conddo.io

Conddo

Privacy Policy

Effective date: July 2026 · Last updated: July 2026

1. Introduction

Welcome to Conddo. Conddo (“we”, “us”, or “our”) is a business operating system for Nigerian small and medium businesses, operated by Conddo (RC: 9693423), a company duly registered under the laws of the Federal Republic of Nigeria.

This Privacy Policy explains how we collect, use, store, protect, and share information about you when you use our platform at getconddo.com and any related services, applications, and tenant websites hosted on our platform (collectively, the “Service”).

By accessing or using the Service, you confirm that you have read, understood, and agree to this Privacy Policy. If you do not agree, please do not use the Service.

We are committed to protecting your personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR). Where applicable, we also observe the principles of the General Data Protection Regulation (GDPR).

2. Who This Policy Applies To

This Privacy Policy applies to two types of users:

  • Tenants: business owners who register and use Conddo to manage their business operations, customers, orders, payments, inventory, and marketing.
  • End users: customers of Conddo tenants who interact with a business website, place orders, or make payments through a Conddo-powered tenant site.

Where this policy distinguishes between these groups, we will say so clearly. Where we refer to “you” generally, the policy applies to both groups.

3. Information We Collect

3.1 Information You Give Us Directly

When you register as a tenant or use the Service, we collect:

  • Account information: your name, business name, business email address, phone number, and password
  • Business information: your business description, industry vertical, business address, and operational details you provide during onboarding
  • Profile and brand information: your business logo, brand colors, and website content
  • Communications: messages you send us through support channels

3.2 Information We Collect Automatically

When you use the Service, we automatically collect:

  • Usage data: pages visited, features used, actions taken within the platform, and session duration
  • Device and technical information: IP address, browser type, operating system, and device identifiers
  • Log data: server logs, error reports, and activity timestamps

3.3 Information Related to Your Customers (Tenant Data)

When you use Conddo to manage your business, you may store your customers’ data on our platform, including:

  • Customer names, phone numbers, and email addresses
  • Order history, product preferences, and transaction records
  • Delivery addresses and contact details

You, as the tenant, are the data controller for your customers’ information. Conddo acts as a data processor on your behalf. You are responsible for ensuring you have the appropriate legal basis to collect and store your customers’ data, and for informing them that their data may be processed on a third-party platform.

3.4 Payment Information

Conddo does not collect, store, or process payment card details directly. Payments on the platform are handled by regulated third-party payment providers, and card details are entered directly into their secure interfaces. We receive only transaction confirmations and reference numbers, not card numbers, CVV, or expiry dates.

Payments are processed as follows:

  • Conddo subscriptions (tenant → Conddo): Subscription payments for your Conddo plan and program enrolments are processed by Paystack, licensed by the Central Bank of Nigeria. Review Paystack’s privacy policy at paystack.com.
  • Customer payments (customer → tenant): Payments made by end users to a tenant — including online orders, deposits, POS collections, and walk-in payments — are processed by Importapay and/or Routepay, both licensed under the Central Bank of Nigeria payment regulations. Review their respective privacy policies at importapay.com and routepay.com.

These payment providers may collect additional information as required by Nigerian financial regulations, including Know Your Customer (KYC) and Anti-Money Laundering (AML) checks. Their handling of that information is governed by their own privacy policies.

3.5 Social Media Data

If you connect your Facebook Page or Instagram Business account to Conddo’s marketing module, we collect:

  • Your Facebook Page ID and Instagram Business account ID
  • Access tokens required to publish content on your behalf
  • Basic page and account metadata (page name, follower count, account status)

We use this information solely to publish content you create and schedule within Conddo to your connected social media accounts. We do not use your social media data for advertising or share it with third parties. You can revoke Conddo’s access to your social media accounts at any time through your Facebook or Instagram settings.

4. How We Use Your Information

We use the information we collect for the following purposes:

  • To create and manage your Conddo account
  • To provide, operate, and improve the Service
  • To configure your business platform using our AI Provisioning Service, which processes your business description to recommend the right tools for your business
  • To send you transactional communications including account verification emails, payment confirmations, and service notifications
  • To send you marketing communications about Conddo features, updates, and offers, where you have given us permission to do so. You can opt out of marketing communications at any time.
  • To send you SMS notifications where you have provided your phone number and consented to SMS communication
  • To process your subscription payments through Paystack, and to route customer payments through Importapay and Routepay
  • To respond to your support requests and enquiries
  • To detect, investigate, and prevent fraudulent or unauthorized activity
  • To comply with our legal obligations under Nigerian law
  • To analyze how the Service is used so we can improve it

5. Legal Basis for Processing

We process your personal data on the following legal bases under the NDPA and NDPR:

  • Contract: processing necessary to provide the Service you have subscribed to
  • Consent: for marketing communications and SMS notifications, where you have explicitly opted in
  • Legitimate interests: for platform security, fraud prevention, and service improvement, where these interests are not overridden by your rights
  • Legal obligation: where we are required to process data to comply with Nigerian law

6. Data Ownership

You own your data. This means:

  • All business data you create on Conddo, including your customer records, order history, inventory, and business content, belongs to you
  • Conddo does not claim any ownership or rights over your business data
  • You may export or request a copy of your data at any time by contacting us at privacy@getconddo.com
  • If you close your Conddo account, we will retain your data for 90 days to allow for reactivation or export, after which it will be permanently deleted from our systems

We process your data as a data processor acting on your instructions, not as an owner of that data.

7. Data Sharing and Disclosure

We do not sell your personal data. We do not share your data with third parties for advertising purposes. We may share your data only in the following circumstances:

  • Service providers: we share data with trusted third-party providers who help us operate the Service, including Paystack (subscription payments), Importapay and Routepay (customer payments and payouts to tenants), Brevo (email and SMS delivery), Amazon Web Services (cloud infrastructure and storage), and Sentry (error monitoring). These providers are contractually bound to process your data only as instructed by us and to maintain appropriate security standards.
  • AI processing: when you use our AI Provisioning Service or marketing automation features, your business description and content may be processed by third-party AI model providers including Anthropic and DeepSeek. These providers process data only as part of generating responses and do not retain your data for their own purposes beyond what their individual privacy policies specify.
  • Legal requirements: we may disclose your data where required by law, court order, or government authority in Nigeria, including financial regulators and law enforcement in connection with fraud investigations or anti-money-laundering obligations.
  • Business transfers: in the event of a merger, acquisition, or sale of substantially all of our assets, your data may be transferred to the acquiring entity, subject to the same privacy protections.
  • With your consent: we may share data for any other purpose with your explicit consent.

8. Data Security

We take the security of your data seriously and implement the following measures:

  • All data is encrypted in transit using TLS (HTTPS)
  • Tenant data is isolated using Row Level Security in our database, meaning no tenant can access another tenant’s data
  • Access to production systems is restricted to authorized personnel only
  • We use industry-standard cloud infrastructure on AWS with appropriate security configurations
  • We monitor our systems for unauthorized access and suspicious activity using Sentry and AWS CloudWatch

No system is completely secure. While we work hard to protect your data, we cannot guarantee absolute security. If we become aware of a data breach that affects your personal data, we will notify you in accordance with our obligations under the NDPA.

9. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

  • Account data is retained for the duration of your subscription and for 90 days after account closure
  • Transaction records are retained for 7 years as required by Nigerian financial regulations
  • Marketing opt-out records are retained indefinitely so we do not contact you after you have opted out
  • Log data and usage analytics are retained for 12 months

10. Your Rights

Under the Nigeria Data Protection Act 2023, you have the following rights:

  • Right to access: you can request a copy of the personal data we hold about you
  • Right to rectification: you can ask us to correct inaccurate or incomplete data
  • Right to erasure: you can ask us to delete your personal data, subject to legal retention requirements
  • Right to data portability: you can request your data in a structured, machine-readable format
  • Right to object: you can object to processing based on legitimate interests, including direct marketing
  • Right to withdraw consent: where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at privacy@getconddo.com. We will respond within 30 days.

11. Cookies

We use essential cookies to keep you logged in and maintain your session on the platform. We do not currently use tracking or advertising cookies. If we introduce additional cookies in the future, we will update this policy and ask for your consent where required.

12. Children’s Privacy

The Service is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@getconddo.com and we will delete it promptly.

13. International Data Transfers

Your data is primarily stored and processed in Nigeria on AWS infrastructure. Some of our third-party service providers (including Anthropic, DeepSeek, and Brevo) may process data outside Nigeria. Where this occurs, we ensure appropriate safeguards are in place consistent with the NDPA requirements for cross-border data transfers.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this document and notify active users by email. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us:

  • Email: privacy@getconddo.com
  • Website: getconddo.com
  • Address: Lagos, Nigeria

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

Conddo Privacy Policy · Effective July 2026 · getconddo.com