Privacy Policy
Effective date: 25 June 2026
1. Who We Are
AEX Ecommerce (“AEX”, “we”, “us”) operates a multi-vendor marketplace platform connecting buyers with independent store owners across Africa. We are the data controller for personal data collected through this platform. This policy explains what data we collect, why, and how we protect it.
2. Data We Collect
Account data
When you create an account or register as a seller we collect your first name, last name, email address, and optionally your phone number. Passwords are stored as one-way hashes — we never store plaintext passwords.
Order and transaction data
When you place an order we collect your delivery address, the items ordered, and the total amount. Payment is processed by Paystack — we receive a transaction reference and status only. We do not store card numbers, CVVs, or bank account details.
Store and product data (sellers)
If you open a store we collect your store name, description, operating countries, and any product information you upload including images. This data is visible to buyers on the platform.
Usage data
We collect basic session data to keep you logged in (JWT tokens stored in memory and refresh tokens in secure HttpOnly cookies). We do not run advertising trackers or third-party analytics scripts.
Reviews and communications
Reviews you submit are public and linked to your display name. Support messages you send us are retained to help resolve your issue.
3. How We Use Your Data
- To create and maintain your account
- To process orders and coordinate fulfillment between you and the relevant store
- To send transactional emails — order confirmations, shipping updates, password resets, and email verification
- To display your orders and account history to you
- To allow store owners to fulfil orders placed with their store
- To detect and prevent fraud, abuse, and policy violations
- To operate and improve the platform
We do not sell your data. We do not use your data for advertising profiling.
4. Who Can See Your Data
Store owners can see the name, delivery address, phone number, and order details of buyers who placed orders with their store. They cannot see data from orders placed with other stores.
AEX platform staff can access all account and order data for the purpose of operating the platform, resolving disputes, and complying with legal obligations. Access is logged and restricted to authorised personnel.
Paystack receives your email address and the transaction amount to process payment. Their privacy policy governs how they handle that data.
We do not share your data with any other third parties except where required by law.
5. Data Retention
We retain your account data for as long as your account is active. Order records are retained for seven years to meet commercial and tax record-keeping requirements. If you request account deletion we will erase or anonymise your personal data within 30 days, except where retention is required by law.
6. Your Rights
Under the Nigeria Data Protection Act (NDPA) 2023 and applicable data protection frameworks in our operating countries, you have the right to:
- Access a copy of the personal data we hold about you
- Correct inaccurate data — you can update most data directly in your account settings
- Request deletion of your personal data (subject to legal retention obligations)
- Object to or restrict certain processing
- Withdraw consent where processing is based on consent
To exercise any of these rights, email us at privacy@aex.africa. We will respond within 30 days.
7. Security
All data is transmitted over HTTPS. Passwords are hashed using bcrypt. Payment processing is delegated entirely to Paystack, who are PCI DSS compliant. Access to production data is restricted to authorised staff and logged. We conduct regular security reviews.
8. Changes to This Policy
We may update this policy when our practices change. We will notify registered users by email for material changes. Continued use of the platform after the effective date constitutes acceptance of the updated policy.
9. Contact
For privacy questions, data requests, or complaints contact us at privacy@aex.africa.