Privacy Policy

Ordex360 is committed to protecting the privacy and security of all information entrusted to us by our users. This Privacy Policy explains how we collect, use, store, share, and protect personal and business data in connection with the Ordex360 Platform.

This Privacy Policy applies to all Users - Admins, Sales Agents, and Buyers - and should be read together with the Terms and Conditions in Part A of this document.

Ordex360 is designed and operated in alignment with the Nigeria Data Protection Act (NDPA) 2023, GDPR principles where applicable to users in the European Economic Area, and the Payment Card Industry Data Security Standard (PCI DSS) for payment data handling.

P2.1 Information You Provide Directly

When you register and use the Platform, we collect the following categories of data:

P2.2 Information Collected Automatically

When you access the Platform, we automatically collect technical and behavioral data including:

• IP address, browser type, operating system, and device identifiers.
• Pages viewed, features accessed, session duration, and click-stream data.
• Real-time order status updates and Platform interaction logs.
• Audit log entries recording all admin and agent actions, including timestamps and IP addresses.

Ordex360 processes personal data only for lawful, specified, and legitimate purposes. We use your data to:

1. Provide and operate the Ordex360 Platform and all its core features.
2. Authenticate users and enforce Role-Based Access Controls.
3. Process orders, payments, and issue invoices.
4. Calculate and credit agent commissions, referral rewards, and promotional earnings.
5. Deliver real-time order tracking updates and push notifications via SendGrid (email), Twilio (SMS), and Firebase (push).
6. Generate analytics reports and performance dashboards for authorized users.
7. Detect, investigate, and prevent fraudulent activity, unauthorized access, and policy violations.
8. Comply with applicable legal obligations, including tax, financial reporting, and data retention requirements.
9. Improve the Platform's features, security, and user experience.

Our processing of personal data is grounded in one or more of the following legal bases:

• Contractual Necessity: Processing required to fulfill our contractual obligations, including account creation, order processing, and payment handling.
• Legitimate Interests: Processing for fraud prevention, platform security, audit logging, and analytics, where such interests are not overridden by your fundamental rights.
• Legal Obligation: Processing necessary to comply with applicable laws, including the Nigeria Data Protection Act 2023, tax regulations, and financial reporting requirements.
• Consent: Where we rely on your consent (e.g., for marketing communications), you retain the right to withdraw consent at any time without affecting the lawfulness of prior processing.

P5.1 Third-Party Service Providers

Ordex360 shares data with trusted third-party providers strictly as necessary to operate the Platform. These providers are contractually bound to process data only on our instructions:

• Paystack - payment processing and fraud detection.
• Twilio - SMS delivery for OTPs and order notifications.
• SendGrid - transactional email delivery.
• Firebase (Google) - push notification delivery.
• Amazon Web Services (AWS S3) - secure media and file storage.
• Render / Vercel - backend and frontend hosting infrastructure.

P5.2 Administrative Disclosures

Admin users have broad data access as required to manage the system. Ordex360 maintains comprehensive audit logs of all admin actions to ensure accountability. Admin access to user data is subject to the principle of minimum necessary access.

P5.3 Legal Disclosures

We may disclose personal data to law enforcement agencies, regulatory authorities, or courts when required by applicable law, court order, or other legal process. Users will be notified of such disclosures where legally permitted.

P5.4 Business Transfers

In the event of a merger, acquisition, or sale of Ordex360's assets, user data may be transferred to the acquirer or successor entity. Users will be notified and will retain their data rights under the new entity.

P5.5 No Sale of Personal Data

Ordex360 does not sell, rent, or trade personal data to third parties for their own marketing or commercial purposes.

Ordex360 implements a multi-layered security framework:

• Encryption in Transit: All data is protected using HTTPS with TLS 1.3 encryption.
• Encryption at Rest: Database backups are encrypted using AES-256. Payment data is handled by Paystack's PCI DSS-certified infrastructure.
• Password Security: Passwords are stored using bcrypt hashing; plaintext passwords are never stored.
• Authentication: JWT-based authentication with OAuth 2.0 integration. Tokens are short-lived and subject to refresh protocols.
• Role-Based Access Control: Access to data and features is strictly limited to users with appropriate role permissions.
• Audit Logging: All admin and agent actions are logged with user ID, action type, entity affected, IP address, and timestamp.
• Rate Limiting: API endpoints are protected by rate limiting to prevent brute-force attacks.
• Input Validation: All data is validated and sanitized to prevent injection attacks.

Despite these measures, no data transmission over the internet is 100% secure. Users are responsible for maintaining the security of their own account credentials.

Ordex360 retains data for as long as necessary to fulfill the purposes described in this Policy, including compliance with legal, regulatory, accounting, and reporting obligations:

Data flagged for deletion is permanently removed or anonymized at the end of the applicable retention period. Soft-deleted records are held for a maximum of 90 days before permanent deletion, unless a legal hold is in place.

Ordex360 respects and upholds your data rights under applicable law:

To exercise any of these rights, please contact our Data Protection Officer at the email address in Section P10. We will respond to all valid requests within thirty (30) days, and in complex cases within three (3) months with notice of the extension.

The Platform uses cookies and similar tracking technologies to enhance functionality, maintain session security, and analyze usage patterns:

• Strictly Necessary Cookies: Required for authentication (JWT tokens), session management, and CSRF protection. These cannot be disabled.
• Functional Cookies: Store user preferences such as language settings and role-based UI configurations.
• Analytics Cookies: Collect anonymized data about Platform interactions to help us improve features and performance.

Users may manage non-essential cookie preferences through their browser settings. Disabling strictly necessary cookies will prevent access to secure areas of the Platform.

For all privacy-related enquiries, data subject requests, or to report a suspected data breach, please contact:

Ordex360 may update this Privacy Policy from time to time to reflect changes in legal requirements, platform features, or data practices. Material changes will be communicated through the Platform, email notifications, and/or SMS. The "Effective Date" at the top of this document will reflect the date of the most recent revision.

Continued use of the Platform after the effective date of any updated Policy constitutes acceptance of the revised terms.

Ordex360 | Bridging Manufacturers, Distributors & Wholesalers Across Africa

ordex360.com | support@ordex360.com | privacy@ordex360.com