account, never a government identifier or a document. There is very little here to leak.
• Access to production data by our team is limited to the people who need it to run support and settlement.
• Payment operations are logged, and money movements are recorded double-entry so a discrepancy is detectable.

No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify the Nigeria Data Protection Commission within 72 hours and tell you without undue delay, along with what happened and what you should do.

Help us: use a password you use nowhere else, never share a one-time code, and remember that we will never ask you in a message for your password, a one-time code, your bank login or any government identifier. Anyone who does is not us.

We use no advertising cookies, no analytics cookies and no third-party trackers. What we store on your device is limited to:

Because none of this is used for advertising or profiling, there is no consent banner to click through. Signing out clears your session.

KASDAQ is for adults. You must be 18 or over to register, and we do not knowingly collect data from anyone younger.

If you believe a child has given us personal data, tell us at privacy@kasdaq.io and we will delete it and close the account.

We will update this policy as the service changes. The version and effective date are at the top of this page.

If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect, and where the law requires it we will ask for your consent again rather than assume it.

Kasoowa Limited, 136 NTA Road, Port Harcourt, Rivers State.

If you are not satisfied with how we have handled your data, you can complain to the Nigeria Data Protection Commission. We would rather you came to us first, but that is your right and we will not obstruct it.