At Kormart, safety and trust are central to how we operate our marketplace.
Kormart uses identity verification, transaction monitoring, security controls and Kormart Shield to help reduce fraud, protect users and support safer transactions between buyers and sellers.
Because Kormart facilitates marketplace transactions and provides access to wallet, payment and transaction-related services through integrated financial infrastructure, certain personal information may be required to verify users, process transactions, prevent fraud, resolve disputes, provide delivery services and comply with applicable legal and regulatory requirements.
For the personal data processing activities described in this Privacy Policy, Kormart generally determines why and how personal data is processed for the operation of its Platform and therefore acts as a Data Controller in respect of those activities. Certain third-party service providers may process personal data on Kormart's behalf or may process information under their own legal and regulatory responsibilities, depending on the nature of the service and applicable arrangements.
Kormart ("we", "our", or "us") processes personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA) and other applicable laws and regulatory requirements.
Depending on the circumstances, we may process your personal data on one or more of the following legal bases:
Where consent is relied upon, you may withdraw that consent in accordance with applicable law and the available consent or preference-management mechanisms.
Depending on our verification requirements, we may collect or process:
Identity-verification information is used to verify users and help maintain a trusted marketplace.
Kormart uses these verification processes to help confirm that the person completing verification corresponds with the identity information submitted, including, where applicable, validating that the person completing the live facial check is the owner of the BVN or identity information being verified.
Kormart does not use your BVN to access your bank account balance or independently access funds in your bank account.
Wallet and transaction services may be provided through Kormart's integrated financial infrastructure, including the applicable Rubies Microfinance Bank infrastructure or other provider used for the relevant service.
Where delivery is requested, we may collect:
We may process relevant information from communications conducted through Kormart, including in-app messages.
Where reasonably necessary, relevant communications may be reviewed to investigate disputes, fraud, abuse, security incidents, or violations of Kormart's Terms.
The particular technical information processed may depend on whether you use Kormart through the mobile application or the web platform and on the third-party technologies enabled for the relevant Platform.
Kormart processes personal data for purposes including:
Kormart does not sell, rent, or trade your personal data as a product. We may share personal data with third-party service providers, financial infrastructure providers, identity-verification providers, logistics providers and other recipients where reasonably necessary to provide Kormart's services, process transactions, provide delivery, maintain Platform security, measure or improve services where applicable, or comply with applicable law.
Kormart uses identity-verification infrastructure to verify users during onboarding or before providing certain Platform features. Verification information is processed for the purpose of confirming your identity and maintaining a trusted marketplace.
Kormart does not share your identity-verification information with unrelated third parties for their own purposes.
Verification information, including BVN-related information and information generated through an applicable live facial or liveness verification process, may be processed for the purpose of confirming identity and maintaining a trusted marketplace.
Where required to create or provision your wallet, virtual account or related financial service, Kormart may provide relevant information, including your BVN where applicable, to the financial or banking infrastructure provider responsible for the relevant service.
Kormart currently uses Rubies Microfinance Bank or the applicable Rubies financial infrastructure for relevant wallet services. Your BVN may be processed for purposes such as identity verification, wallet or financial-service provisioning and applicable regulatory requirements.
Kormart does not intentionally provide your BVN to advertising or unrelated third parties for marketing purposes.
When you purchase an item that requires delivery, Kormart may provide the information necessary for the relevant logistics or delivery provider to fulfil the order. This may include:
The information shared with a delivery provider is limited to what is reasonably necessary to fulfil the delivery.
Kormart may share information necessary to process deposits, wallet transactions, Kormart Shield transactions, payouts, refunds, and other financial services with the relevant authorized financial, payment, or banking infrastructure providers.
Such providers may include Rubies Microfinance Bank or the relevant financial infrastructure used by Kormart for the applicable service.
Kormart may use third-party technology providers for services such as hosting and cloud infrastructure, analytics, error and crash monitoring, push notifications, security monitoring, fraud prevention, and other technical infrastructure.
These providers may include, depending on the relevant Platform and technical configuration, Firebase, Google services, Sentry, AppsFlyer and other technology providers used by Kormart. The information processed by these providers depends on the specific service they provide and Kormart's technical configuration.
Kormart uses or may use different analytics, advertising and technical monitoring technologies depending on whether you access the Platform through the web platform or mobile application.
Kormart may also use Firebase Cloud Messaging for push notifications and may use other technical monitoring or security services where applicable.
Kormart does not intentionally provide users' BVN or identity-verification information to advertising or analytics providers for marketing purposes.
Kormart uses cookies and other technologies such as browser local storage, mobile-device storage, software development kits (SDKs), advertising pixels, analytics tools and security-monitoring technologies.
Not all of these technologies are technically "cookies." This section therefore describes the broader category of tracking and similar technologies used across Kormart's web platform and mobile application.
Kormart may use essential cookies, local storage, mobile-device storage and similar technologies to:
Certain essential technologies may be necessary for important parts of Kormart's services to function.
Depending on the Platform you use, Kormart may use:
These technologies may collect technical, device, usage, advertising, attribution and event information depending on the provider and Kormart's configuration.
Where consent or another applicable user-choice mechanism is required before a non-essential technology is activated, Kormart will seek to provide the relevant mechanism before activating that technology.
Kormart may use:
Essential authentication, security and functionality technologies may be necessary for Kormart to operate properly and may not be removable without affecting core functionality.
Where applicable, Kormart will provide users with an appropriate mechanism to make choices concerning non-essential analytics or advertising technologies.
On the web platform, such choices may be made through a cookie or tracking preference mechanism where implemented. On the mobile application, relevant choices may be presented through an in-app privacy or tracking preference mechanism where applicable.
You may also be able to manage certain cookies through your browser settings and control certain advertising, tracking or application permissions through your device or operating-system settings.
Disabling certain technologies may affect some functionality, analytics or personalization features.
Kormart retains personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law.
Certain transaction, financial, KYC, AML, fraud-prevention, dispute, accounting, and regulatory records may need to be retained after an account is closed. The applicable retention period depends on the type of information, the nature of the transaction, applicable regulatory requirements, legal obligations, dispute requirements, and other legitimate purposes.
Where data is no longer required, Kormart will take appropriate steps to delete, anonymize, or otherwise securely dispose of it, subject to applicable retention obligations.
You may request deletion of your Kormart account through the available account-deletion functionality or by contacting Kormart. Deletion may not result in the immediate deletion of all information where Kormart is legally required or otherwise permitted to retain certain records.
If you have an active Kormart Shield transaction, unresolved dispute, pending payout, refund, chargeback, investigation, or other matter requiring preservation of information, Kormart may delay or restrict deletion of relevant information until the matter has been resolved or the applicable retention obligation has expired.
Kormart uses appropriate technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss, destruction, or unlawful processing. Depending on the system and data involved, these measures may include:
No internet-based service can guarantee absolute security.
Users are responsible for protecting their passwords, authentication credentials, transaction PINs, and devices and should promptly notify Kormart of suspected unauthorized access.
Subject to applicable legal conditions and limitations, you may have rights relating to your personal data, including the right to:
Some rights are subject to legal conditions and exceptions. For example, Kormart may need to retain certain information to comply with legal obligations, protect legal claims, prevent fraud, or complete an existing transaction.
You may also have the right to lodge a complaint with the Nigeria Data Protection Commission where you believe your data-protection rights have been violated.
Kormart does not currently operate an automated system that, without human review, makes decisions to automatically reject, suspend, restrict or freeze an account, wallet or transaction in the manner described in Kormart's current Platform operations.
Kormart may permit persons under the age of 18 to use certain features of the Platform, subject to applicable law and Kormart's applicable account, identity-verification and safety requirements.
Where Kormart becomes aware that additional authorization, consent or protective measures are required in relation to the processing of a child's personal data, Kormart may request appropriate information or authorization from a parent or legal guardian or take other steps reasonably necessary to comply with applicable requirements.
Certain features involving identity verification, wallets, financial services, withdrawals or other regulated or higher-risk activities may be restricted based on age, applicable law, the requirements of Kormart's financial infrastructure providers or Kormart's operational policies.
Kormart may send service-related communications that are necessary for the operation, security or administration of your account, including account, transaction, delivery, security and other important service notifications.
Where Kormart seeks to send direct marketing communications based on your consent, Kormart will provide an appropriate opt-in mechanism and information about how you may withdraw or manage that consent.
You may withdraw consent to marketing communications through the applicable preference, unsubscribe or account settings mechanism, where available.
Withdrawing consent to marketing communications will not prevent Kormart from sending communications that are necessary to provide the Platform, complete a transaction, protect your account, comply with legal obligations or communicate important service or security information.
Some Kormart service providers may process information using infrastructure located outside Nigeria. Where personal data is transferred or processed outside Nigeria, Kormart will take steps required by applicable data-protection law to ensure that appropriate safeguards are in place.
Kormart may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, or data-processing practices.
When we make material changes, we may provide an appropriate notice through the Kormart platform or other reasonable means.
The "Last Updated" date at the beginning of this policy indicates when the policy was most recently revised.
For questions regarding this Privacy Policy, your personal data, data-subject rights or Kormart's privacy practices, please contact:
Data Protection Contact / Data Protection Officer: DPO@kormart.ng
If you wish to exercise a data-subject right, please provide sufficient information for Kormart to identify you and process your request securely. Kormart will handle requests in accordance with applicable data-protection requirements and applicable verification procedures.
Where you are unable to resolve a data-protection concern directly with Kormart, you may have the right to submit a complaint to the relevant data-protection authority in accordance with applicable law.
© 2026 Kormart. All rights reserved.
