1. Introduction
This Privacy Policy explains what personal data OrderFastNow collects, why, how it is used and shared, how long it is kept, and the rights you have over it. It applies to everyone who interacts with the Platform: account holders, vendors and their team members, customers (including guests who buy without an account), delivery agents, and visitors.
OrderFastNow is operated by OrderFastNow Limited, a company incorporated in the Federal Republic of Nigeria ("OrderFastNow", "we", "us", "our"). We are the data controller for personal data processed on the Platform, and we process it in accordance with the Nigeria Data Protection Act 2023 (the "NDPA") and its subsidiary instruments.
"The Platform" means orderfastnow.com, vendor storefronts on subdomains of orderfastnow.com, and the related services we operate.
2. One platform, many storefronts
Vendor storefronts on the Platform (for example, {storename}.orderfastnow.com) are part of the Platform and covered by this policy. When you place an order on a vendor's storefront, we process your data as described here, and we share the order details with that vendor so they can fulfil it.
Vendors are independent businesses. Once a vendor receives your order details, their handling of that data in their own systems and channels (for example, contacting you on WhatsApp, or keeping their own customer records) is their own responsibility as an independent controller. This policy governs what happens on the Platform; it cannot govern what a vendor does outside it.
3. The information we collect
3.1 Information you give us
If you create an account: your email address, your name, and, if you sign in with Google, the name and profile details Google provides. Your account profile can also hold a phone number and an avatar image. We never see or store your Google password; if you sign up by email, sign-in is passwordless (one-time codes and links), so there is no OrderFastNow password either.
If you place an order (with or without an account): your name, email address, and phone number, and, for deliveries, your delivery address. If you express interest in an event, we record the email you provide for that.
If you run a business on the Platform: your business's public details (name, description, contact phone and email, WhatsApp number, social handles, and business location, including map coordinates if you set them). Business contact details are public by design: they appear on your storefront. To receive payouts, you provide your bank name and account number; the account holder name and its verified status are returned to us by your bank through Paystack's account resolution service, and cannot be entered by hand.
If you join a business's team: the email address and display name the inviting owner enters for you, and your acceptance of the invitation.
If you open a dispute: your complaint, your messages, and any evidence files you upload. Evidence is stored in a private bucket and used for resolving the dispute.
If you leave a review: your name as shown, your rating, and your comment. Vendor replies are stored alongside.
If you contact support: your name, email, and the content of your messages.
If you join our launch waitlist: your email address, phone number, country, and the location label you provide, used to tell you when OrderFastNow is available in your area.
If you accept our terms: we record which document and version you accepted, when, and through which action, as evidence of the agreement.
Email preferences: your on/off choices for optional email types.
3.2 Information others provide about you
Delivery riders: when a vendor dispatches an order with their own rider, the vendor enters the rider's name and phone number so the customer knows who is coming. If you are a rider, this data about you is provided by the vendor you work with, and shared with the customer for that delivery.
Delivery agents: your name and phone number are entered by the vendor building their agent roster, and confirmed by you when you accept the invitation.
Team invitations: as above, the inviting owner provides your email and display name.
Vendors are required by our Terms of Service to have the right to share this data before providing it.
3.3 Information collected automatically
- Order and transaction records: what was bought, paid, refunded, released, and disputed, including payment references and outcomes from Paystack.
- Activity data: in-product activity such as searches and browsing events, linked to your user or session. This data is automatically deleted after 90 days.
- Security logs: records of security-relevant events, which can include the acting account and its IP address. These protect the Platform and its users.
- Administrative audit logs: actions taken by our own staff on the Platform are logged for accountability. This is data about our staff, kept to make our own conduct auditable.
- Technical security reports: our systems receive automated reports from browsers about blocked or suspicious page behaviour, limited to technical details and containing no account information.
3.4 What we never collect
We never receive or store your card number, CVV, card PIN, or bank login credentials. Card and bank details for payments are entered on Paystack's own secure payment surfaces. What we receive and keep from Paystack are payment records: the payment reference, amount, status, payment channel, payment timestamp, and, where applicable, refund and transfer references and the bank-verified account name for payouts. This is a deliberate design rule of the Platform.
4. How we use your information, and on what legal basis
Under the NDPA, we process personal data only where a lawful basis applies. We use your data:
To provide the service you asked for (lawful basis: performance of a contract): creating and operating accounts and storefronts; processing orders, bookings, tickets, packages, and passes; coordinating fulfilment, including sharing delivery details with the vendor and their rider or agent; processing payments, holding and releasing vendor settlements, and paying refunds; running the cancellation, dispute, review, and bonus systems; and providing customer and vendor support.
To send you transactional and operational email (lawful basis: performance of a contract): order confirmations, cancellation and refund notices, booking reminders, dispute updates, payout notices, team and agent invitations, and similar messages about things you are part of. These are part of the service and cannot be switched off while the underlying activity is live.
To send you optional email (lawful basis: consent): weekly summary reports and marketing messages are sent only if you have turned them on. They are off by default, and every such email carries a one-click unsubscribe link.
To keep the Platform safe and honest (lawful basis: legitimate interests): monitoring for fraud and abuse, enforcing purchase-gated reviews, recording vendor quality events, maintaining security logs and staff audit logs, investigating violations of our Terms, and inviting you to review a completed order (which you can switch off, Section 6).
To comply with law (lawful basis: legal obligation): keeping transaction and financial records for statutory periods, responding to lawful requests from authorities, and honouring your data protection rights.
To improve the Platform (lawful basis: legitimate interests): understanding usage in aggregate. Our activity data is short-lived (90 days) and we do not sell personal data or use it for third-party advertising.
5. Cookies
The Platform uses a small number of cookies, all first-party and all strictly necessary:
- Authentication cookies: keep you signed in, including a short-lived cookie used during the sign-in handshake. The Platform's signed-in features cannot work without them. Each cookie is scoped to the site it was set on, so signing in on a vendor storefront sets a session cookie for that storefront only.
We do not use third-party advertising or tracking cookies, and we run no third-party analytics.
6. Email, and your control over it
Emails from the Platform fall into three groups. Transactional and operational email (confirmations, refunds, reminders, disputes, payouts) is part of providing the service and always sends while the activity it relates to is live. Optional email (weekly reports, marketing) is preference-gated: the default is off, no preference row means no send, and you can change your preferences at any time in your settings or through the unsubscribe link in any such email. Review invitations are a third group: after a completed order we may email you inviting a review; these are on by default, and you can switch them off at any time in your settings or through the unsubscribe link in any such email. Unsubscribe links are secured with encrypted tokens and remain valid for 30 days from the email being sent; after that, you can still unsubscribe from your settings or by contacting us.
7. How we share information
We share personal data only as needed to run the Platform:
With the vendor you buy from: your order details (name, contact details, delivery address, and what you ordered) go to the vendor so they can fulfil your order and support you. Section 2 explains the vendor's independent responsibility.
With the people fulfilling your delivery: your delivery details are shared with the rider or delivery agent handling your order, and the rider's or agent's name and phone number are shared with you.
With our service providers (processors), who process data on our instructions and only for the purposes below:
| Service | Provider | What they do for us |
|---|---|---|
| Payments | Paystack | Payment processing, bank account verification, transfers, payouts, and refunds. Card details are entered with and held by Paystack, never by us (Section 3.4) |
| Hosting, database, and storage | International cloud infrastructure providers | Running the Platform and storing its data, with primary data storage in the European Union (Section 8) |
| Email delivery | A specialist email delivery provider | Sending the transactional and optional emails described in Section 6 |
| Maps, addresses, and fonts | Address search and autocomplete (addresses you type at checkout are sent to Google to return suggestions), maps, and font delivery for our pages and emails (which involves your device's IP address reaching Google when a page or email loads). Google's own privacy policy also applies to its processing |
A current list of the specific providers we use is available on request at privacy@orderfastnow.com.
With authorities and other parties where the law requires or permits it: to comply with a legal obligation, a court order, or a lawful request; to enforce our Terms; or to protect the rights, property, or safety of OrderFastNow, our users, or the public.
In a business transfer: if OrderFastNow is involved in a merger, acquisition, restructuring, or sale of assets, personal data may be transferred as part of that transaction, under confidentiality protections, and we will notify you of any change of controller.
We do not sell personal data.
8. Where your data is stored, and international transfers
The Platform is hosted with international cloud infrastructure providers, and its primary data storage is located in the European Union. This means personal data processed on the Platform is stored outside Nigeria.
We transfer data outside Nigeria only in line with the NDPA's cross-border transfer requirements, relying on transfers to jurisdictions and providers offering adequate protection and on contractual data processing safeguards with each provider listed in Section 7. If you would like more information about these safeguards, contact us at the address in Section 16.
9. How long we keep information
We keep personal data only as long as it is needed for the purpose it was collected for, and then delete, anonymise, or irreversibly de-identify it. Specific periods:
| Data | Retention |
|---|---|
| Checkout drafts abandoned before payment begins | Deleted automatically after 30 minutes; drafts where payment was initiated become order records |
| In-product activity data (searches, browsing events) | Deleted automatically after 90 days |
| Launch waitlist entries | Kept until we have completed launch communications for your area or you ask us to remove them (email support@orderfastnow.com) |
| Acceptance records (which terms you agreed to, and when) | Kept while the agreement is relevant and afterwards as evidence of it; on account erasure, your identifiers on these records are replaced with an irreversible one-way hash |
| Unsubscribe link tokens | Expire 30 days after the email is sent |
| Account and profile data | Kept while your account is active; removed through the deletion process in Section 11 |
| Orders, payments, settlements, refunds | Kept for a minimum of six years from the transaction, as required by Nigerian tax and companies legislation; on account erasure, personal identifiers on these records are removed or replaced with irreversible placeholders while the financial record itself is preserved |
| Dispute records and evidence | Evidence files you uploaded are deleted on account erasure; the fact and outcome of the dispute are retained as part of the transaction record |
| Support tickets | Retained for support quality and record purposes; on account erasure, your email on tickets is replaced with an irreversible placeholder so the ticket content survives without identifying you |
| Security logs | Retained as long as necessary for security, fraud prevention, and legal purposes |
| Staff audit logs | Immutable by design and retained long-term; these record the actions of our own staff |
| Erasure record | When we erase your account, we permanently keep a one-way cryptographic hash of your email address, and nothing else, as our proof that the erasure was carried out. The hash cannot be reversed into your email |
10. Your rights
Under the NDPA you have the right to:
- Access the personal data we hold about you, and receive a copy;
- Correct inaccurate or incomplete data (most profile and business data you can correct yourself in settings);
- Delete your data (Section 11 describes the in-product process; you can also write to us);
- Data portability: to request an export of your personal data in a usable format, email privacy@orderfastnow.com and we will provide it within 30 days;
- Object to, or ask us to restrict, processing based on legitimate interests, in your particular situation;
- Withdraw consent at any time where processing is based on consent (for example, marketing email), without affecting processing already done;
- Not be subject to solely automated decisions with legal or similarly significant effects. The Platform's automated money movements (settlement releases, tier-based refunds, automatic full refunds) execute the published rules you agreed to at purchase, and every outcome can be raised with a human through a dispute or support ticket;
- Complain to the Nigeria Data Protection Commission if you believe we have processed your data unlawfully. We would appreciate the chance to address your concern first, but you do not need our permission to complain.
To exercise any right, use the in-product tools where they exist, or email privacy@orderfastnow.com. We may need to verify that you are the person the data belongs to before acting; for guest orders, we verify through the order email address. We respond within the timelines the NDPA requires.
11. Deactivating or deleting your account
You have two levels of control, both available in your account settings:
Deactivation switches your account off without destroying anything: your profile is marked deactivated and any businesses you own are taken offline, in one step. You can come back.
Deletion is permanent, and works like this:
- When you request deletion, erasure is scheduled for 30 days later. This grace period exists so that a mistaken or impulsive request does not destroy your data instantly.
- During the grace period, you can cancel the deletion by signing in and confirming that you want to restore the account on the restore screen. Signing in alone does not cancel it; the confirmation does.
- Once erasure begins, completed stages cannot be reversed. If a run is interrupted, the process resumes on the next daily pass; restoration is only possible before erasure has started.
- Erasure then removes or irreversibly de-identifies your personal data across the Platform in an ordered process: your team access is deactivated, your behavioural and activity data and any launch waitlist entries are deleted, your uploaded files including dispute evidence are deleted from storage, businesses you own are reduced to empty shells with contact details removed, personal data columns are cleared or replaced with irreversible placeholders where a record must structurally survive, a permanent erasure record (the one-way email hash in Section 9) is written, and finally your sign-in account and profile themselves are deleted.
- What survives erasure, and why: transaction and financial records with your identifiers removed (legal obligation, Section 9); support ticket content with your email replaced by a placeholder; records of your acceptance of our terms, with your identifiers replaced by an irreversible one-way hash; the one-way hash of your email as proof of erasure (Section 9); and data about other people that appeared alongside yours (for example, a rider's details on an order, or our staff's audit entries), which is theirs, not yours, and is not deleted by your erasure.
We may refuse or defer a deletion request in narrow cases, for example where the account carries our own staff's audit history or another recorded legal blocker. If we refuse, we tell you the reason.
If you are a vendor, deleting your account does not extinguish obligations already in flight: outstanding orders, refunds, and settlements are completed under the Terms of Service before or alongside erasure.
12. Guests: your rights without an account
Buying as a guest does not reduce your data protection rights. Your rights over a guest order (access, correction, deletion, and the order rights themselves: cancel, dispute, review, bonus claims) are exercised through the email address you gave at checkout, which is how we verify you. To have guest order data erased, email privacy@orderfastnow.com from that address.
13. Security
We protect personal data with technical and organisational measures appropriate to the risk, including: encryption of data in transit; access controls enforced by our servers on every gated action; private, access-controlled storage for sensitive files such as dispute evidence and purchased digital products, with time-limited access; bank-verified payout destinations; audit logging of our own staff's administrative actions; continuous security monitoring; and least-privilege access to production systems.
No system is perfectly secure, and we cannot guarantee absolute security. If a breach occurs that puts your rights at risk, we will notify the Nigeria Data Protection Commission and affected users as the NDPA requires.
14. Children
The Platform is for adults. It is not directed at, and may not be used by, anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.
15. Changes to this policy
We may update this policy as the Platform evolves or the law changes. The effective date at the top tells you when it was last revised. For material changes, we will give notice through the Platform or by email before the change takes effect where reasonably practicable. Your continued use of the Platform after a change takes effect constitutes acceptance of the updated policy.
16. Contact us
Data controller: OrderFastNow Limited Privacy contact: privacy@orderfastnow.com
You can also reach us through the in-app support system.
Supervisory authority: Nigeria Data Protection Commission (NDPC). You have the right to lodge a complaint with the NDPC at any time.