Privacy
This notice explains what Ekime does with personal data, under the Nigeria Data Protection Act 2023. It covers two different groups of people, and the difference matters throughout:
- Merchants and their staff — people with an Ekime account, running or working in a shop.
- Shoppers — people who order from a shop that uses Ekime, whether or not they have an account.
For merchants and staff, Ekime Limited is the data controller: we decide what is collected and why. For shoppers, the shop is the controller and we are its processor — the shop decides to take your order, and we hold the record on its behalf. If you want a shop to forget you, you may ask us and we will act on it, but the shop is who the data belongs to.
Ekime Limited is registered with the Nigeria Data Protection Commission as a data controller (Extra High Level, 2026). Anyone can check this on the Commission's public register by searching for "Ekime".
What we collect
If you have an account
- Your name, email address and phone number.
- A hash of your password — never the password itself. If you signed in with Google, Apple or Facebook there is no password at all, only a record that the account is linked.
- Which shops you own or work in, and what you are allowed to do in each.
- Sign-in events, including failed attempts, and the actions you take that change data.
If you order from a shop
- Your name and phone number, so the shop can reach you about the order.
- Your email address, if you gave one, so we can send a receipt.
- A delivery address and directions, if the order is a delivery.
- What you ordered, what it cost, and whether it was paid for.
- Any dietary preferences or allergies you save, if you have an account. These are yours, not any shop's — a shop sees the note you attach to an order, not your profile.
What we do not collect
Card details never reach our servers. Online payments are handled by our payment provider, on their own pages. We store a reference to the payment and nothing that could be used to charge a card.
We run no advertising trackers, no analytics scripts and no third-party pixels of our own. Nobody is following you from this site to another one. A shop may add its own advertising tags to its own pages, and only with your say-so: see Cookies.
Why we are allowed to hold it
| What | Lawful basis |
|---|---|
| Your account, and the orders you place | Contract — we cannot run a shop or fill an order without it |
| Order and payment records kept for seven years | Legal obligation — Nigerian tax law requires the seller to keep them |
| Sign-in logs and audit trails | Legitimate interest — knowing who changed a price or read a customer list is how a merchant is protected from their own staff and from us |
| An application to be an aggregator, and an aggregator's account | Steps before a contract, then contract — we cannot consider an application or pay an aggregator without it. The address an application came from is kept for thirty days, to stop the form being flooded, and then deleted |
| Offers and marketing email | Consent — off unless you turn it on, and off again the moment you say so |
| Notifications to your browser | Consent — your browser asks you, and you can withdraw it there or in your settings |
Who else sees it
We do not sell personal data and we do not share it for anyone else's marketing. Data reaches these companies only because the service cannot work otherwise:
| Who | What reaches them | Why |
|---|---|---|
| Our payment provider | Your name, email, the amount and a reference | To take the payment. Card details go to them directly and never through us. |
| Our email provider | Your email address and the contents of the message | To deliver receipts, codes and reports. |
| Google, Apple or Meta | Only that you chose to sign in with them | If you use those buttons. They tell us your name, email and whether they have verified it. With Apple's Hide My Email, the address is one Apple forwards to you, and we never see the real one. |
| Your browser's push service | An encrypted message it cannot read | If you turn notifications on. Google, Mozilla or Apple carry the message; the contents are encrypted end to end and only your browser can open them. |
| The aggregator who introduced a business | The business's name, address and phone; its owner's name, phone and email; how far its setup and verification have got; how many orders it takes; its reviews' star ratings. Never its sales, order values, prices, balance or payouts, and nothing about its customers. | Only for a business that typed the aggregator's code when it opened, which is told this where it types it. So the aggregator can help it set up and keep trading. |
| Our hosting and storage providers | Everything, at rest | The servers and the object storage the service runs on. |
We will also hand over data where the law requires it — a court order, a regulator's lawful demand. We will tell you when we are permitted to.
Where it is kept
Ekime's servers and its file storage are in Germany, so your data leaves Nigeria. Our email provider and, if you use them, the sign-in and notification services named above may process it elsewhere.
Part VIII of the Nigeria Data Protection Act 2023 allows this where the destination gives personal data an adequate level of protection, and Germany — under the EU General Data Protection Regulation — does. Each of those companies processes the data only on our instructions, under a written agreement that says so. Your rights below are the same wherever the data physically sits, and you exercise them here.
How long we keep it
These are the periods the software actually enforces. A daily job applies them; they are not aspirations.
| What | How long | Why |
|---|---|---|
| Orders and payment records | 7 years | Required of the seller by Nigerian tax law. These are never deleted — see below. |
| Audit logs | 3 years | Security and accountability. |
| Sign-in sessions, with the IP address and browser they were used from | 30 days after the session ends | Legitimate interest — security. They let you (and us) see where your account is signed in and spot a sign-in that was not you. An old session is a liability, not a record. |
| A shop's record of a customer | While active, plus 1 year — or, if you have an Ekime account, as long as the account | A shop you have not ordered from in over a year has no reason to still hold your phone number. The record is anonymised, not deleted — the shop keeps its sales figures, without you in them. If you have an account, the record lasts as long as the account does, so your order history stays with you. |
| Baskets (carts) not turned into an order | 90 days | Long enough to come back to; no longer. |
| QR code scans | 12 months | A shop's count of how many people scanned its codes, for a year's comparison. |
| Table reservations | 2 years | So a shop can see a regular's history and settle a disputed booking. |
| The contents of emails we send you | 30 days | Long enough to resend one that did not arrive. The record that an email was sent (to whom, when, which kind) is kept with the audit logs. |
| The payer's details the payment gateway sends us (name, bank, account) | 180 days | To match a transfer to its order and handle a dispute or refund. The payment itself is kept with the order records. |
| Reviews you leave | Indefinitely | They are public, and a shop's rating is built from them. |
| Your account after you close it | 30 days, then erased | So a change of mind is possible. Sign in within 30 days and it is cancelled. |
Why orders survive an erasure. When you ask to be forgotten, we strip your name, phone number, email and address from a shop's records and leave the sale itself. A shop is legally required to keep what it sold and for how much; deleting that to satisfy a privacy request would break the law nobody was thinking about. What is left is a sale with no person attached to it.
What you can ask for
Under the Nigeria Data Protection Act 2023 you have these rights, and you should not have to email anybody to use most of them:
- A copy of your data. If you have an account, Preferences → Download my data builds it and hands it to you immediately, in machine-readable form.
- Correction. Change your details in your account. If something is wrong in a shop's record of you, ask the shop, or ask us.
- Erasure. Preferences → Close my account, subject to the seven-year records above.
- Withdrawing consent. Turn off marketing email or notifications in your preferences. Receipts and order updates are not marketing and continue.
- Objecting, or asking us to stop processing while a complaint is looked at. Write to our data protection officer.
- Complaining to the regulator. You can go to the Nigeria Data Protection Commission without coming to us first, though we would rather you gave us the chance to fix it.
If you have a business, staff or partner account, the same rights are under Your data in your account menu (or Security, in the partner dashboard): download a copy straight away, or ask for the account to be deleted. We look at a deletion request first, because shops, payslips and earnings hang off these accounts, and then delete it thirty days later unless you withdraw it.
If you ordered from a shop without an account, we cannot show you your history from a page — there is no account to sign in to. Write to our data protection officer with the order number and the phone number you used.
Cookies
Ekime sets one cookie, and only if you use the Google, Apple or Facebook sign-in buttons. It holds a random value for ten minutes so that we can tell your sign-in apart from somebody else's, and it is deleted as soon as you come back. It carries no identifier and follows you nowhere.
Ekime sets no advertising cookies and no third-party cookies of its own. Your sign-in token and a couple of conveniences — which shop you were last looking at, an unfinished basket — are kept in your browser's own storage, on your device, and are never sent anywhere except to us as part of a request you made.
A shop's own advertising tags. A shop that advertises on Facebook, Instagram, TikTok or Google may add those companies' tags to its own pages on Ekime, to see which of its adverts bring orders. They never run on Ekime's own pages or on any other shop's. That shop's pages then ask you first, and nothing is loaded unless you press Accept; Decline, or not answering, loads nothing. If you accept, those companies set their own cookies and learn which of the shop's pages you looked at, what you put in your basket and what you paid, but not your name, phone number or email. The shop is responsible for them, not Ekime, and so are those companies' own privacy policies. You can change your answer at any time from "Cookie settings" at the foot of the shop's page; your answer is kept in your browser, for that shop only.
Keeping it safe
- Everything travels over HTTPS.
- Passwords are hashed with bcrypt, and cannot be read back — not by us either.
- Staff in a shop see only what their role allows. A waiter cannot open the takings.
- Changes to data are recorded against the person who made them.
- Card details are never stored on our servers in any form.
If personal data is ever exposed, we will tell the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and tell the people affected where there is a real risk to them.
Children
Ekime is not for children under 13, and we do not knowingly collect their data. If you believe a child has given us data, write to our data protection officer and we will remove it.
Changes
If we change how data is used in a way that affects you, we will say so — by email where we have one — rather than quietly editing this page. The date at the bottom moves only when something has actually changed.
Contact
Our data protection officer is Canaan Okeoghene Etaigbenu, reachable at c.etai@teqpace.com. That mailbox is for data questions, access requests and complaints, and it is monitored.
Ekime Limited (RC 9895429)
26 Akinsanya Street, Ajao Estate, Lagos State, Nigeria
Registered with the Nigeria Data Protection Commission