1. Introduction
This policy explains how BitaSei Technologies Limited (RC 9278400) collects, uses, shares and protects personal data when you use Stockwaka. It applies to shop owners and traders who use Stockwaka on WhatsApp, to attendants who use a counter terminal, and to shoppers who order from a shop through its Stockwaka link.
We are the data controller for the personal data described here, except where this policy says a merchant is the controller and we act as their processor — which is the case for the records a merchant keeps about their own customers (see clause 8).
We process personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation 2019 (NDPR), and other applicable Nigerian law.
2. Who we are and how to reach us
Stockwaka is a product of BitaSei Technologies Limited. The company, not the product, is the legal entity you deal with.
| Detail | Information |
|---|---|
| Controller | BitaSei Technologies Limited |
| RC number | 9278400 |
| Registered office | 8B, Obadare Street, Amuwo Odofin, Lagos State, Nigeria |
| Privacy contact | privacy@bitasei.com |
| Support | hello@stockwaka.com |
3. The three ways people reach us
Stockwaka touches three different kinds of people, and the answer to “whose data is this, and who decides what happens to it” differs for each. It is worth knowing which one you are.
| Who you are | Your relationship with us |
|---|---|
| A merchant | You hold the account. We are the controller of your account data and process your business records to run the Service for you. |
| An attendant | Your employer creates your profile and PIN so sales can be attributed to you. Your employer is the controller of that; we process it for them. |
| A shopper | You message a shop through its link. We are the controller of the account we create to run that conversation; the shop is the controller of its own record of your order. |
| Someone named in a merchant’s records | A merchant may record your name against a debt or a sale. That merchant is the controller of that record — see clause 8. |
4. Information we collect
Information you give us
| Category | What it includes |
|---|---|
| Identity and contact | Your WhatsApp phone number — which is your identity on Stockwaka — your name, your business name, and the type of business you select. |
| Business records | Your products, prices, stock levels, sales, credit book entries, orders, VAT settings, and any trade ledger you keep. |
| What you send us | The text of your messages and commands, the transcript of your voice notes, the information read out of photographs and receipts you send, and the contents of any stock file you upload. |
| Payment and payout | The bank name, account number and verified account name you nominate to receive payment, the settlement account reference created for it, and references for subscription payments. We do not hold your full card details — the payment provider does. |
| Counter terminal | Attendant names and their PINs stored as a one-way hash, terminal pairing records, and device identifiers. |
Information we collect about shoppers
When someone orders through a shop’s Stockwaka link we record their WhatsApp number, the name they give, their order history with that shop, the total they have spent there, and where they are in the conversation so a reply makes sense in context.
Information collected automatically
- Message metadata from WhatsApp — message identifiers, timestamps, and whether a message was delivered and read.
- Technical and diagnostic data — IP address, error logs, timings, and the identifier of a paired terminal.
- Usage counts, such as how many transactions were recorded in a billing period, so we can apply your plan allowance.
What we do not collect
- We do not ask for a password, a BVN, an NIN, or a government identity document for the core service.
- We do not collect location data.
- We do not want special category data — health, religion, political opinion, biometric or genetic data. Do not put it into the Service.
- Stockwaka has no advertising trackers and we do not run advertising networks on the Service.
5. Voice notes, photographs and artificial intelligence
We do not keep your voice notes.
When you send a voice note, the audio is fetched, held in memory only for as long as it takes to turn it into text, and then discarded. It is never written to our storage. The same is true of the photographs you send: we keep what was read out of the image, not the image file.
What we do keep is the transcript and the entries made from it, because those are your business records — the sale, the restock, the debt. You can see and correct them at any time through the Service.
Who processes the audio and images
We use OpenAI to convert speech to text and to read the contents of your photographs and messages. To do that, the audio or image and the resulting text are transmitted to OpenAI’s systems in the United States. We use these services under terms that do not permit your content to be used to train their general models.
Because a photograph of a sales jotter or an invoice can contain other people’s names and debts, this processing may include their personal data. Clause 8 explains how that is handled.
Automated decisions
We do not make decisions producing legal or similarly significant effects about you by automated means alone. Automated processing is used to interpret what you sent and to raise alerts — for example that stock is low or a debt is ageing — and every entry is confirmed back to you so you can correct it.
6. How we use your information
- To create and run your account, and to onboard you.
- To transcribe, interpret and record what you send, and to confirm it back to you.
- To maintain your stock, sales, credit, order and trade records across WhatsApp, the counter terminal and your storefront.
- To run your storefront — showing your catalogue to shoppers, reserving stock, and passing orders to you and your terminals.
- To send operational messages: confirmations, low-stock and expiry alerts, order notifications, reports you asked for, and service notices.
- To take subscription payments, apply plan limits, and verify the bank account you nominate.
- To provide support when you contact us.
- To keep the Service secure — detecting fraud, abuse, and unauthorised access.
- To improve the Service, including improving how accurately we understand Nigerian speech and business language. Where we use your content for this beyond simply running the Service, we aggregate or de-identify it first.
- To meet our legal, accounting and regulatory obligations, and to establish or defend legal claims.
We do not sell your personal data. We do not share your business figures with other merchants. We do not use your records to advertise to your customers.
7. Our legal basis for processing
Under the NDPA, we rely on the following bases:
| Basis | When we rely on it |
|---|---|
| Performance of a contract | Running your account, processing what you send, taking payment, running your storefront, and providing support — all of which are what you asked us to do. |
| Consent | Optional messages such as marketing, and any processing we specifically ask you to agree to. You can withdraw consent at any time. |
| Legal obligation | Keeping accounting and tax records, and responding to a lawful request from a court, regulator or law enforcement agency. |
| Legitimate interest | Securing the Service, preventing fraud and abuse, recovering money owed to us, and improving how the Service works — balanced each time against your interests and rights. |
8. Records merchants keep about other people
A central part of Stockwaka is the credit book: a merchant records that a named customer owes a sum of money. Names also appear in sales entries and in photographs of sales books. Those people are often not Stockwaka users and have no account with us.
For those records, the merchant is the controller — not us.
The merchant decides what to record and why. We hold and process it on their instructions as their processor, and we do not use it for our own purposes.
If you are named in a merchant’s records
If you believe a business has recorded you in Stockwaka and you want to know what it holds, or want it corrected or removed, contact that business — they control the record and can change it. If you cannot reach them, or you believe a business is using Stockwaka to hold data about you unlawfully, write to us at privacy@bitasei.com and we will help, including by putting your request to the merchant and, where we are entitled to, acting on it ourselves.
If you are the merchant
You must have a lawful basis for what you record, and you are responsible for answering these requests. Our Terms of Service set this out in full. We will give you reasonable assistance, and will tell you promptly if we receive a request or complaint that relates to your records.
10. International transfers
Some of our providers are outside Nigeria, as the table in clause 9 shows — principally in the United States and the European Union. That means your personal data may be transferred to and processed in those countries.
Where we transfer personal data out of Nigeria we do so on a basis permitted by the NDPA — normally an adequacy determination, or contractual terms imposing protections equivalent to those under Nigerian law, together with our own assessment of the provider’s safeguards. You may ask us for details of the mechanism used for a particular transfer.
11. How we protect your information
- Data is encrypted in transit, and messages from WhatsApp reach us over a secured, signature-verified channel we reject anything unverified on.
- Attendant PINs are stored as one-way hashes, never as the PIN itself.
- A counter terminal’s access credentials are held by the application itself and are never exposed to its interface, so they cannot be read off the screen or copied out of the till.
- Access to production systems is restricted to staff who need it, and is logged.
- We validate every payment webhook’s signature before acting on it, so a forged payment notification cannot confirm an order.
No system is perfectly secure. You play a real part: keep control of the phone number your account is tied to, issue attendant PINs individually, remove staff who leave, and do not let untrusted people reach a paired terminal.
If something goes wrong
If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of it where the law requires, and will tell affected people without undue delay where the risk is high.
12. How long we keep information
We keep personal data only as long as we need it for the purpose we collected it, or as long as the law requires. Your sales ledger and credit book are accounting records, so company and tax law obliges us to retain them even if you ask for deletion.
| What | How long |
|---|---|
| Voice note and photograph audio/image files | Not retained. The file is held in memory only long enough to read it, then discarded — we never write it to storage. |
| Merchant account details (phone, name, business name, plan) | For as long as the account is open, then 6 years. |
| Business records (stock, sales ledger, credit book, trade ledger, transcripts of what you sent) | 6 years from the end of the financial year they relate to — these are accounting records. |
| Payout bank details and payment references | For as long as the account is open, then 6 years. |
| Shopper profile and order history (customer storefront) | Order records for 6 years as above; the shopper profile itself is deleted 24 months after the shopper was last active — their last order or last message to a shop, whichever is later. |
| WhatsApp message logs (content and delivery status) | 24 months from the message being logged. |
| Counter terminal credentials and attendant PINs | Destroyed as soon as the terminal is unpaired or the attendant is removed. The pairing and staff records themselves are kept with your business records, so past sales stay attributable to whoever made them. |
| Technical and error logs | 12 months. |
| Marketing preferences | Until you withdraw consent. |
When a period ends we delete the data or irreversibly anonymise it. Backups are overwritten on their own cycle, so a deleted record may persist in a backup for a short period after deletion from the live system.
13. Your rights
Under the NDPA you have the following rights over your personal data:
| Right | What it means |
|---|---|
| Access | Ask what personal data we hold about you and get a copy of it. |
| Rectification | Have inaccurate or incomplete details corrected. |
| Erasure | Ask us to delete your data, where no law requires us to keep it. |
| Restriction | Ask us to pause processing while a dispute about accuracy or lawfulness is resolved. |
| Data portability | Receive the data you gave us in a common, machine-readable format. |
| Objection | Object to processing we carry out on the basis of a legitimate interest. |
| Withdrawal of consent | Withdraw consent at any time, without affecting anything done before you withdrew it. |
| Complaint | Complain to us, and to the Nigeria Data Protection Commission (NDPC), if you believe your data has been mishandled. |
How to exercise them
Write to privacy@bitasei.com from the number or address associated with your account, or message us on WhatsApp. We may ask you to confirm your identity before we act, so that we do not disclose someone’s data to the wrong person.
We respond within 30 days. If a request is complex we may extend that, and will tell you why. There is no fee unless a request is manifestly unfounded or excessive.
Some rights are limited. We cannot delete records we are legally required to keep, and we cannot act on a merchant’s behalf for data they control — clause 8 explains that route.
Complaints
If you are unhappy with how we have handled your data, tell us first at privacy@bitasei.com and we will try to put it right. You also have the right to complain to the Nigeria Data Protection Commission (NDPC) at any time.
14. Children
Stockwaka is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child’s data has been given to us, contact privacy@bitasei.com and we will delete it.
16. Changes to this policy
We may update this policy. The version number and effective date at the top of this page always show the current version. Where a change materially affects how we handle your data, we will tell you on WhatsApp or in the Service before it takes effect.
17. Governing law
This policy is governed by the laws of the Federal Republic of Nigeria, and the courts of Lagos State have exclusive jurisdiction, subject to the dispute resolution clause of our Terms of Service and to your right to complain to the Nigeria Data Protection Commission (NDPC).