Privacy Policy

This policy covers the VP Solution website at vpsolution.com.ng and the VP Solution mobile app for Android and iOS. Both are operated by VP Solution Ltd (RC 9571116), of Shop 44, Unilag Shopping Complex, Lagos, Nigeria.

In this policy “we” and “us” mean that company, and “you” means anyone who visits the website, uses the app, or buys from us.

We are the data controller for the personal data described here. We process it under the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Commission’s General Application and Implementation Directive 2025.

If you only want one thing from this page: we collect what an order needs, we do not sell it, and you can have it deleted. The rest is the detail behind that.

1. What we collect when you buy

To take an order and get it to you we need:

• Your name so the rider knows who to hand the parcel to
• Your phone number so the rider can reach you, and so we can reach you about the order
• Your email address so we can send the receipt and so you can find the order later
• A delivery address street, landmark, city and state, or the pickup point you chose
• What you ordered items, quantities and the amount

You can buy as a guest, without creating an account. We still need the five things above, because they are what a delivery is. We do not ask for anything extra in exchange for not registering.

If you create an account we keep the same details, so you do not retype them next time, plus a password. We never store your password itself: it is stored as a one-way hash, which means nobody at VP Solution can read it, including us.

2. What we collect when you just look around

On the website. Standard web server records: your IP address, your browser and device type, which pages you opened and when. Cookies, covered in section 8.

In the app. A device identifier, described in the next paragraph, and nothing else. There is no analytics software inside the app. We do not know which screens you opened.

The app’s device identifier is worth being precise about, because “device id” usually means something worse than what this is. When the app first runs it generates a random number, keeps it in your phone’s own secure storage, and sends it with cart and checkout requests so that a basket you fill before signing in is still there when you sign in. That is the whole purpose.

• It is random. It is not your IMEI, not your Android or iOS advertising id, and not derived from any hardware detail.
• It identifies a phone, not a person, and it cannot be linked to you by anyone who does not already have your order.
• Uninstalling the app destroys it. A fresh install generates a new one.
• We do not use it for advertising and we never share it with an advertiser.

The app does not read your contacts, your location, your call or message history, or your installed apps. It never opens your camera or your photo library.

3. The full list

What you give us directly

• Account full name, email address, phone number, hashed password
• Delivery addresses full name and phone for the delivery, street address, landmark, city, state, and which one is your default
• Orders items, quantities, amounts, delivery choice, order status and history
• Guest checkout the same name, email, phone and address, attached to that order only
• Order lookup an order number and the email it was placed with, when you look up an order you placed as a guest
• Product requests when you ask us to source something we do not stock: your name, your email, what you are looking for, and optionally your phone number, the type of item and your budget range
• Messages whatever you write to us on WhatsApp, by email or through the contact form
• Newsletter your email address, only if you ask for it

What is created automatically

• App the random device identifier above; sign-in tokens, held only in your phone’s secure keystore and never in ordinary app storage
• App notifications a Firebase Cloud Messaging token, if you allow notifications. It addresses a message to your phone. It carries nothing about you and is not an advertising identifier.
• Website IP address, browser and device type, pages viewed, referring page
• Both order and payment records we are required to keep

What stays on your own phone and never reaches us

• Items you save while signed out
• Addresses you save while signed out
• Your recent searches

These live in your phone’s own storage. If you later sign in, the app asks whether they are yours before adding them to your account, because a phone cannot tell two people apart and a shared handset should not hand one person’s saved items to another. If you answer no, they are deleted from the phone. The app also offers a “Clear this phone” control that removes them at any time.

What we never see

Your card number, CVV or card PIN. Payment happens on Paystack’s own page. The app opens it in a secure window and Paystack tells us only whether the payment succeeded, along with a reference. Card details never touch our servers or the app.

No special category data. We do not ask for and have no use for health information, religious or political views, ethnicity, trade union membership, genetic or biometric data.

4. Why we process it, and under what lawful basis

The Nigeria Data Protection Act requires us to have a lawful basis for each purpose. Ours are:

• Taking, packing and delivering your order performance of a contract with you
• Taking payment and confirming it performance of a contract with you
• Telling you what is happening with your order performance of a contract with you
• Running your account and keeping you signed in performance of a contract with you
• Answering your questions and handling complaints performance of a contract, or our legitimate interest in supporting our customers
• Sourcing an item you asked us to find your request, which is a step before a contract
• Keeping tax, accounting and order records legal obligation
• Preventing fraud and keeping the shop secure our legitimate interest in not being defrauded
• Understanding which products and pages work your consent, given through the cookie banner
• Marketing emails and advertising your consent, which you can withdraw

Where we rely on consent you can take it back at any time, and doing so is as easy as giving it. It does not affect anything we did lawfully before you withdrew it.

We do not make automated decisions about you that produce legal effects. Nothing is profiled to decide whether you may buy, at what price, or on what terms.

We collect nothing that is not needed for the purpose it is collected for. Where a field is optional, the app and the website say so and leave it blank rather than sending an empty value.

5. Who else sees it

We do not sell, rent or trade your personal data. Not to advertisers, not to data brokers, not to anybody. There is no arrangement under which money or value moves in exchange for your details.

We do share it with the people needed to complete what you asked for:

• Paystack payments. They receive your name, email and the amount, and they handle the card details we never see. Nigerian company, regulated by the CBN.
• Delivery partners your name, phone number and delivery address, and nothing else. A rider does not receive your email address or your order history.
• Pickup points if you choose pickup, your name and phone number so the parcel can be released to you.
• Email and hosting providers our email service and our web host process data on our instructions only, under contract, and may not use it for their own purposes.
• Meta and TikTok advertising measurement. NOT ACTIVE TODAY – see the paragraph below.
• Google Analytics NOT ACTIVE TODAY – see section 8.
• Firebase (Google) delivers app notifications to your phone. Receives the notification token and the message, not your order.
• Professional advisers our accountants and lawyers, where they need it and are bound by confidentiality.
• Authorities where the law requires it, or to establish or defend a legal claim.

Advertising measurement, stated plainly because it is the part people are most surprised by. Today we send them nothing: no advertising platform is configured on this site, so no purchase record leaves it and none of their software runs. The capability is built in and switched off.

When it is switched on, this is what it means, and we would rather you knew before than after. To tell which adverts work, the platform is sent a record that a purchase happened, carrying the amount and the products, your email address, phone number and name in scrambled (SHA-256 hashed) form, and a random visitor id. Hashing is one-way: they cannot read the address, only check it against one they already hold. Your IP address and browser type go with it and are not scrambled, because that is how the platform recognises the request at all. It would happen only with your consent, only on the website, and never from the app.

Where your data goes. Our website and database are held with a third-party hosting provider on our instructions, under contract, and that provider’s servers may be outside Nigeria. Some of the providers above process data outside Nigeria too – Firebase today, and Google, Meta or TikTok if advertising measurement is ever switched on. Where that happens we rely on the transfer conditions in Part IX of the Nigeria Data Protection Act and on those providers’ own contractual data protection terms.

6. The app, specifically

This section exists because Article 31 of the NDPC’s 2025 Directive requires an app to say these things plainly, in one place, and because you deserve to know them before you install.

• What it processes your name, email, phone number, delivery addresses and orders, the random device identifier in section 2, and a notification token if you allow notifications. That is the complete list.
• Why to take an order, deliver it, take payment for it, keep you signed in, and tell you what is happening with it.
• Nothing surplus the app processes nothing that is not needed for those purposes. There is no analytics software in it, no advertising identifier, no tracking of what you browse.
• Permissions internet access, and notifications if you allow them. The app requests no camera, no photo library, no location, no contacts, no storage.
• How it is protected all traffic uses HTTPS with certificate validation. Sign-in tokens and the device identifier are held in the operating system’s own hardware keystore (Android Keystore, iOS Keychain), never in ordinary app files. Sign-in tokens are short-lived and the long-lived refresh token is replaced every single time it is used, so a stolen one stops working. Diagnostic logging is disabled in the published build, and even in development it redacts credentials.
• Privacy by design the app was assessed before release for what it would collect, and it was built to collect the minimum. Two examples of the choices that came out of that: the device identifier is random rather than a hardware id, and items you save while signed out stay on your phone rather than being uploaded.
• Getting help Account -> Help & FAQ inside the app, or WhatsApp 0811 111 1328, or Info@vpsolution.com.ng.
• Turning it off you can uninstall the app at any time, which destroys the device identifier and everything stored on the phone. You can clear the phone’s stored data without uninstalling, from Account -> Clear this phone. You can delete your whole account from Account -> Profile -> Delete account, or at vpsolution.com.ng/account-deletion/.
• Complaining contact us first, at Info@vpsolution.com.ng. If we do not put it right you may complain to the Nigeria Data Protection Commission at ndpc.gov.ng. If you are outside Nigeria you may complain to the data protection authority where you live.

7. How long we keep it

• Your account until you delete it. We do not close an account for being inactive, so it is there whenever you come back.
• Order and payment records 6 years, the usual figure for Nigerian tax and accounting records. These survive account deletion. We are required to keep them and cannot delete them on request. See section 9.
• Guest orders the same period, for the same reason
• Delivery addresses until you delete them or delete your account
• Product requests 7 days
• Support messages 120 days
• Website tracking events 180 days, after which the individual records are permanently deleted. Anonymous daily totals, which cannot be traced to any person, are kept for reporting.
• Server logs 20 days
• App data on your phone until you clear it, sign out, or uninstall

When a period ends we delete the data or reduce it to a form that can no longer identify anybody.

8. Cookies and similar technologies

This section is a summary. The full list of cookies, with names and lifetimes, is in our Cookie Policy.

This is about the website. The app does not use cookies for tracking and has no analytics software in it.

Necessary cookies run without asking, because the site cannot work without them: keeping you signed in, remembering your basket, security, and remembering your cookie choice itself. They do not track you across other websites.

Everything else waits for your answer. The banner offers a real choice between accepting and refusing, both buttons the same size and weight, and until you answer nothing optional runs: no visitor id, no session id, no analytics record.

We run no third-party analytics or advertising today. There is no Google Analytics, no Meta Pixel and no TikTok Pixel on this site. What the optional categories cover is our own first-party count of which pages and products people use, and which campaign or website sent you to us. If we ever switch an advertising platform on, the Cookie Policy is updated before it runs and your consent still gates it.

Your answer lasts 30 days, after which the banner asks again. To change it sooner, use Cookie settings at the bottom of any page: it clears your answer and asks again straight away, so withdrawing is one click, exactly like giving it.

Refusing the optional cookies does not stop you shopping and does not change any price.

9. Your rights

Under the Nigeria Data Protection Act 2023 you have the right to:

• Be told what we hold and what we do with it. This page is that.
• See it ask for a copy of your personal data.
• Correct it have anything wrong or incomplete fixed. Most of it you can fix yourself in Account -> Profile.
• Delete it ask us to erase your personal data. See below.
• Take it elsewhere receive your data in a common machine-readable format, or have us send it to another provider where that is technically possible.
• Object object to processing we base on legitimate interest.
• Restrict it ask us to pause processing while a dispute about accuracy is sorted out.
• Withdraw consent at any time, for anything we do on the basis of consent.
• Complain to the Nigeria Data Protection Commission, ndpc.gov.ng.

Exercising any of these is free and we will answer within 30 days. We will not treat you differently for asking.

Deletion, honestly. Ask and we will delete your account, your saved addresses, your saved items, your product requests and your marketing preferences. We cannot delete the record of an order you actually placed: Nigerian tax and accounting law requires us to keep it. What we do instead is detach it from your account, so it survives as a financial record and not as a profile of you. If we ever have to refuse part of a request we will tell you which part and which law requires it.

How to ask. Email Info@vpsolution.com.ng, or message WhatsApp 0811 111 1328, or use the account deletion page. We may ask you to confirm who you are before we act, which protects you rather than us.

10. How we protect it

• Everything travels over HTTPS. The app validates certificates and refuses plain connections.
• Passwords are stored as one-way hashes and cannot be read by anybody, including us.
• App sign-in tokens live only in the phone’s hardware-backed keystore. The long-lived token is replaced on every use, so a captured one is useless the moment the real device uses it again.
• Card data never reaches us. Paystack handles it and is PCI DSS certified.
• Access to customer data is limited to staff who need it to do their job.
• Sensitive values are redacted from logs, and diagnostic logging is off in the published app.

No system is perfectly secure and we will not pretend otherwise. If a breach happens that is likely to harm you, we will tell you and we will report it to the Nigeria Data Protection Commission within 72 hours, as the Act requires.

11. Children

VP Solution is not for children. You must be at least 18 to hold an account or place an order. We do not knowingly collect data from anyone under 18, and if we find that we have, we delete it. If you believe a child has given us their details, tell us at Info@vpsolution.com.ng and we will remove it.

12. Other people’s sites

We link to other websites, including Paystack for payment and our social media pages. Once you are on somebody else’s site, their privacy policy applies and not ours. We are not responsible for how they handle your data.

13. Changes

We update this policy when what we do changes. The date at the top is when it last changed. If a change materially affects your rights we will tell you directly, by email or in the app, rather than quietly editing this page.

14. Contact

• Company VP Solution Ltd (RC 9571116)
• Address Shop 44, Unilag Shopping Complex, Lagos, Nigeria
• Email Info@vpsolution.com.ng
• WhatsApp 0811 111 1328
• Data queries and deletion requests Info@vpsolution.com.ng, marked “Data protection”

If you are not satisfied with how we handle a request, you can complain to the Nigeria Data Protection Commission, ndpc.gov.ng.