Which Law Applies to Whom
Africlana Ltd (“we”, “our”, or “us”) operates a premier cross-border escrow marketplace connecting verified African artisans and small-to-medium enterprises (SMEs) with diaspora and international buyers. Because we sell to buyers located across the United Kingdom, the European Union, and the United States, we comply with three distinct data protection regimes simultaneously.
| Region | Governing Law | Who It Protects | Legal Trigger |
|---|---|---|---|
| European Union (EU) | EU GDPR (Regulation 2016/679) | Anyone located in the European Union | Selling goods to EU buyers, processing transactions, or tracking EU visitors. |
| United Kingdom (UK) | UK GDPR + Data Protection Act 2018 | Anyone located in the United Kingdom | Selling goods to UK buyers or offering marketplace services in the UK. |
| United States (US) | CCPA / CPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), etc. | Residents of CA, VA, CO, CT, and covered US states | Marketplace threshold exceeding 100K consumers, $25M+ gross revenue, or processing consumer data. |
| Nigeria & Africa | Nigeria Data Protection Act (NDPA 2023) / NDPR | African artisan sellers, merchant partners, and local users | Onboarding local SMEs, artisans, and processing local settlement payouts. |
Africlana's Roles & Vendor DPAs
Under European, UK, and international data protection laws, entities have distinct legal responsibilities depending on their relationship with the data subject. In our marketplace model:
Data Controller (Buyer Data)
For diaspora buyers purchasing goods: we determine the purposes and means of processing your personal data, including name, shipping address, payment tokens, fraud prevention records, and app analytics.
Data Processor (SME Merchant Data)
For African vendor and SME data passed to logistics couriers or buyers for package dispatch: the merchant is the primary Data Controller, and Africlana processes this data solely to fulfill escrow and fulfillment instructions.
Mandatory Vendor Data Processing Agreements (DPAs)
In accordance with GDPR Article 28, Africlana executes formal, binding Data Processing Agreements (DPAs) with every vendor and sub-processor in our technology chain, including Stripe, Amazon Web Services (AWS), YouVerify, SendGrid, and partner courier networks.
Information We Collect & Lawful Basis
We only collect personal information when we have a defined, statutory lawful basis under GDPR Article 6 and applicable state laws:
| Data Category | Examples Collected | Lawful Basis (GDPR / NDPA) |
|---|---|---|
| Identity Data | Full name, email address, telephone number, CAC business registration, seller store names. | Performance of Contract (Art. 6(1)(b)) + Legal Obligation (Art. 6(1)(c)) |
| Transaction & Escrow Data | Cart sub-orders, shipping physical addresses, delivery milestones, payment tokens, escrow lock references. | Performance of Contract (Art. 6(1)(b)) |
| KYC & Verification Data | Government-issued ID, proof of address, BVN, tax identifiers for artisan merchant payout clearance. | Legal Obligation (Anti-Money Laundering AML) + Fraud Prevention (Art. 6(1)(c)/(f)) |
| Technical & Telemetry Data | IP addresses, browser type, device identifiers (Expo/Firebase push tokens), cookies, traffic metrics. | Consent (Art. 6(1)(a)) + Legitimate Interests (Platform Security Art. 6(1)(f)) |
| Sensitive / Special Category Data | Health, race, ethnicity, religion, biometric identification, sexual orientation, Social Security Numbers. | EXPLICIT EXCLUSION: Africlana does NOT collect or process sensitive personal data. |
User Rights: The 8 Requests & SLA
Regardless of your country of residence, Africlana guarantees robust fulfillment of the 8 fundamental data subject requests. All requests are logged with tamper-evident audit timestamps and overseen directly by our privacy officer.
| Statutory Right | EU / UK GDPR | US CCPA/CPRA | Africlana Fulfillment Method |
|---|---|---|---|
| 1. Right of Access | Yes (30-day SLA) | Yes (45-day SLA) | Download My Data self-service tool in Privacy Center or formal email request. |
| 2. Right to Erasure / Deletion | Right to be Forgotten | Delete My Info | Delete account via mobile app or web portal (/delete-account). Anonymizes non-tax records. |
| 3. Right to Rectification / Correction | Yes | Yes | Edit profile in app settings or submit a correction request to DPO. |
| 4. Right to Data Portability | Yes (Machine-readable JSON/CSV) | Yes | Instant data export button in the Africlana Privacy Center. |
| 5. Right to Object / Opt-Out | Marketing + Profiling | Do Not Sell or Share | Interactive toggle in Privacy Center and footer Do Not Sell modal. |
| 6. Right to Restriction of Processing | Yes | Limited statutory equivalent | Temporary freeze on data processing upon verified request to privacy@africlana.com. |
| 7. Right to Withdraw Consent | Yes anytime | Yes | 1-click unsubscribe on all emails + interactive Cookie Consent Banner settings. |
| 8. Right to Appeal | Lodge with UK ICO or EU Lead DPA | Yes (CA, VA, CO, CT) | Direct appeal to privacy@africlana.com; response issued within 45 days. |
US State Privacy Extras (CCPA/CPRA)
For residents of California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other states with enacted privacy legislation, the following additional disclosures apply:
1. “Do Not Sell or Share My Personal Information”
Africlana does not sell personal information for monetary payment. However, California law broadly defines “sharing” to include cross-context behavioral advertising. You can exercise your statutory opt-out at any time via our modal in our site footer.
2. Disclosures for the Preceding 12 Months
In the preceding 12 months, we collected identifiers (names, emails, IP addresses), commercial transaction records (escrow order milestones), and internet activity telemetry solely for transaction fulfillment, payment clearing, and anti-fraud verification.
3. Non-Discrimination Guarantee
We will never deny goods, charge different prices, or provide a different level of quality if you exercise any of your CCPA/CPRA rights.
4. Right of Consumer Appeal
If we decline to act regarding your privacy request, California and Virginia consumers may appeal our determination within 45 days by writing to privacy@africlana.comwith the subject line “Privacy Appeal”.
International Data Transfers (SCCs)
Africlana facilitates global trade between the African diaspora (located in the UK, EU, and North America) and artisan producers located across Africa (primarily Nigeria, Ghana, Kenya, and Rwanda). Cloud servers (AWS) and payment infrastructure (Stripe) are located in the United States and European economic areas.
- Standard Contractual Clauses (SCCs): We integrate European Commission-approved SCCs into all vendor and seller agreements for transfers from the EU to third countries.
- UK International Data Transfer Addendum:For UK buyers, transfers outside the UK are protected by the UK Information Commissioner's Office (ICO) approved International Data Transfer Addendum (B.10.0) combined with the EU SCCs.
- Data Minimization: Artisan sellers and courier dispatchers only receive physical shipping coordinates necessary to complete package delivery.
Escrow Operations & Sub-Processors
Our multi-vendor escrow marketplace model guarantees that buyers and sellers are protected throughout the entire fulfillment lifecycle:
Escrow Deposit Lock
When a diaspora buyer checks out, funds are held securely in Africlana's centralized escrow accounts. Money is never disbursed directly to sellers prior to verified delivery.
48-Hour Inspection Window
Once logistics couriers mark an order as delivered, the buyer has a statutory 48-hour inspection period to review items for authenticity, defect, or damage.
Programmatic Payout or Dispute
If confirmed, or upon 48 hours without dispute, APIs automatically disburse payout to the African artisan minus marketplace commission. In disputes, funds remain locked until resolution.
Vetted Third-Party Sub-Processors
| Partner | Purpose | DPA & SCC Status |
|---|---|---|
| Stripe & Paystack | Payment Processing & Escrow Gateways (Sub-processor (PCI-DSS Level 1)) | DPA Executed with SCCs |
| Amazon Web Services (AWS) | Cloud Hosting & Encrypted Database (Sub-processor (US / EU Data Centers)) | AWS GDPR Data Processing Addendum Executed |
| YouVerify | Artisan KYC & Identity Verification (Sub-processor (BVN & ID Validation)) | DPA Executed with NDPR & GDPR terms |
| SendGrid / Twilio | Transactional Order & Security Emails (Sub-processor) | DPA Executed with SCCs |
| Africlana Logistics & Couriers | Cross-Border Dispatch & Tracking (Sub-processor (Delivery Addresses)) | Logistics Partner Data Agreement |
Data Retention & Erasure Schedule
In accordance with the GDPR “storage limitation” principle (Art. 5(1)(e)), personal data is retained strictly as long as legally justified:
Tax & Escrow Financial Ledgers
Transaction invoices, VAT records, payout receipts, and dispute audit trails kept 6 years for legal and HMRC/IRS compliance.
Inactive Accounts
User accounts that have had zero login activity or orders for 24 continuous months are queued for automated pruning.
Non-Statutory Profile Data
Upon verified request at /delete-account, passwords, carts, avatars, and push tokens are erased within 48h.
Security, DPIA & 72-Hour Breach Response
We protect our ecosystem using enterprise-grade safeguards and strict internal governance:
Data Protection Impact Assessment (DPIA)
Because our marketplace processes cross-border escrow payments, seller KYC identity credentials, and multi-party shipping records, Africlana maintains an active DPIA pursuant to GDPR Article 35.
Mandatory 72-Hour Breach Notification Protocol
In the unlikely event of a security breach involving personal data:
1. Regulator Notification: We notify the UK Information Commissioner's Office (ICO) and relevant EU Supervisory Authorities within 72 hours of awareness (GDPR Art. 33).
2. User Notification: If a breach is assessed to pose a high risk to the rights and freedoms of individuals, affected users will be notified without undue delay with mitigation steps (GDPR Art. 34).
Continuous Staff Training
All Africlana engineering, support, and escrow dispute personnel undergo mandatory privacy, data handling, and anti-phishing training.
Contact, DPO & Official Privacy Notice
For questions, supervisory inquiries, or to exercise any data subject rights under UK GDPR, EU GDPR, or US State Privacy Laws, contact our Data Protection Officer:
- Designated DPO Email
- privacy@africlana.com
- Response SLA Commitment
- 30 Days (UK/EU) • 45 Days (US)
- Self-Service Portal
- africlana.com/privacy-center
- Account Erasure Portal
- africlana.com/delete-account
AFRICLANA PRIVACY POLICY
We are AFRICLANA Ltd. We connect African SMEs with global buyers.
EU/UK Users: You have rights to access, delete, port your data. Contact privacy@africlana.com. Legal bases: Contract, Consent, Legal Obligation.
US Users: CA residents have right to know, delete, and opt-out of sale/sharing of personal info. See “Do Not Sell or Share” link.
Data Transfers: Data may be transferred outside your country using Standard Contractual Clauses.
Retention: We keep data for 6 years for legal reasons.
Last Updated: September 2026