How we collect, use, and protect your personal data
Your privacy matters to us. This Privacy Policy explains what personal data PriceTracker collects, why we collect it, how we use it, and what rights you have under the Nigeria Data Protection Act (NDPA) 2023 and the General Application and Implementation Directive (GAID) 2025 — the current, operative legal framework in Nigeria since 19 September 2025.
Last updated: 1 March 2026 · Effective date: 1 March 2026
PriceTracker is a community-driven, non-commercial price tracking Progressive Web Application (PWA) serving Nigerian consumers. As the operator of this platform, we act as the Data Controller as defined under Section 65 of the NDPA 2023.
| Field | Details |
|---|---|
| Service Name | PriceTracker |
| Operator | Mark Peschke (private individual, non-commercial) |
| Contact Email | info@pricetracker.ng |
| Privacy Enquiries | privacy@pricetracker.ng |
| Legal Framework | NDPA 2023 + GAID 2025 |
| DCPMI Status | We are not currently classified as a Data Controller of Major Importance under the NDPA 2023. Should our processing activities reach the applicable regulatory thresholds, we will comply with all resulting registration obligations with the NDPC. |
| Data | Purpose | Retention |
|---|---|---|
| Security audit logs (login events, IP address, timestamp) | Fraud prevention, anomaly detection, NDPA breach notification obligations | 90 days |
| IP address (contained in audit logs above) | Security incident investigation and abuse prevention | 90 days — legal basis: Legitimate Interest (NDPA s.25(e)) |
| Password reset token | Verifying identity during password reset — single use, invalidated immediately after use | Maximum 1 hour or until used |
| Session token | Keeping you logged in | Until logout or expiry |
| Essential cookies only | Session management | Session / persistent as required |
We do not intentionally collect sensitive personal data as defined in Section 30 of the NDPA 2023 (including health data, biometrics, political opinions, religious beliefs, or financial account data). If you inadvertently include such data in a price report or comment, please contact us for immediate deletion.
PriceTracker is not directed at persons under 18 years of age. In compliance with the Child Rights Act 2003 and NDPA Section 31, we do not knowingly collect data from minors. Registration requires confirmation of being 18 or above. If we discover a minor has registered, the account and all associated data will be deleted immediately.
All processing is carried out on one of the following lawful bases under NDPA 2023, Section 25:
Pursuant to GAID 2025 Article 19, we use only essential cookies — specifically session management cookies required to keep you logged in. No analytics, advertising, or tracking cookies are deployed. Essential cookies do not require prior consent under GAID 2025, but we disclose them here in full transparency.
In line with the storage limitation principle (NDPA Section 24(e)), we retain data only as long as necessary:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account data (email, username, password) | Duration of account + 30 days after deletion request | Service provision; grace period for accidental deletion |
| Price reports (public) | Indefinitely while account is active; anonymised or deleted on account closure | Community database integrity |
| Shopping lists | Until manually deleted or account closure | User preference |
| Watchlist entries | Until manually deleted or account closure | User preference |
| Security audit logs | 90 days | Fraud detection; breach notification obligations |
| Session tokens | Until logout or automatic expiry | Authentication |
| Backup copies | Maximum 30 days after deletion from production | Disaster recovery |
Price reports you submit are publicly visible (product name, price, market, date, and your username) — this is the core function of the service. All other personal data is not shared.
We engage the following limited service providers to process data on our behalf:
| Provider | Purpose | Data Transferred |
|---|---|---|
| Mailgun | Transactional email delivery (account verification, password reset) | Email address only — subject to Mailgun's standard Data Processing Agreement under GDPR |
| Smartweb Nigeria Limited | Web hosting and server infrastructure | All data stored on the platform, with the exception of email addresses processed separately by Mailgun — servers located in Nigeria. As a Nigerian company, Smartweb is subject to the NDPA 2023 and applicable Nigerian data protection law. |
We use Mailgun as a transactional email service provider to ensure reliable delivery of account verification and password reset emails. This is necessary because emails sent directly from Nigerian .ng domains are frequently rejected or filtered as spam by major email providers such as Gmail, resulting in users not receiving critical account emails. Mailgun's infrastructure is located on EU-based servers, which ensures these emails reach you reliably.
This transfer is permitted under NDPA Section 43 on the basis of necessity to perform the service you requested (account registration and authentication). Only your email address is transferred to Mailgun for this sole purpose. As Mailgun operates under the EU General Data Protection Regulation (GDPR), which imposes data protection standards comparable to or exceeding those of the NDPA 2023, the NDPC would consider this an adequate level of protection for the purposes of cross-border transfer assessment. Your data is not used by Mailgun for any other purpose.
We may disclose data to Nigerian authorities, law enforcement, or courts where required by law, lawful court order, or to protect the safety of our users — strictly within the limits of applicable Nigerian law.
We implement appropriate technical and organisational measures as required by NDPA Section 38 and GAID 2025 Article 7:
In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the NDPC within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to you personally, we will also notify you directly without undue delay.
Under NDPA 2023, Part VI, you have the following rights. These rights are free of charge and we will respond within 30 days:
Request a copy of your personal data and information on how we process it
Correct inaccurate or incomplete data — most can be updated in your account settings
Delete your account and associated personal data ("right to be forgotten")
Receive your data in a structured, machine-readable format
Object to processing based on legitimate interest at any time
Request that we restrict processing while a dispute is resolved
Withdraw consent for optional processing (e.g. location) at any time without penalty
We make no solely automated decisions with legal or significant effect on you
Where we rely on consent as the lawful basis for processing (e.g. location-based filtering), you may withdraw this consent at any time through your account settings or by contacting us. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
By registering for an account, you acknowledge that you have read and understood this Privacy Policy. Consent to processing is obtained at registration via an explicit, unchecked opt-in checkbox — no pre-ticked boxes, no implied consent (GAID 2025, Article 19 principles applied broadly).
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (to your registered address) and/or by displaying a prominent notice on the app at least 14 days before the changes take effect. The "Last Updated" date at the top of this page will always reflect the most recent revision.
Continued use of PriceTracker after the effective date of any update constitutes acceptance of the revised policy. If you do not agree, you may delete your account before the effective date.
This policy is designed to comply with the following legal instruments:
For any questions about this policy or to exercise your rights, please contact us: