YELLOWMAN PRIVACY POLICY

Effective Date: 21 September 2026

Last Updated: 21 September 2026

Yellowman Nigeria Limited ("Yellowman", "we", "us" or "our") respects your privacy and is committed to protecting the personal data of customers, Vendors, visitors and other users of the Yellowman marketplace.

This Privacy Policy explains how Yellowman collects, uses, stores, shares, protects and otherwise processes personal data when you use the Yellowman website, mobile applications, marketplace, customer-support channels and related services (collectively, the "Platform").

This Policy is intended to operate in accordance with applicable Nigerian data protection law, including the Nigeria Data Protection Act 2023 ("NDP Act"). The NDP Act establishes principles including lawful, fair and transparent processing, purpose limitation, data minimisation, accuracy, storage limitation and security.

Nothing in this Privacy Policy limits any data subject right that cannot lawfully be excluded.

1. WHO WE ARE

Yellowman is a Nigerian multi-vendor ecommerce marketplace operated by Yellowman Nigeria Limited.

Yellowman may act as a data controller in relation to personal data processed for operating its own marketplace, customer, account, marketing, security and business functions. Depending on the circumstances, Yellowman may also process data on behalf of another party as a processor.

Independent Vendors may separately determine how they process certain personal data in connection with their own businesses. Where appropriate, Vendors may provide their own privacy notices.

2. SCOPE OF THIS PRIVACY POLICY

This Policy applies to personal data collected or processed through:

1. the Yellowman website;
2. Yellowman mobile applications;
3. Yellowman customer accounts;
4. orders and transactions;
5. Vendor registration and Vendor accounts;
6. customer support and complaints;
7. marketing communications;
8. cookies and similar technologies;
9. social-media or other communication channels operated by Yellowman; and
10. other Yellowman services that link to this Policy.

It does not automatically apply to independent third-party websites, applications, payment providers, courier platforms or other services that Yellowman does not control. Those services may have their own privacy policies.

3. PERSONAL DATA WE MAY COLLECT

Depending on how you use Yellowman, we may collect the following categories of personal data:

1. identity information, such as name and username;
2. contact information, such as email address, telephone number and delivery address;
3. account information, including login credentials and account preferences;
4. transaction information, including products purchased, order details, delivery information, payment status and refund information;
5. payment-related information, although full payment-card or financial credentials may be processed directly by authorised payment providers rather than stored by Yellowman;
6. Vendor information, including business name, business address, identification, registration and settlement information where required;
7. communications, including customer-service enquiries, complaints, messages and support records;
8. device and technical information, such as IP address, browser type, device type, operating system and related technical identifiers;
9. usage information, such as pages viewed, searches, interactions, clicks and general Platform activity;
10. location information where reasonably required for delivery, fraud prevention, service functionality or where you have permitted the relevant collection;
11. marketing preferences and responses to marketing communications;
12. reviews, ratings, photographs and other content you choose to submit; and
13. information reasonably necessary to detect, investigate and prevent fraud, abuse, security incidents or unlawful activity.

4. PERSONAL DATA WE DO NOT INTENTIONALLY SEEK

Yellowman does not generally require sensitive personal data for ordinary marketplace purchases. You should not provide sensitive personal information through product reviews, public comments, customer-support messages or other Platform features unless it is reasonably necessary and you are authorised to do so.

If sensitive personal data is required for a particular service or legal purpose, Yellowman will process it only where there is an applicable lawful basis and appropriate safeguards.

5. HOW WE COLLECT PERSONAL DATA

We may collect personal data:

1. directly from you when you create an account, place an order, register as a Vendor or contact us;
2. automatically when you browse or use the Platform;
3. from Vendors and other transaction participants where necessary to fulfil an order;
4. from payment processors and financial institutions in connection with transactions;
5. from courier and logistics providers for delivery and fulfilment;
6. from identity, fraud-prevention or security service providers where permitted;
7. from public or legally available sources where reasonably necessary; and
8. from other third parties where lawful and relevant to providing the Platform.

6. WHY WE PROCESS YOUR PERSONAL DATA

We may process personal data for the following purposes:

1. creating and managing customer and Vendor accounts;
2. processing and fulfilling orders;
3. arranging delivery;
4. processing payments, refunds and transaction-related issues;
5. providing customer support;
6. communicating about orders, accounts, security and service updates;
7. administering Vendor relationships and settlements;
8. verifying identity or business information where necessary;
9. detecting and preventing fraud, abuse, money laundering and other unlawful activity;
10. protecting the security and integrity of the Platform;
11. handling complaints, disputes and returns;
12. improving products, services and Platform performance;
13. conducting analytics and measuring Platform usage;
14. sending marketing communications where permitted;
15. personalising relevant Platform experiences;
16. complying with legal and regulatory obligations;
17. responding to lawful requests from regulators, courts, law-enforcement bodies or other authorised persons; and
18. establishing, exercising or defending legal claims.

7. LAWFUL BASES FOR PROCESSING

Yellowman will process personal data only where there is a lawful basis under applicable data protection law.

Depending on the circumstances, lawful bases may include:

1. your consent;
2. performance of a contract or steps taken at your request before entering into a contract;
3. compliance with a legal obligation;
4. protection of vital interests where applicable;
5. performance of a task carried out in the public interest where applicable; and
6. legitimate interests, where permitted by law and where those interests are not overridden by applicable rights and protections.

The applicable lawful basis depends on the particular processing activity. Consent is not the only lawful basis for processing personal data under the NDP Act.

8. CONSENT

Where Yellowman relies on consent, you may withdraw your consent where permitted by law. Withdrawal of consent will not affect processing that was lawfully carried out before withdrawal and may not stop processing where Yellowman has another lawful basis or is required by law to continue.

Marketing preferences can generally be changed using the unsubscribe mechanism in a marketing message or by contacting Yellowman.

9. COOKIES AND SIMILAR TECHNOLOGIES

Yellowman may use cookies, pixels, local storage, device identifiers and similar technologies to operate and secure the Platform and to understand how users interact with it.

Cookies may be used for:

1. essential Platform functionality;
2. account and session management;
3. security and fraud prevention;
4. remembering preferences;
5. analytics and performance measurement;
6. personalisation; and
7. marketing or advertising where permitted and appropriately disclosed.

Where consent is required for non-essential cookies or similar technologies, Yellowman will provide an appropriate mechanism for you to make or change your choices.

You may also manage cookies through your browser or device settings, although disabling certain cookies may affect Platform functionality.

10. PAYMENT INFORMATION

Yellowman may use authorised payment service providers to process payments. Depending on the payment method, payment providers may collect and process payment-card, bank or other financial information directly.

Yellowman may receive transaction-related information such as payment status, transaction reference, amount and payment method, but should not be understood to store full payment-card credentials where those credentials are handled directly by the applicable payment provider.

Payment providers may process personal data under their own privacy policies and applicable regulatory obligations.

11. SHARING PERSONAL DATA WITH VENDORS

Because Yellowman is a multi-vendor marketplace, certain personal data may need to be shared with the Vendor supplying your order.

This may include information reasonably necessary to:

1. identify and fulfil your order;
2. prepare and package products;
3. arrange delivery;
4. respond to product-related questions;
5. process returns, refunds or warranty matters; and
6. comply with legal or regulatory requirements.

Vendors must process personal data received through Yellowman only for legitimate purposes and in accordance with applicable law and their contractual obligations.

12. SHARING WITH SERVICE PROVIDERS

Yellowman may engage third-party service providers to support Platform operations.

These may include:

1. hosting and cloud service providers;
2. payment processors and financial institutions;
3. couriers and logistics providers;
4. identity and verification providers;
5. fraud-prevention and security providers;
6. analytics and technology providers;
7. customer-support and communication providers;
8. marketing and advertising service providers, where permitted;
9. professional advisers, auditors and insurers; and
10. other processors or contractors necessary to operate the Platform.

Where a third party processes personal data on Yellowman's behalf, Yellowman will seek to use appropriate contractual, organisational and technical safeguards as required by applicable law.

13. LEGAL, REGULATORY AND LAW-ENFORCEMENT DISCLOSURES

Yellowman may disclose personal data where reasonably necessary to comply with applicable law, court orders, regulatory requirements, lawful government requests, investigations, fraud prevention obligations or the protection of Yellowman, users or third parties.

Yellowman may also disclose information where reasonably necessary to establish, exercise or defend legal rights or claims.

14. BUSINESS TRANSFERS

If Yellowman is involved in a merger, acquisition, restructuring, financing, sale of assets or similar transaction, personal data may be transferred as part of the relevant business transaction, subject to applicable law and appropriate safeguards.

Where legally required, affected data subjects will receive appropriate notice.

15. INTERNATIONAL DATA TRANSFERS

Some service providers used by Yellowman may process personal data outside Nigeria.

Where personal data is transferred outside Nigeria, Yellowman will take reasonable steps to ensure that the transfer is carried out in accordance with applicable Nigerian data protection requirements and that appropriate safeguards are in place.

The safeguards may include contractual protections, adequacy mechanisms or other lawful transfer mechanisms recognised under applicable law.

16. DATA RETENTION

Yellowman retains personal data only for as long as reasonably necessary for the purposes for which it was collected, including contractual, operational, security, legal, accounting, dispute-resolution and regulatory requirements.

Retention periods may vary depending on the type of information and the purpose for which it is processed.

When personal data is no longer required, Yellowman will take reasonable steps to securely delete, anonymise or otherwise dispose of it, subject to legal or legitimate retention requirements.

17. DATA SECURITY

Yellowman takes reasonable technical and organisational measures designed to protect personal data against unauthorised access, unlawful processing, loss, destruction, alteration, disclosure and other security risks.

Security measures may include access controls, authentication, encryption or secure transmission where appropriate, monitoring, backups, staff controls and other technical and organisational safeguards.

No internet-based service can guarantee absolute security. You should protect your account credentials and notify Yellowman promptly if you suspect unauthorised access.

18. DATA BREACHES

If Yellowman becomes aware of a personal-data breach, we will assess and respond to the incident in accordance with applicable law, including any applicable requirements to notify the Nigeria Data Protection Commission and affected data subjects.

Yellowman may take steps to contain the incident, investigate its cause, mitigate potential harm and implement corrective measures.

19. YOUR DATA PROTECTION RIGHTS

Subject to applicable legal conditions and limitations, data subjects have rights recognised under Nigerian data protection law. The NDPC identifies rights including the right to be informed, access, rectification, objection, restriction, portability, erasure/being forgotten, and rights relating to automated decision-making, as well as the right to lodge a complaint with the Commission.

Depending on the circumstances, you may have the right to:

1. receive information about how your personal data is processed;
2. request access to personal data held about you;
3. request correction of inaccurate or incomplete personal data;
4. object to certain processing;
5. request restriction of processing in applicable circumstances;
6. request portability of personal data where the legal requirements are met;
7. request deletion or erasure where applicable;
8. withdraw consent where processing is based on consent;
9. request human intervention or exercise applicable rights concerning certain automated decision-making; and
10. lodge a complaint with the Nigeria Data Protection Commission.

20. HOW TO EXERCISE YOUR RIGHTS

To make a data protection request, contact Yellowman using the details in Section 29 of this Policy.

Your request should include enough information to identify you and understand the request. Yellowman may take reasonable steps to verify your identity before disclosing or changing personal data.

We will respond within the period required by applicable law and may explain any lawful reason why a request cannot be fully granted.

21. CHILDREN'S PRIVACY

Yellowman is a general ecommerce marketplace and is not intended to knowingly collect personal data from children in circumstances where applicable law requires parental or guardian involvement.

Where Yellowman becomes aware that personal data has been collected unlawfully from a child, we will take reasonable steps to address the situation in accordance with applicable law.

Parents or guardians who believe a child has provided personal data to Yellowman may contact us using the details below.

22. MARKETING COMMUNICATIONS

Yellowman may send transactional communications that are necessary to operate your account or fulfil an order, such as order confirmations, delivery updates, security notices and service announcements.

Marketing communications may be sent where permitted by law and, where required, based on your consent or another lawful basis.

You may opt out of marketing communications at any time using the unsubscribe mechanism provided or by contacting Yellowman.

Opting out of marketing does not prevent essential transactional or security communications.

23. PERSONALISATION AND ANALYTICS

Yellowman may use aggregated or individual usage information to understand Platform performance, improve search and recommendations, personalise experiences, detect abuse and analyse customer behaviour.

Where analytics or profiling involves personal data, Yellowman will process it in accordance with applicable law and your data subject rights.

24. AUTOMATED DECISION-MAKING AND FRAUD PREVENTION

Yellowman may use automated tools to assist with fraud detection, account security, transaction monitoring, product moderation and other risk-management activities.

Where applicable law gives you rights concerning automated decision-making that produces legal or similarly significant effects, Yellowman will respect those rights and provide appropriate mechanisms for review or human intervention where required.

Security and fraud-prevention systems may restrict or delay transactions where reasonably necessary to protect the marketplace.

25. REVIEWS, PHOTOS AND USER CONTENT

If you submit reviews, ratings, photographs, comments or other content, Yellowman may process the personal data contained in that content for operating, moderating and improving the Platform.

Do not publish another person's personal information without appropriate authority.

User-generated content may be visible to Vendors, other customers or the public depending on the feature used.

26. LINKS TO THIRD-PARTY WEBSITES

The Platform may contain links to third-party websites or services. Yellowman is not responsible for the privacy practices of websites that it does not control.

You should review the privacy policy of any third-party service before providing personal data to it.

27. YOUR RESPONSIBILITIES

You should:

1. provide accurate personal information where required;
2. keep your account credentials secure;
3. avoid sharing passwords with others;
4. notify Yellowman if you suspect unauthorised account access;
5. avoid submitting unnecessary sensitive personal data through public Platform features; and
6. respect the privacy of other users, Vendors and delivery personnel.

28. CHANGES TO THIS PRIVACY POLICY

Yellowman may update this Privacy Policy from time to time to reflect changes in law, regulatory guidance, technology, Platform features or business operations.

The updated Policy will be published on the Platform with a revised "Last Updated" date.

Where applicable law requires specific notice or consent for a material change, Yellowman will provide the required notice or obtain the required consent.

29. CONTACTING YELLOWMAN ABOUT PRIVACY

For privacy questions, data subject requests, complaints or other data protection matters, please contact:

Yellowman Nigeria Limited

Website: https://yellowman.ng

Privacy/Data Protection Email: compliance@yellowman.ng

Customer Support: customercare@yellowman.ng

Telephone/WhatsApp: +234 818 100 7777

Registered/Business Address: 16 Kajola Street, Mende, Maryland, Lagos

Nigeria

30. COMPLAINTS TO THE NIGERIA DATA PROTECTION COMMISSION

If you are dissatisfied with Yellowman's response to a data protection concern, you may have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), Nigeria's data protection supervisory authority. The NDPC provides information and mechanisms for data-subject complaints and privacy-rights enforcement.

Yellowman encourages you to contact us first so that we have an opportunity to investigate and address the matter promptly, without limiting your statutory right to complain to the Commission.

31. GOVERNING LAW

This Privacy Policy shall be governed by and interpreted in accordance with the laws of the Federal Republic of Nigeria, including applicable Nigerian data protection legislation and regulations.

32. FINAL STATEMENT

Yellowman is committed to responsible data handling, transparency, security and respect for the privacy rights of its customers, Vendors and other users.

© 2026 Yellowman Nigeria Limited. All rights reserved.