This Privacy Policy (hereinafter — the "Policy") describes how Awoof Cars Auction processes and protects the personal data of Users in accordance with the Nigeria Data Protection Act 2023 (NDPA) and the guidance of the Nigeria Data Protection Commission (NDPC), and — for Users located in the European Union — with the EU General Data Protection Regulation (GDPR). The Policy applies together with the Terms of Use, the Public Offer and the Cookie Policy. By using the Service, you confirm that you have read this Policy.
1. General provisions
The owner and controller of personal data is the administration of the Awoof Cars Auction service (hereinafter — "We" or the "Administration"). We determine the purpose and means of processing the data you provide during registration, payment and vehicle history checks.
We process personal data lawfully, transparently and only to the extent necessary to provide the services. Providing some data is voluntary; however, without it certain features of the Service (for example, generating and saving reports) may be impossible.
2. Terms and definitions
- Personal data — information about a natural person who is identified or can be identified.
- Processing — any action with personal data: collection, storage, use, transfer, anonymisation, deletion.
- Data subject — a natural person whose personal data is being processed.
- Consent — a voluntary, specific and informed expression of will to process data.
- Cookie — small files stored in the browser for the correct operation of the site and for analytics.
- Service — the Awoof Cars Auction website and its related features.
3. What data we collect
We collect only the data required to provide the services. Depending on how you use the Service, these may include the following categories:
Account data
Name, email address, phone number and password (in encrypted form) that you provide during registration.
Request data
The VINs you enter for checking, as well as the reports generated and saved for you.
Payment data
Information about the order and payment. Card details are processed by the payment provider — we do not store the full card number.
Technical data
IP address, browser and device type, date and time of visit, cookie files and data about behaviour on the site.
4. Purpose and legal grounds of processing
We process personal data only where there is a legal ground and for the following purposes:
- Providing services — generating reports, processing payments and maintaining the account (performance of a contract).
- Support and communication — responding to enquiries and sending service notifications about order status (performance of a contract).
- Improving the Service and security — analytics, preventing fraud and technical abuse (legitimate interest).
- Marketing — newsletters about news and promotions are sent only with your consent, which can be withdrawn at any time.
- Compliance with legal requirements — accounting and other obligations provided for by law (legal obligation).
7. Data storage and protection
We store personal data for as long as it is necessary to achieve the purpose of processing, and also for the periods provided for by law. After these periods expire, the data is deleted or anonymised.
To protect data we apply technical and organisational measures: connection encryption (HTTPS), storing passwords in hashed form, differentiation of access rights and regular backups.
8. Your rights
As a subject of personal data, you have the right to:
- Know about the processing of your data and obtain access to it.
- Request the correction of inaccurate data or the updating of incomplete data.
- Request the deletion of data or the restriction of its processing in the cases provided for by law.
- Withdraw consent to data processing previously given.
- Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or another supervisory authority with jurisdiction over you.
Your name, the language of our letters and your password are yours to change in the "Profile" and "Account security" sections of the account. For everything else, including deletion of your data, contact us using the contact details below.
9. International data transfer
Since some data sources and partner services are located outside Nigeria — in particular the United States auction platforms whose records our reports draw on — your data may be processed in other countries. In such cases we transfer data only to countries or partners that provide an adequate level of protection, or on the basis of contractual safeguards, as required by the Nigeria Data Protection Act 2023.
10. Data of minors
The Service is intended for persons who have reached the age of 18. We do not knowingly collect the personal data of minors. If we become aware that a child's data was provided without the consent of legal representatives, we will delete it as soon as possible.
11. Changes to the Policy
We may update this Policy by publishing a new version on this page, indicating the date of the update. We will notify you separately of significant changes — on the site or by email. Continued use of the Service after the changes take effect means your agreement with the updated version.
12. Contacts
For any questions regarding the processing of personal data or to exercise your rights, contact us via the contacts page. We will review your enquiry within the time limits provided for by law.