Ordelo Shopping — Privacy Policy

Effective date: 01 July 2026 Last updated: 01 July 2026

Ordelo Shopping ("Ordelo", "the app", "we", "us", "our") is operated by Noddit Technology Limited (RC 7761794), a company registered in Nigeria with its office at De Law House, Airport Road, Warri, Delta State, Nigeria. This Privacy Policy explains how we collect, use, share, store and protect your personal data when you use the Ordelo Shopping app to browse stores, place orders, pay and receive deliveries.

We are committed to processing personal data in line with the Nigeria Data Protection Act, 2023 (NDPA), the Nigeria Data Protection Regulation, 2019 (NDPR) and any guidance or framework issued by the Nigeria Data Protection Commission (NDPC).

1. Who this policy applies to

This policy applies to you if you are a customer who uses the Ordelo app to find stores, place orders, make payments and arrange delivery or pickup.

For the personal data you give us and that we collect when you use the app, Noddit Technology Limited is the data controller — we decide why and how it is processed.

When you place an order, we share the details needed to fulfil it with the merchant you order from, and where relevant with the delivery partner or rider who brings it to you. The merchant becomes an independent controller of the order information they receive, for their own records and obligations.

2. Our role

• Controller: for your account, profile, orders, payments, location and app-usage data, Noddit Technology Limited decides why and how the data is processed.
• The merchants you order from, and delivery partners, are separate controllers for the order data they need to prepare and deliver your order.

3. Data Protection Officer / contact

Questions, requests or complaints about this policy or your data:

• Email: privacy@getnoddit.com
• Data Protection Officer: Oghenejakpor Odafe James
• Address: De Law House, Airport Road, Warri, Delta State, Nigeria

4. Personal data we collect

a. Account and identity data

• First name, surname, email address, phone number.
• Password credentials (handled by our identity provider; we do not store your password in plain text).
• Profile photo and preferences, where you add them.

b. Order and delivery data

• Items you browse, add to cart and order, and your order history.
• Delivery addresses, contact phone number and any delivery notes or instructions.
• Pickup or dine-in selections, where offered.

c. Payment data

• Payment method details and transaction references. Card and bank details are handled by our payment providers; we do not store full card numbers.
• Billing status, refunds and payment history.

d. Location data

• Delivery addresses and coordinates resolved through mapping services when you search for or pick an address.
• Device location, only where you enable "use my location" and grant permission, to find nearby stores and set your delivery point.
• Live or approximate location during an active delivery, where offered, so you and the rider can find each other.

e. Communications and support

• Messages you send us or a merchant through the app, ratings, reviews and support requests.

f. Device and technical data

• Device model, operating system, app version and language.
• Push notification tokens, so we can send order and account alerts.
• IP address, log data and general usage of features.

g. Diagnostics

• Crash reports and error diagnostics to keep the app stable.

We do not intentionally collect special-category or sensitive personal data through the app. Please do not enter such data into free-text fields (for example delivery notes).

5. How we collect data

• Directly from you when you sign up, set up your profile, place an order, pay, chat with a merchant, leave a review or contact support.
• Automatically as you use the app (device, usage, diagnostics, push tokens, and location where you enable it).
• From service providers acting for us, such as our identity, payment, mapping, messaging and analytics partners.

6. Why we process data and our lawful basis

Under the NDPA and NDPR we rely on one or more of the following lawful bases:

Where we rely on consent, you may withdraw it at any time (see section 12). This does not affect processing carried out before you withdrew.

7. How we use data

• Show you nearby stores, menus and items, and let you place and track orders.
• Send your order to the merchant and, where relevant, a delivery partner.
• Take payment, issue receipts and process refunds.
• Send you real-time order updates, delivery tracking and account messages.
• Provide support and handle disputes, ratings and reviews.
• Recommend stores and items that may interest you and improve the app.
• Prevent fraud and abuse and keep the service secure.
• Meet our legal, tax and regulatory obligations.
• Send you promotions and offers where you have agreed to receive them.

8. Sharing your data

We share personal data only as needed to run the service, and with parties bound by confidentiality and data protection obligations:

• Merchants you order from, to prepare and fulfil your order (your name, order details, delivery address and contact where needed).
• Delivery partners and riders, to deliver your order and, where offered, enable live tracking and contact.
• Payment providers, to process payments and refunds.
• Cloud hosting and infrastructure providers that store and run the service.
• Identity and authentication provider for sign-in and account security.
• Mapping and geocoding provider to resolve addresses and locations.
• Messaging providers for push notifications, SMS or WhatsApp updates.
• Analytics and crash-reporting providers to keep the app reliable.
• Professional advisers, auditors and regulators where required.
• Authorities, where disclosure is required by law or to protect rights, safety or property.

We do not sell your personal data.

A list of our current processors is available on request from the contact in section 3.

9. International transfers

Some of our service providers store or process data outside Nigeria. Where we transfer personal data abroad, we do so in line with the NDPA cross-border transfer rules, and we rely on one or more of: an adequacy decision or instrument recognised by the NDPC, appropriate contractual safeguards, or your consent. You may request information about the safeguards we use.

10. Data retention

We keep personal data only for as long as necessary for the purposes above, then delete or anonymise it. Typical periods:

• Account and profile data: for the life of your account and for a reasonable period after closure to meet legal and audit duties.
• Order and payment records: as required by tax and accounting law (commonly at least six years).
• Location data used for a delivery: kept only as long as needed for that order and related support or disputes, then deleted or aggregated.
• Diagnostics and logs: short retention, then deleted or aggregated.

11. Your rights

Subject to the NDPA and NDPR, you have the right to:

• Be informed about how your data is processed.
• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data where the law allows.
• Restrict or object to certain processing.
• Request portability of data you provided, in a usable format.
• Withdraw consent at any time, where processing is based on consent.
• Not be subject to a decision based solely on automated processing that has a legal or similarly significant effect, without safeguards.

To exercise a right, contact us using section 3. We will respond within the time the law allows. We may need to verify your identity first. These rights are free in most cases. Where a request concerns data held by a merchant you ordered from as their own controller, we may refer you to that merchant.

12. Managing your choices

• Location: turn device location on or off in your device settings. Some features, such as finding nearby stores or live delivery tracking, may not work without it.
• Notifications: control push notifications in your device settings; you can still receive essential order and security messages.
• Marketing: opt out of promotions at any time using the unsubscribe option in the message or your in-app settings.

13. Security

We use technical and organisational measures to protect personal data, including encryption in transit, access controls, authentication, and monitoring. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your data and to notify you and the NDPC of a breach where the law requires.

14. Children

Ordelo is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has provided us data, contact us and we will delete it.

15. Cookies and similar technologies

Our web app and website may use cookies and similar technologies for sign-in, security, preferences and basic analytics. You can control cookies through your browser settings. Disabling some cookies may affect how the app works.

16. Changes to this policy

We may update this policy from time to time. We will post the new version with an updated date, and where changes are significant we will notify you in the app or by email. Continued use of the app after an update means you accept the revised policy.

17. Complaints

If you have a concern, please contact us first using section 3 so we can try to resolve it. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

*Ordelo Shopping is a Noddit product. getnoddit.com*