Privacy Policy & Data Governance Notice

This Privacy Policy is issued by Verndly Commerce & Financial Services Limited ("Verndly", "we", "us", or "our") as the designated Data Controller under the Ghana Data Protection Act, 2012 (Act 843) and aligned with international data protection standards, including the General Data Protection Regulation (GDPR) principles where applicable.

This notice governs the collection, processing, storage, sharing, and protection of personal data across all Verndly digital touchpoints, including our consumer website (verndly.com), storefront directories, merchant management portals, checkout interfaces, transactional communication channels, and developer APIs (collectively, the "Platform").

By accessing or using the Platform, registering an account, purchasing goods, or operating a merchant storefront, you acknowledge that your personal data will be processed strictly in accordance with the terms set forth herein.

We collect personal information to provide, secure, and personalize our multi-vendor commerce services. The categories of data we gather depend on your interaction with the Platform:

Under statutory data protection law, Verndly only collects and processes personal information where we have an established, lawful basis to do so:

• Performance of a Contract: Processing necessary to fulfill our contractual commitments to you, including creating user accounts, processing orders, executing escrow payments, facilitating courier dispatch, and paying out merchant earnings.
• Compliance with Legal & Regulatory Obligations: Processing required to comply with statutory taxation reporting (GRA compliance), Anti-Money Laundering (AML) / Know Your Customer (KYC) guidelines under the Bank of Ghana payment systems framework, and lawful court subpoenas.
• Legitimate Business Interests: Processing necessary for our legitimate interests in securing the Platform against cyber threats, preventing payment fraud, auditing 4% platform fees, maintaining anti-circumvention controls, enhancing catalog search, and conducting platform telemetry.
• User Consent: In specific cases where you have granted explicit consent, such as opting into our merchant newsletter, marketing communications, or promotional WhatsApp announcements. You have the statutory right to withdraw consent at any time.

Verndly utilizes personal data strictly for legitimate operational, security, and commercial purposes, including:

• Order Management & Fulfillment: Transmitting necessary shipping manifests to merchants and courier services to enable timely doorstep delivery.
• Payment Verification & Escrow Holding: Authenticating transactions, managing segregated escrow settlement holding accounts, and executing net disbursements.
• Buyer Protection & Dispute Arbitration: Investigating damaged, missing, or misdescribed product claims under our Returns & Refunds Policy.
• Merchant Governance & Security: Verifying merchant identity credentials, preventing store spoofing, identifying fake reviews, and blocking fraudulent or bot traffic.
• Transactional Communications: Transmitting automated order confirmations, official payout receipts, dispatch tracking alerts, password resets, and critical legal policy updates.
• Platform Optimization: Analyzing aggregate catalog demand, delivery turnaround speeds, and user navigation patterns to optimize marketplace performance.

We share personal data solely with the following authorized entities strictly as necessary to execute marketplace operations:

• Marketplace Counterparties: When a Buyer orders from an independent Seller, we transmit the Buyer's customer name, delivery address, and contact phone number to that specific merchant and their assigned courier strictly to facilitate packaging and physical delivery. Sellers are contractually prohibited from using buyer information for unsolicited private marketing.
• Financial & Gateway Partners: Paystack Payments Limited processes card and Mobile Money payments, maintains verified merchant subaccounts, and executes escrow settlements in accordance with their licensed regulatory duties.
• Infrastructure & Technology Providers: We utilize trusted, enterprise-grade cloud service providers bound by strict Data Processing Agreements (DPAs):
  • Resend Technologies Inc. — Secure transactional email delivery infrastructure.
  • Cloudinary Inc. — Encrypted media and product photograph hosting.
  • Supabase & Cloud Database Hosts — ISO-27001 and SOC-2 compliant managed database infrastructure.
• Legal & Law Enforcement Authorities: We may disclose personal data if required to do so by a valid court order, warrant, judicial subpoena, or statutory government directive, or when necessary to investigate financial fraud, protect consumer safety, or enforce our Terms of Service.

Verndly utilizes cookies, session tokens, and local web storage to provide a seamless, secure user experience:

• Strictly Essential Cookies: Fundamental to platform functionality. They manage authenticated user sessions, maintain shopping cart contents across page loads, enforce Cross-Site Request Forgery (CSRF) security protection, and support secure checkout routing. These cannot be disabled without breaking platform functionality.
• Functional & Preference Cookies: Remember your interface preferences, such as light/dark mode selection, recently viewed items, and preferred delivery regions.
• Performance & Analytics Cookies: Gather anonymized, aggregated telemetry on page load speeds, error rates, and navigation paths to help our engineers optimize system performance.

You may adjust your web browser settings to block or notify you about cookies. However, disabling essential cookies will prevent you from logging in, maintaining a shopping cart, or completing purchases on the Platform.

While Verndly primarily serves merchants and consumers in Ghana and West Africa, our technical infrastructure and cloud sub-processors operate high-availability data centers distributed globally.

Where personal information is transferred across international borders, Verndly ensures that appropriate statutory safeguards are enforced in compliance with the Data Protection Act (Act 843), including Standard Contractual Clauses (SCCs), strict data encryption in transit and at rest, and vetting vendor compliance with ISO/IEC 27001, SOC-2, and GDPR standards.

Verndly implements multi-tiered, industry-standard physical, electronic, and procedural safeguards to protect your personal information against unauthorized access, destruction, loss, alteration, or disclosure:

• Encryption in Transit: All HTTP communications with the Platform are strictly enforced via Transport Layer Security (TLS 1.3 / HTTPS) with modern cryptographic cipher suites.
• Encryption at Rest: Sensitive customer databases, identity verification documents, and audit trails are encrypted at rest using industry-standard Advanced Encryption Standard (AES-256).
• Credential Hashing: User account passwords are never stored in plain text; they are hashed using irreversible, salted cryptographic hashing algorithms (bcrypt/Argon2).
• Role-Based Access Control (RBAC): Internal access to user data is strictly restricted to authorized administrative personnel on a verified need-to-know basis, protected by multi-factor authentication (MFA) and immutable audit logging.

We retain personal data only for as long as necessary to satisfy the commercial, legal, and operational purposes outlined in this policy:

• Active Accounts: User profile information, storefront details, and product catalogs are maintained for the active lifecycle of your registered account.
• Financial & Transaction Records: In accordance with statutory tax legislation and corporate auditing standards, records of completed orders, payment references, tax invoices, and payout receipts are securely retained for seven (7) years following transaction execution.
• Security & Audit Logs: Server telemetry, IP access logs, and audit logs are retained for ninety (90) days for forensic analysis and intrusion detection, after which they are automatically purged.
• Account Deletion: When an account is closed upon user request, non-financial personal data is permanently deleted or anonymized within thirty (30) business days, except where retention is legally mandated.

Under applicable Data Protection legislation, you possess comprehensive statutory rights regarding your personal information. You may exercise these rights at any time through your Account Settings or by contacting our Data Protection Officer:

• Right to Access (Subject Access Request): You have the right to request a formal copy of the personal information Verndly holds about you, including transaction histories and verification files.
• Right to Rectification: You may update or correct inaccurate, incomplete, or outdated personal information directly through your dashboard or request administrative correction.
• Right to Erasure ("Right to be Forgotten"): You have the right to request the permanent deletion of your personal data, provided there are no active orders, pending escrow disputes, or statutory tax retention mandates requiring continued preservation.
• Right to Restrict or Object to Processing: You may object to the processing of your data for direct marketing purposes, promotional analytics, or automated profiling.
• Right to Data Portability: You are entitled to receive your personal data in a structured, commonly used, and machine-readable electronic format (JSON or CSV).
• Right to Lodge a Regulatory Complaint: You have the right to file a formal complaint with the Data Protection Commission (DPC) of Ghana if you believe Verndly has processed your personal data in violation of statutory law.

To submit a formal data rights request, please email our Data Protection Office at privacy@verndly.com. We verify your identity before processing and respond to all requests within thirty (30) calendar days.

Verndly is a commercial marketplace designed for adult consumers, young entrepreneurs, and registered business owners. We do not knowingly solicit, collect, or process personal data from children under the age of 16 without verified parental or legal guardian authorization.

If we become aware that personal information relating to a child under 16 has been collected without verified parental consent, we will take immediate steps to suspend the associated account and permanently erase the data from our active storage infrastructure. Parents or guardians who believe a child has provided us with personal data may contact us immediately at privacy@verndly.com.

Verndly reviews and updates this Privacy Policy periodically to reflect technological developments, legislative amendments, and platform updates. When material revisions occur, we will update the "Effective Date" at the top of this document and provide prominent electronic notice via email or your account dashboard at least seven (7) days prior to enforcement.

Your continued use of the Platform after the effective date of an amended policy constitutes your understanding and acknowledgment of the revised terms.