JAAR Privacy Policy

1. Introduction

JAAR ("JAAR," "we," "us," or "our") operates usejaar.com and the JAAR mobile application (together, the "Platform"), a secure escrow platform for social commerce transactions. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have over it.

This Policy is written to comply with the Nigeria Data Protection Act 2023 ("NDPA") and applicable Nigeria Data Protection Commission ("NDPC") regulations. If you are located outside Nigeria, additional local data protection rights may apply to you, and nothing in this Policy limits those rights.

By using JAAR, you acknowledge that your personal data will be processed as described in this Policy.

2. Who This Policy Applies To

This Policy applies to Buyers, Sellers, and any other individual whose personal data we process in connection with the Platform, including individuals named as recipients on a delivery, or business representatives whose details are submitted for business verification (KYB).

3. Information We Collect

3.1 Information You Provide Directly

• Account information: full name, phone number, and basic or seller profile details provided during onboarding.
• Identity verification (KYC) information: government-issued identification details and other information required to verify your identity, collected when you take an action that requires verification, such as making your first payment.
• Business verification (KYB) information: business registration details and related documentation, where you register as a seller operating as a business.
• Financial information: bank account details you provide for the purpose of receiving withdrawals or refunds.
• Transaction information: details of deals you create or accept, including transaction amount, item or service description, delivery details, and communications related to a transaction.
• Dispute and delivery evidence: photos, videos, text descriptions, tracking numbers, and other evidence submitted in connection with delivery confirmation or a dispute.
• Support communications: information you provide when you contact JAAR support, including the content of your messages.

3.2 Information Collected Automatically

• Device and usage information: IP address, device type, operating system, browser type, and how you interact with the Platform.
• Log data: access times, pages viewed, and actions taken on the Platform, for security, fraud prevention, and service improvement purposes.
• Cookies and similar technologies: as described in our separate Cookie Policy, which forms part of this Policy.

3.3 Information From Third Parties

• Verification results: confirmation of identity or business verification outcomes from our regulated financial infrastructure partner ("Anchor" or "our Payment Partner"), which conducts KYC/KYB checks on our behalf. We store verification status and reference identifiers rather than duplicating full identity documents wherever possible.
• Payment and transaction confirmations: confirmation of payments, collections, and payouts from our Payment Partner.
• Delivery and logistics information: tracking and delivery status from courier or logistics partners, where available.

We do not knowingly collect information from anyone we know to be under the age of 18. If we learn that we have inadvertently collected such information, we will take reasonable steps to delete it.

4. How We Use Your Information

We use your personal data to:

• create and manage your JAAR account;
• verify your identity and, where applicable, your business, in order to comply with legal and regulatory requirements and to protect the integrity of transactions;
• facilitate the creation, acceptance, payment, tracking, delivery, inspection, and completion of transactions between Buyers and Sellers;
• hold, release, or refund escrowed funds according to the conditions of a transaction;
• process withdrawal requests to your verified bank account;
• investigate and resolve disputes, including reviewing evidence submitted by both parties;
• send transactional notifications, including one-time passwords (OTP), payment confirmations, delivery updates, dispute updates, and withdrawal confirmations, via in-app notification, SMS, and email;
• detect, investigate, and prevent fraud, unauthorized transactions, and other illegal activity;
• maintain records for financial reconciliation, accounting, and audit purposes;
• respond to your support requests; and
• comply with applicable legal, regulatory, and law enforcement obligations.

We do not use your identity documents, bank account details, or transaction data for advertising purposes, and we do not sell your personal data.

5. Legal Basis for Processing

Where the NDPA requires a specified legal basis, we rely on one or more of the following: your consent (for example, where you opt in to marketing communications); the necessity of processing to perform our contract with you (for example, to complete a transaction you have created or accepted); our legitimate interests in operating, securing, and improving the Platform, provided these interests are not overridden by your rights; and our compliance with legal obligations, including anti-money laundering, know-your-customer, and financial recordkeeping requirements.

6. How We Share Your Information

We share personal data only as necessary for the purposes described in this Policy, including with:

• Our Payment Partner (Anchor): for identity and business verification, payment collection, sub-ledger accounting, and payout processing. Your bank account details and identity verification data are shared with our Payment Partner to the extent necessary to process payments and comply with financial regulation.
• Courier and logistics providers: delivery-related information necessary to fulfil and track an order, where direct courier integration is used.
• Communications providers: your phone number and relevant message content, to deliver SMS, OTP, and email notifications.
• Cloud infrastructure and storage providers: for hosting our database, application infrastructure, and secure storage of dispute evidence, delivery evidence, and verification documents, under contractual confidentiality and security obligations.
• The other party to a transaction: limited information reasonably necessary for a Buyer and Seller to complete a deal, such as name, delivery details, and dispute evidence relevant to that specific transaction. We do not share your full identity verification documents with the other party to a transaction.
• JAAR Operations (internal): for KYC/KYB review, transaction monitoring, dispute resolution, and operational support, accessible only to authorized personnel on a need-to-know basis.
• Regulators and law enforcement: where required by law, regulation, or valid legal process, or to protect the rights, property, or safety of JAAR, our users, or the public.
• Professional advisors and successors: legal, audit, or financial advisors, and any party involved in a merger, acquisition, or sale of assets, subject to appropriate confidentiality protections.

We require all third parties who process personal data on our behalf to implement appropriate security and confidentiality measures consistent with the NDPA.

7. International Data Transfers

Where personal data is transferred to or processed by a service provider located outside Nigeria (for example, a cloud infrastructure provider), we take steps required under the NDPA to ensure an adequate level of protection, such as relying on providers that maintain appropriate security certifications or entering into data protection agreements incorporating NDPC-recognized safeguards.

8. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this Policy, including the duration of your account's active use, the period necessary to resolve any open transaction or dispute, and any additional period required to meet our legal, regulatory, financial recordkeeping, audit, or accounting obligations. Financial and transaction records are generally retained for a longer period than other account information to meet regulatory and reconciliation requirements. Where data is no longer needed, we will securely delete or anonymize it.

9. Data Security

We implement technical and organizational measures designed to protect your personal data, including encryption of data in transit and at rest, access controls and role-based permissions, secrets management for sensitive credentials, private and access-controlled storage for identity and dispute-related documents, webhook signature validation for payment events, audit logging of important account and financial events, and regular monitoring for suspicious activity.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data as defined under the NDPA, we will notify you and the NDPC as required by applicable law.

10. Your Rights

Subject to applicable law, you have the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your personal data, subject to our legal and regulatory retention obligations (for example, we cannot delete records relating to a completed financial transaction where retention is legally required);
• object to or request restriction of certain processing;
• request a copy of your data in a portable format, where technically feasible; and
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us using the details in Section 13. We may need to verify your identity before actioning a request. You also have the right to lodge a complaint with the Nigeria Data Protection Commission if you believe your data protection rights have been violated.

11. Marketing Communications

Where you have opted in, we may send you marketing communications about JAAR features and updates. You may opt out at any time via the unsubscribe link in such communications or through your account settings. This will not affect transactional notifications necessary for the operation of your account and transactions, such as OTPs, payment confirmations, and dispute updates.

12. Children's Privacy

JAAR is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at:

Email: usejaar@gmail.com
Address: Abuja, Nigeria

If JAAR has appointed a Data Protection Officer under the NDPA, their contact details will be provided here.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Where changes are material, we will provide reasonable notice before they take effect. The "Last Updated" date at the top of this Policy indicates when it was last revised.