1. Who We Are & How to Contact Us
Data Controller: Buymedia Digital Limited
Address: Plot 12, Bode Thomas Street, Surulere, Lagos State, Nigeria
Data Protection Officer (DPO): privacy@buymedia.ng
If you have questions about this policy or how we handle your data, please contact our DPO at the email or address above.
2. What Data We Collect
We collect the following categories of personal data:
Account & Identity Data
- Full name, email address, phone number
- Company or brand name
- Account password (stored in encrypted form — we never see your plaintext password)
Booking & Transaction Data
- Media placements browsed, shortlisted, and booked
- Campaign dates, budgets, and special instructions
- Payment method type — we do not store full card numbers
- Transaction amounts, booking references, and order history
- Creative files (ad materials) uploaded for campaigns
Technical & Usage Data
- IP address, browser type, and device information
- Pages visited, search queries, and session duration
- Cookies and similar tracking technologies (see Section 8)
3. How We Use Your Data
| Purpose | Legal basis |
|---|---|
| Creating and managing your account | Contract performance |
| Processing bookings and payments | Contract performance |
| Sending booking confirmations and order updates | Contract performance |
| Providing customer support | Legitimate interest |
| Sending marketing emails (opt-in only) | Consent |
| Improving the Platform through analytics | Legitimate interest |
| Fraud detection and platform security | Legitimate interest / Legal obligation |
| Complying with legal and regulatory requirements | Legal obligation |
4. Who We Share Your Data With
We do not sell your personal data. We share data only with:
- Media Partners — to coordinate and deliver booked campaigns. Partners receive only information necessary to fulfil your booking.
- Payment processors — Paystack and Stripe process payment data under their own security standards and privacy policies.
- Email service providers — to send transactional and marketing emails.
- Analytics providers — to understand Platform usage and improve our services.
- Legal and regulatory authorities — where required by Nigerian law, court order, or NDPC request.
5. How Long We Keep Your Data
| Data type | Retention period |
|---|---|
| Account data | Duration of account + 2 years after closure |
| Booking and transaction records | 7 years (Nigerian financial record requirements) |
| Creative files | 12 months after campaign end date |
| Communication records | 3 years |
| Usage and analytics data | 24 months (anonymised after 12 months) |
6. Your Rights Under the NDPA 2023
- Right to access — request a copy of personal data we hold about you
- Right to rectification — request correction of inaccurate or incomplete data
- Right to erasure — request deletion of your data, subject to legal retention requirements
- Right to data portability — request your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interests
- Right to lodge a complaint — file a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng
7. Data Security
- SSL/TLS encryption for all data in transit
- Encrypted storage of passwords (argon2id hashing)
- PCI-DSS compliant payment processing — we do not store card numbers
- Role-based access controls — staff access data only as necessary
- Regular security assessments and vulnerability testing
In the event of a data breach posing risk to your rights, we will notify you and the NDPC within 72 hours as required by the NDPA 2023.
8. Cookies
We use cookies and similar technologies to operate the Platform and understand usage. Types used:
- Essential cookies — required for login sessions and checkout. Cannot be disabled.
- Analytics cookies — understand usage patterns. You can opt out via cookie settings.
- Marketing cookies — used only with consent.
9. International Data Transfers
Your data is primarily stored in Nigeria. Where we use service providers outside Nigeria (e.g. Stripe in the United States, cloud infrastructure providers), we ensure appropriate safeguards are in place in accordance with NDPA 2023 requirements for cross-border transfers.
10. Children's Privacy
BuyMedia.ng is not intended for persons under 18. We do not knowingly collect data from minors. If you believe a minor has registered, contact privacy@buymedia.ng and we will promptly delete the account.
11. Changes to This Policy
We may update this policy periodically. We will notify you of material changes by email or platform notice. The “Last updated” date at the top reflects the most recent revision.
12. Contact Our Data Protection Officer
- Email: privacy@buymedia.ng
- Post: Data Protection Officer, Buymedia Digital Limited, Plot 12, Bode Thomas Street, Surulere, Lagos State, Nigeria
- Regulator: Nigeria Data Protection Commission (NDPC) — ndpc.gov.ng