Version 1.0 · Effective 31 August 2026 · Operated by P-Eviron Prospects Limited
Read together with the Terms of Use and, for Vendors, the Vendor Terms of Agreement.
This Privacy Notice explains how P-Eviron Prospects Limited (“PEPWOO,” “we,” “us”), operating the PEPWOO marketplace at www.pepwoo.com (the “Platform”), collects, uses, shares, retains, and protects personal data belonging to Customers, Vendors, Logistics Partners, Staff, and other users. PEPWOO is the data controller for the personal data described in this Notice.
We do not intentionally collect special-category personal data except where necessarily contained in identity documents uploaded for verification.
Under the Nigeria Data Protection Act 2023 (NDPA):
We do not sell personal data to unrelated third parties.
Cross-border transfers. Some providers may process or store data outside Nigeria. Where transfers occur, PEPWOO takes steps intended to ensure an appropriate level of protection consistent with NDPA requirements (contractual safeguards, recognised transfer mechanisms where available, encryption in transit, and access controls). Further detail is available on request.
Deactivation. Eligible users may deactivate through Privacy & Account controls. Deactivation stops normal access but does not erase records needed for operational integrity, accountability, or legitimate retention.
Deletion requests. Eligible account holders may request deletion. The account is deactivated and enters a 30-day cooling-off period before eligible profile data is processed for deletion or anonymisation. A request may be held where an active transaction, payout, delivery, dispute, security investigation, financial reconciliation, or legal obligation remains.
Retention defaults (governance settings, not immutable legal periods):
Retention may be extended where law, investigation, dispute, reconciliation, or security requires it. Where a record must remain but identification is no longer necessary, PEPWOO minimises or anonymises identifying information rather than destroying transaction history. Full detail is in the Privacy & Data Retention Policy.
We apply reasonable technical and organisational measures, including encryption in transit, access controls on sensitive data (verification documents, bank details), role-based restrictions, and audit logging of material lifecycle actions. No system is completely secure. You are responsible for keeping credentials confidential.
Personal data breaches. Where PEPWOO becomes aware of a breach posing risk to individuals, it will investigate, contain, and manage the incident and, where required by the NDPA, notify affected individuals and the relevant authority within required timeframes.
We use strictly necessary cookies and similar technologies to keep you signed in and support essential Platform functions. Optional preference, analytics and marketing technologies are controlled through the PEPWOO cookie preference centre where applicable. You can change those choices from Cookie settings in the footer. See the Cookie Policy for further information.
Where you have consented to marketing, you may opt out at any time via the unsubscribe link or by contacting us. Essential account and transaction communications continue regardless of marketing preference.
PEPWOO is not directed at, and does not knowingly collect personal data from, individuals under 18. If we become aware of inadvertent collection, we will take steps to delete it. Eligibility is governed by the Terms of Use.
Under the NDPA 2023 you have the right to:
Exercise rights via Privacy & Account controls or the contact details below. We may need to verify identity. Some information cannot be erased immediately where retention is required for transactions, disputes, security, accounting, investigations, or legal compliance.
We may update this Notice from time to time. Material changes will be notified through the Platform, by email, or by other reasonable means. Continued use after an update takes effect constitutes acknowledgement of the revised Notice.
PEPWOO has designated organisational responsibility for data-protection compliance. Privacy and data-lifecycle matters are overseen by the designated administrator or privacy-responsible function. Whether a formal Data Protection Officer must be appointed and whether NDPC registration is required depends on scale, volume, and sensitivity of processing under the NDPA. PEPWOO will maintain the designation and registration status required by law. Where a named DPO is appointed, that contact will be published here or in Platform privacy controls.
Privacy questions or rights requests: support@mail.pepwoo.com. Complaints: complaints@mail.pepwoo.com. You may also lodge a complaint with the NDPC where permitted by law.