Privacy Policy

BNP Fulfillment is operated by BoxNPick Global, based in Abuja, Nigeria. We are responsible for the personal information described in this policy and handle it in line with the Nigeria Data Protection Act 2023. Questions about your information can be sent to bnpfulfillment@gmail.com.

Merchants and fulfillment centers. Business name, contact person, email, phone number and product category when you sign up; your logo and any public storefront details you add (description, WhatsApp number, Instagram); your products, stock and orders; wallet transactions; and, if you withdraw funds, your bank name, account number and account name.

Customers. When you order from a storefront: your name, phone number, delivery address, email address if you give one, and what you ordered. If you respond to a delivery message, we also keep your rating, review or problem report and any WhatsApp replies you send us.

Automatically. Sign-in cookies that keep you logged in, the contents of your storefront cart and the order number and phone you last tracked (both stored only in your own browser), and standard server logs such as IP address and browser type, which we use to keep the platform secure and working. To stop spam and password guessing, our forms also keep a scrambled code made from your connection for up to an hour; it can't be turned back into your IP address.

• to create and run your account, and to review new applications;
• to store, pick, pack and deliver orders, and to let customers track them;
• to take payments, charge fees and process wallet top-ups and withdrawals;
• to send service messages, such as order and restock alerts, order confirmations, password resets, and a WhatsApp message asking customers to confirm delivery;
• to handle returns, claims and problems reported after delivery;
• to prevent fraud, keep the platform secure and meet our legal obligations.

We use your information because we need it to provide the service you signed up for or the order you placed (performance of a contract); because we have a legitimate interest in running a secure, reliable platform; because the law requires it, for example tax and accounting records; or, where we ask for it, with your consent, which you can withdraw at any time.

We don't sell personal information. We share it only where needed:

• The merchant you bought from sees your name, phone number, address and order, so they can fulfil it and contact you about it.
• Fulfillment centers and riders on our network see the order details needed to pack and deliver it.
• Service providers that run parts of the platform for us: Supabase (database and accounts), Vercel (website hosting), Paystack (payments and bank transfers), Resend (email), Twilio (WhatsApp messages) and Sentry (error reports, which record what went wrong and on which page, without your personal details).
• Authorities, when the law requires it or to protect people from harm or fraud.

Some of these providers store data outside Nigeria. When that happens we rely on their contractual commitments to protect it to the standard required by Nigerian law.

Card and bank payments are processed by Paystack. Your card details go directly to Paystack and are never seen or stored by BNP. For withdrawals, we pass your bank account details to Paystack to verify the account and send the transfer.

We only use what the platform needs to work: cookies that keep you signed in, and your browser's local storage to remember your storefront cart and the order you last tracked, which you can clear from the tracking page. We don't use advertising or tracking cookies, and we don't run third-party analytics.

We keep account information while your account is open. Order, payment and wallet records are kept for as long as Nigerian tax and accounting law requires, even after an account is closed. Other information is deleted or anonymised when we no longer need it for the purposes above.

Information is encrypted in transit, and access is restricted so that each merchant and fulfillment center can only see the data they need. Passwords are stored securely by our account provider and are never visible to BNP staff. No system is perfectly secure, but if a breach affects your information we will tell you and the regulator as the law requires.

Under the Nigeria Data Protection Act 2023 you can ask us to:

• give you a copy of the personal information we hold about you;
• correct information that is wrong or incomplete;
• delete your information, where we don't need to keep it by law;
• stop or limit how we use it, or object to a particular use;
• send your information to you or another provider in a usable format.

Email bnpfulfillment@gmail.com to make a request. We'll respond within 30 days. You can also complain to the Nigeria Data Protection Commission.

BNP isn't intended for children. Business accounts must be opened by adults, and we don't knowingly collect information from anyone under 18.

We'll update the date at the top of this page when this policy changes, and email account holders about significant changes.