Skip to content
hepploNearby

Privacy & data protection

Draft — pending legal review. This document was prepared during development and has not yet been reviewed by a qualified lawyer. It must not be relied on until it has, and no provider data should be collected against it in production.

This notice explains what personal data Nearby collects, why, and what rights you have. It is written with reference to the Nigeria Data Protection Act 2023 (NDPA).

Who is the data controller

Hepplo is the data controller for personal data processed through Nearby. Contact details for the data protection contact must be added before launch.

What we collect from service providers

If you create a listing, we collect and publish:

  • Your name, and business name if you give one.
  • Your phone number, and WhatsApp number if different.
  • Your email address, if you choose to give one.
  • The description of your work, your service categories and the areas you serve.
  • Your profile photo, if you upload one.

We also keep, but do not publish: the date and version of terms you consented to, a one-way hash of the IP address you consented from, and a record of when you last confirmed your listing is current.

Our lawful basis

We publish your details on the basis of your consent, given explicitly when you created your listing. The purpose of publication is to let potential customers find and contact you directly. You may withdraw consent at any time by requesting removal, and withdrawal does not affect processing that already took place.

We do not create listings for people who have not asked to be listed. We do not compile provider details from other websites or public sources.

What we collect from visitors

When you tap a call, WhatsApp or Marketplace link we record the fact that the click happened, which listing it related to, the page it happened on, and an anonymous first-party session identifier. We use this to understand which categories and areas are useful. We do not record who you are, and we do not record the content of any conversation you have with a provider — those happen entirely outside Hepplo.

What we do not do

  • We do not sell personal data.
  • We do not share provider contact details in bulk with third parties.
  • We do not handle bookings or payments through Nearby.

How long we keep data

Listings are kept while they are active. A listing that goes 180 days without confirmation is hidden from search but retained so the provider can restore it. On a removal request we unpublish immediately and delete the listing and its personal data.

Verification codes are stored only as hashes and expire after 10 minutes.

Your rights

Under the NDPA you have the right to access your data, correct it, request its deletion, withdraw consent, and lodge a complaint with the Nigeria Data Protection Commission. Providers can see and update most of their data from the manage your listing page.

Security

Data is stored in an access-controlled database. Verification codes are hashed, admin passwords are hashed with scrypt, and IP addresses are hashed rather than stored in the clear.

The Hepplo Marketplace

The Hepplo Marketplace is a separate product with its own account system and its own privacy notice. Creating a Nearby listing does not create a Marketplace account, and the two do not share data.