Privacy Policy

Maldra Limited is a company registered in Nigeria.

Maldra provides software tools that businesses can use to manage business operations.

Depending on how you use Maldra, we may process information:

• directly provided by you;
• generated through your use of the Maldra platform;
• provided by your organisation or business administrator;
• entered into Maldra by other authorised users of your business;
• received from service providers that support our services; and
• generated as part of transactions, subscriptions, support requests and other interactions with Maldra.

We collect information that is reasonably necessary to provide, maintain, secure and improve our services.

The information we collect depends on how you interact with Maldra.

2.1 Account Information

When you create or use a Maldra account, we may collect information such as:

• name;
• email address;
• telephone number;
• business name;
• business address;
• account credentials and authentication information;
• account type or subscription plan;
• business configuration and preferences; and
• other information you voluntarily provide during account registration or setup.

Where you choose to authenticate using Google, certain account information may be received from Google as necessary to create and authenticate your Maldra account.

We do not receive your Google password.

Maldra is a business management platform, which means customers may enter substantial information relating to their businesses.

Depending on the features used, this may include:

• products;
• product descriptions;
• SKUs;
• barcodes;
• inventory information;
• stock quantities;
• warehouse information;
• customer records;
• supplier records;
• employee or staff information;
• sales records;
• invoices;
• quotations;
• receipts;
• payment records;
• expenses;
• business addresses;
• tax-related information;
• transaction information;
• notes and other business records.

The specific information stored depends on the features and modules used by the customer.

A business using Maldra may enter information relating to people connected with that business.

For example, a Maldra customer may enter information concerning:

• customers;
• employees;
• suppliers;
• contractors;
• business contacts;
• authorised users;
• other individuals involved in the customer's business activities.

In these circumstances, the business using Maldra is responsible for ensuring that it has an appropriate lawful basis and any necessary permissions or notices required to provide that information to Maldra for processing.

Maldra processes this information on behalf of the business customer where necessary to provide the requested software functionality.

For example, if a business uses Maldra to maintain its customer list and create invoices for those customers, Maldra processes the information necessary to provide those functions.

Maldra uses third-party payment service providers to process payments and subscriptions.

Where you make a payment through Maldra, payment information may be processed by Paystack, a third-party payment service provider.

Maldra does not directly collect or store your full bank-card details or banking credentials through its own systems.

Payment information required to process a transaction may be transmitted directly to or processed by the applicable payment service provider.

Paystack's own privacy and security practices govern information processed by Paystack.

Maldra may receive limited payment-related information necessary to manage your account, subscription or transaction, such as:

• payment status;
• transaction reference;
• subscription status;
• amount;
• currency;
• payment date;
• payment provider information; and
• other non-sensitive transaction metadata.

Maldra does not require you to provide your bank login credentials to use the platform.

Certain business or tax-related information may be requested by Maldra to support particular business functions.

Where tax information is optional, you are not required to provide it unless the relevant feature or applicable law requires otherwise.

Tax information may include information such as a tax identification number or other business tax information voluntarily provided by the business.

When you access or use Maldra, certain technical information may be processed automatically as part of operating and securing the service.

This may include:

• IP address;
• browser type;
• device type;
• operating system;
• application version;
• approximate technical location information derived from network information where necessary;
• access times;
• pages or application areas accessed;
• authentication events;
• error information;
• security and diagnostic information; and
• other technical information necessary to operate and secure the service.

This information may be used for security, troubleshooting, service reliability, fraud prevention, diagnostics and performance monitoring.

Maldra does not currently operate a cookie-based advertising or behavioural tracking system.

We do not currently use cookies for targeted advertising.

Certain technical mechanisms may nevertheless be necessary for authentication, security, session management or basic operation of our services.

If Maldra introduces additional cookie or tracking technologies in the future, we will update our privacy and cookie notices as appropriate and provide any choices required by applicable law.

We use information processed through Maldra for legitimate business and operational purposes, including to:

• create and manage accounts;
• authenticate users;
• provide access to Maldra;
• provide requested software functionality;
• process subscriptions;
• manage billing;
• process payments through authorised payment providers;
• maintain business records;
• provide inventory functionality;
• provide sales functionality;
• provide invoicing and quotation functionality;
• maintain customer and supplier records;
• provide business management tools;
• provide customer support;
• respond to enquiries;
• troubleshoot problems;
• detect and prevent fraud or abuse;
• protect the security of Maldra;
• monitor service performance;
• maintain and improve our software;
• investigate errors and technical incidents;
• communicate important service information;
• send marketing communications where permitted and appropriate;
• comply with legal and regulatory obligations; and
• protect Maldra's rights, property and users.

We do not use customer business information for purposes unrelated to providing, maintaining, securing or improving the services except where otherwise permitted or required by law.

Maldra does not currently provide AI-powered features as part of the services covered by this Privacy Policy.

Accordingly, customer business data is not currently submitted to an AI model by Maldra for an AI feature.

If Maldra introduces AI-powered functionality in the future that materially changes how customer information is processed, we will update the relevant documentation and provide appropriate information before or when the applicable processing begins.

Maldra may allow users to sign in using Google authentication.

If you choose Google sign-in, Google may provide Maldra with information necessary to authenticate your account, such as your name, email address and profile information made available through the authentication process.

Maldra does not receive your Google password.

Your use of Google authentication is also subject to Google's applicable terms and privacy practices.

Maldra relies on selected third-party technology and service providers to operate its platform.

These providers may process information on Maldra's behalf or provide infrastructure and services necessary to operate Maldra.

Depending on the service involved, these providers may include:

Vercel

Maldra uses Vercel for aspects of application hosting and deployment.

Supabase

Maldra uses Supabase for database and related application infrastructure.

Render

Maldra uses Render for certain application/server infrastructure.

Paystack

Maldra uses Paystack for payment processing.

Payment information handled by Paystack is subject to Paystack's applicable privacy and security practices.

Google

Maldra may use Google authentication services where a user chooses to sign in using Google.

We seek to use service providers that provide appropriate safeguards for the information they process and that are reasonably necessary for the operation of Maldra.

Maldra does not sell your personal information.

We may disclose information where reasonably necessary to:

• provide the Maldra service;
• process payments;
• provide hosting and infrastructure;
• provide authentication;
• provide customer support;
• maintain security;
• prevent fraud or abuse;
• comply with applicable law;
• respond to lawful requests from competent authorities;
• protect the rights, property or safety of Maldra, our customers or others;
• enforce our agreements; or
• complete a corporate transaction such as a merger, acquisition, restructuring or sale of assets, where legally permitted.

We only seek to disclose information to the extent reasonably necessary for the relevant purpose.

Maldra is primarily a software platform used by businesses.

Where a business customer uses Maldra to store information about its own customers, employees, suppliers or other individuals, the business customer remains responsible for its relationship with those individuals and for determining what information it enters into Maldra.

Maldra processes such information in order to provide the functionality requested by the business customer.

If you are an individual whose information was entered into Maldra by a business that uses Maldra, your privacy-related request may in many cases need to be directed to that business first.

For example, if a retail company stores your name and telephone number in its Maldra customer records, that company may be the appropriate organisation to contact regarding the purpose for which your information was collected.

Maldra may assist the relevant business customer where appropriate and legally required.

Maldra takes reasonable technical and organisational measures designed to protect information against:

• unauthorised access;
• unauthorised disclosure;
• alteration;
• loss;
• destruction;
• misuse; and
• other inappropriate processing.

Security measures may include access controls, authentication mechanisms, infrastructure security, monitoring, secure transmission mechanisms and other safeguards appropriate to the nature of the information and the services provided.

However, no internet-based system can be guaranteed to be completely secure.

You are also responsible for maintaining the confidentiality of your account credentials and for ensuring that authorised users of your business use appropriate security practices.

We retain information for as long as reasonably necessary to:

• provide the services;
• maintain your account;
• maintain business records;
• comply with legal or regulatory obligations;
• resolve disputes;
• enforce agreements;
• prevent fraud and abuse;
• maintain security records;
• complete financial or accounting requirements; and
• protect legitimate business interests.

The retention period will depend on the type of information and the reason for which it is processed.

Where information is no longer required, Maldra may delete, anonymise or de-identify it, subject to applicable legal, security, backup and operational requirements.

A customer may request deletion of their Maldra account.

Account deletion initiates the deletion or de-identification of associated information, subject to information that Maldra is required or permitted to retain.

This may include information required for:

• legal compliance;
• accounting and financial records;
• outstanding transactions;
• dispute resolution;
• fraud prevention;
• security records;
• enforcement of agreements;
• backups;
• legitimate operational requirements; or
• other lawful purposes.

Deletion may therefore not result in the immediate physical removal of every copy of every piece of information from all systems.

Where information is retained for one of these reasons, access and use of that information will be limited to the purposes for which retention is necessary.

A business customer may request a copy or export of its business data, subject to the capabilities of the applicable Maldra service and reasonable verification requirements.

Requests may be made through:

We may require reasonable information to verify the identity and authority of the person making the request.

Subject to applicable law and any relevant legal limitations, individuals may have rights concerning their personal information.

These may include rights to:

• request access to personal information;
• request correction of inaccurate information;
• request deletion where applicable;
• request restriction of certain processing;
• object to certain processing;
• request portability or an export of information where applicable;
• withdraw consent where processing is based on consent;
• request information about how personal information is processed; and
• lodge a complaint concerning the handling of personal information.

The availability and scope of these rights depend on the circumstances and applicable law.

Nigeria's data protection framework is principally governed by the Nigeria Data Protection Act 2023 and applicable guidance issued by the Nigeria Data Protection Commission.

To make a privacy request, contact Maldra at:

For technical or account-related support:

You may be asked to provide sufficient information to verify your identity and ensure that information is not disclosed to an unauthorised person.

We will consider and respond to valid requests in accordance with applicable law.

Maldra may communicate with users about:

• product updates;
• new features;
• service announcements;
• educational information;
• promotions;
• business-related information; and
• other marketing communications where permitted.

Marketing communications may be sent through email or other communication channels where appropriate.

Marketing communications are separate from essential service communications.

For example, messages relating to account security, billing, transactions, important service changes or support requests may still be sent even where a user has opted out of marketing communications.

Marketing-related enquiries may be directed to:

When you contact Maldra for support, we may process information contained in your communication, including:

• your name;
• email address;
• account information;
• screenshots or attachments you voluntarily provide;
• technical information;
• information about the problem you are experiencing; and
• other information necessary to resolve your request.

Support communications may be retained for customer-service, security, quality-control and dispute-resolution purposes.

Support requests may be directed to:

Because Maldra relies on third-party infrastructure and technology providers, information may be processed or stored in jurisdictions outside Nigeria.

Where information is transferred or processed internationally, Maldra will seek to use appropriate contractual, technical, organisational or other safeguards required by applicable data protection law.

The actual location of processing may vary depending on the infrastructure and service provider involved.

Maldra is a business software platform and is not designed specifically for children.

We do not knowingly seek to collect personal information from children for purposes unrelated to the provision of our business services.

If you believe that a child has provided personal information to Maldra in circumstances where this should not have occurred, please contact us so that we can assess the situation and take appropriate action.

Maldra may contain links to third-party websites or services.

These third parties operate independently from Maldra and may have their own privacy policies and terms.

Maldra is not responsible for the privacy practices of third-party websites or services that we do not control.

We encourage users to review the privacy information of third-party services before providing information to them.

Maldra maintains security measures designed to reduce the risk of unauthorised access, disclosure, alteration or loss of information.

If Maldra becomes aware of a security incident affecting personal information, we will assess the incident and take steps required under applicable law, which may include investigation, containment, remediation and notification to affected parties or relevant authorities where legally required.

We may update this Privacy Policy from time to time to reflect:

• changes to our services;
• changes to technology;
• changes to our data-processing practices;
• changes to applicable law;
• regulatory guidance; or
• other operational requirements.

When we make material changes, we may provide appropriate notice through the Maldra website, application or other reasonable communication channels.

The updated Privacy Policy will identify the date on which it became effective.

If you have questions, concerns or requests relating to this Privacy Policy or the handling of personal information, contact us.

Maldra intends to operate its personal-information processing in accordance with applicable Nigerian data-protection requirements, including the Nigeria Data Protection Act 2023, together with applicable regulations, guidance and directives issued by the Nigeria Data Protection Commission.

Nothing in this Privacy Policy limits any mandatory rights or protections available to an individual under applicable law.