1. Who We Are
Littlelyst ("we", "our", "us") is a social-first individual commerce catalogue platform operated by [LITTLELYST OPERATING ENTITY NAME — PENDING BUSINESS CONFIRMATION], with registered offices at 12 Innovation Boulevard, Victoria Island, Lagos, Nigeria.
Under the Nigeria Data Protection Act (NDPA) 2023 and the General Application and Implementation Directive (GAID) 2025, we operate as a Data Controller in respect of personal data collected from registered merchants, buyers, riders, and platform visitors.
For data protection questions, write to our Data Protection Officer (DPO) at: privacy@littlelyst.com.
2. Personal Data We Collect
- Merchant Profile Data: Full name, email address, Nigerian phone number, store handle, business physical address, nearest landmark, city, state, country, and optional profile avatar.
- Financial & Payout Data: Bank name, account number, account holder name, and Paystack subaccount codes. Payment card numbers are collected and processed directly by our CBN-licensed payment partner (Paystack); Littlelyst never stores raw card numbers or CVVs.
- Identity Verification (KYC): Bank Verification Number (BVN) submitted strictly with affirmative explicit consent, verified via licensed NIBSS/CBN-accredited verification partners (Monnify / IdentifyOrg).
- Buyer Transaction Data: Buyer contact name, delivery address, phone number, order items, and payment transaction references.
- Technical & Device Data: IP address, browser type, device information, and session authentication cookies strictly necessary for service operation.
3. Purposes and Lawful Bases of Processing
| Processing Activity | Lawful Basis (NDPA s.25) |
|---|
| Storefront creation, listing management, order fulfilment | Contractual Necessity (s.25(1)(b)) |
| Payment processing, settlement payouts, ledger auditing | Legal & Regulatory Obligation (s.25(1)(c)) |
| BVN KYC Identity Verification (Monnify/NIBSS) | Explicit Informed Consent (s.25(1)(a) & s.30) |
| Platform abuse prevention, rate-limiting, and cybersecurity | Legitimate Interests (s.25(1)(d)) |
| Optional product updates, marketing newsletters, and promotions | Affirmative Consent (s.25(1)(a)) with 1-click opt-out |
4. Protection of Children (NDPA s.31)
Littlelyst is an individual social commerce platform intended strictly for persons aged 18 years and above. We do not knowingly market to or process personal data belonging to children under the age of 18. Age confirmation is enforced during account creation. If we discover that personal data of a minor has been collected without verifiable parental consent, we will immediately delete that information.
5. Third-Party Processors & Cross-Border Transfers
To deliver our services, we partner with specialized infrastructure and service providers:
- Paystack (Nigeria): Payment gateway and automated merchant payouts.
- Monnify / IdentifyOrg (Nigeria): Identity verification and BVN validation under NIBSS standards.
- Neon PostgreSQL / AWS (US-East): Managed cloud database storage governed by robust Data Processing Agreements (DPA) and Standard Contractual Clauses (SCCs).
- Resend (US): Transactional email delivery and verification OTP codes.
- Cloudinary (US/Global): Secure product image and media storage.
Where personal data is transferred across borders, transfers comply with NDPA sections 41–43 relying on contractual safeguards, technical encryption, and statutory derogations.
6. Data Retention and Storage Limitation
- Active Account Data: Retained for the duration of your active platform relationship.
- Financial & Transaction Records: Retained for 6 years in compliance with Nigerian tax, anti-money laundering (AML), and Central Bank of Nigeria (CBN) accounting directives.
- Security & Authentication Logs: Retained for a maximum of 90 days before automatic rotation and deletion.
- Marketing & Newsletter Records: Retained until the user opts out via 1-click unsubscribe.
7. Your Statutory Rights under the NDPA
Under the NDPA, you have the enforceable right to:
- Access: Obtain confirmation and copies of your personal data processed by Littlelyst.
- Rectification: Correct inaccurate or incomplete information via your profile settings.
- Erasure / Account Deletion: Permanently delete and anonymize your account and personal records via our self-service endpoint or by emailing privacy@littlelyst.com.
- Object & Restrict: Object to processing based on legitimate interests or direct marketing.
- Withdraw Consent: Revoke consent at any time without affecting the lawfulness of processing prior to withdrawal.
- Lodge a Complaint: File a complaint with the Nigeria Data Protection Commission (NDPC) at https://ndpc.gov.ng.
8. Security and Incident Notification
We implement industry-standard cryptographic practices (SHA-256 HMAC verification, bcrypt password hashing, HTTP-only secure cookie isolation, strict security response headers, and rate limiting).
In the event of a verified personal data breach likely to result in risk to the rights and freedoms of individuals, we commit to notifying the NDPC within 72 hours and affected users without undue delay, in accordance with NDPA statutory rules.
9. Contact Our Privacy Team
For any questions, requests, or statutory rights submissions, contact:
Data Protection Officer
Littlelyst Privacy & Legal Operations
Email: privacy@littlelyst.com
Physical Address: 12 Innovation Boulevard, Victoria Island, Lagos, Nigeria