HomeAboutFeaturesWhy MerxBlogContact
Join Beta →
Legal

Privacy Policy

Effective date: 1 March 2026 · Last updated: 1 March 2026

Merx Africa Limited (“Merx,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our platform at merx.com.ng, the Merx mobile application, and related services (the “Platform”). This policy is issued in compliance with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation 2019 (NDPR), and other applicable data protection laws.

1. Data Controller

The data controller responsible for your personal data is Merx Africa Limited, a company registered in Nigeria with its principal office in Lagos. For data protection inquiries, contact our Data Protection Officer at privacy@merx.com.ng.

2. Personal Data We Collect

We collect the following categories of personal data:

2.1 Information You Provide

  • Account Data: Full name, email address, phone number, business name, and password when you create an account
  • Identity Verification Data: Government-issued identification (NIN, BVN, or international passport), photographs, and proof of address as required for KYC compliance
  • Financial Data: Bank account details, transaction history, and payment information for escrow processing
  • Store Data: Product listings, descriptions, images, pricing, and inventory information
  • Communication Data: Messages exchanged through the Merx inbox, support tickets, and correspondence with our team

2.2 Information Collected Automatically

  • Device Data: IP address, browser type, operating system, device identifiers, and mobile network information
  • Usage Data: Pages viewed, features used, transaction patterns, time spent on the Platform, and referring URLs
  • Location Data: Approximate location derived from your IP address (we do not collect precise GPS data without your consent)

3. Legal Basis for Processing

We process your personal data on the following legal bases under the NDPA:

  • Contractual Necessity: Processing required to perform our agreement with you, including facilitating escrow transactions, operating your storefront, and delivering analytics
  • Legal Obligation: Processing required to comply with Nigerian law, including anti-money laundering regulations, CBN directives, and tax obligations
  • Legitimate Interest: Processing necessary for our legitimate business interests, including fraud prevention, platform security, and service improvement, balanced against your rights
  • Consent: Where required, we will obtain your explicit consent before processing, particularly for marketing communications and non-essential cookies

4. How We Use Your Data

  • To create and manage your account and seller storefront
  • To process and protect escrow transactions between Buyers and Sellers
  • To verify your identity in accordance with Know Your Customer (KYC) requirements
  • To detect, prevent, and investigate fraud, money laundering, and other illegal activities
  • To provide customer support and resolve disputes
  • To deliver analytics, weekly revenue digests, and performance reports
  • To communicate platform updates, security alerts, and transactional notifications
  • To improve and develop the Platform based on usage patterns
  • To comply with legal obligations and respond to lawful requests from authorities

5. Data Sharing and Disclosure

We do not sell your personal data. We may share your data with:

  • Transaction Counterparties: Limited information (name, store name, escrow status) shared between Buyers and Sellers to facilitate transactions
  • Payment Processors: Licensed Nigerian financial institutions that process payments on our behalf, subject to their own data protection obligations
  • Service Providers: Third-party vendors who assist with hosting, analytics, and communication services, bound by data processing agreements
  • Regulatory Authorities: The Central Bank of Nigeria (CBN), Nigeria Financial Intelligence Unit (NFIU), Economic and Financial Crimes Commission (EFCC), or other authorities when required by law
  • Legal Process: In response to valid court orders, subpoenas, or legal proceedings

6. Data Retention

We retain your personal data for as long as your account remains active and for a minimum of six (6) years following account closure, as required by Nigerian financial record-keeping regulations and the Companies and Allied Matters Act. Transaction records are retained for a minimum of ten (10) years in compliance with CBN regulations. You may request deletion of non-essential data at any time, subject to our legal retention obligations.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

  • Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
  • Access controls and role-based permissions for internal systems
  • Regular security assessments and vulnerability testing
  • Secure escrow fund management through licensed financial partners
  • Incident response procedures and breach notification protocols

8. Your Rights

Under the NDPA and NDPR, you have the right to:

  • Access: Request a copy of the personal data we hold about you
  • Rectification: Request correction of inaccurate or incomplete data
  • Deletion: Request erasure of your data, subject to legal retention requirements
  • Restriction: Request that we limit how we process your data in certain circumstances
  • Data Portability: Receive your data in a structured, machine-readable format
  • Objection: Object to processing based on legitimate interests
  • Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at privacy@merx.com.ng. We will respond within 30 days.

9. Cookies and Tracking

We use essential cookies to operate the Platform (session management, security tokens). We use analytics cookies only with your consent to understand how the Platform is used and to improve our services. You can manage your cookie preferences through your browser settings.

10. International Data Transfers

Your data is primarily stored and processed in Nigeria. Where data is transferred to service providers outside Nigeria, we ensure adequate safeguards are in place through standard contractual clauses or by verifying that the recipient jurisdiction provides an adequate level of data protection as determined by the Nigeria Data Protection Commission.

11. Children’s Privacy

The Platform is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Platform at least 14 days before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

13. Complaints

If you are unsatisfied with our handling of your personal data, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

14. Contact

For privacy-related questions, contact us at:
Merx Africa Limited — Data Protection Officer
Email: privacy@merx.com.ng
WhatsApp: +234 902 195 5842
Lagos, Nigeria