Privacy Policy

Weporta is the data controller for the personal data described in this policy. This means we decide why and how that data is processed.

You can reach us about anything in this policy at contact@weporta.com, or through the Contact page on our website. Please put "Privacy" in the subject line so your message reaches the right person quickly.

What we collect depends on how you use Weporta and which type of account you hold (vendor, exporter, buyer or service provider).

Information you give us

• Account details: your full name, username, email address, phone number, country, password (stored only in encrypted, hashed form), profile photo, and the type of account you choose.
• Business details: your business or trading name, CAC registration number, NEPC registration number, state of operation, website, logo, a description of your business, and the product categories you deal in.
• Identity and verification documents: depending on your account type, a government ID (National Identification Number slip, voter's card or driver's licence), an international passport, a CAC certificate, or an NEPC certificate, together with the details shown on those documents.
• Export credentials and compliance documents you upload, such as NAFDAC registrations, phytosanitary certificates, certificates of origin, organic, GlobalGAP, HACCP, ISO or Fairtrade certificates, and laboratory analysis results.
• Supply records: details you record about producers and farmers you source from, including their names, state and local government area, GPS location, commodity, variety, quantity and quality notes.
• Marketplace activity: products and export offerings you list, prices, deals and orders you create or respond to, and reviews you write or receive.
• Service provider listings: your services, locations, images and contact details for the public directory.
• Community content: posts, comments, reactions and reports you submit to Export Conversations.
• Messages you send us through the Contact page, by email, or when you join our waitlist (your name, email address and the type of account you are interested in).

Information we collect automatically

• Technical and log data: IP address, browser type, device type, operating system, pages requested, and the date and time of each request. Our hosting and security systems need this to deliver the website and protect it.
• Error reports: when something breaks, we record technical details about the error and the device it happened on so we can fix it.
• Performance data: anonymous measurements of how quickly pages load, which we use to keep the platform fast on mobile networks.
• Usage analytics: if, and only if, you accept analytics cookies, we record which pages and features are used. We do not attach your name, email address or other directly identifying details to these events.
• Data stored on your device: to let you keep working without an internet connection, the platform stores some of your work in your browser's local storage until it can be sent to our servers.

Information from other people

Other users may give us information about you. For example, an exporter may record you as a producer they sourced from, a member of your organisation may invite you to join their account, a buyer may write a review of your business, or our team may create a service provider account for your business at your request.

We use personal data only for the purposes below, and we rely on a lawful basis recognised by section 25 of the NDPA for each one.

• To create and run your account, sign you in, and provide the features of your account type. Lawful basis: performance of our contract with you.
• To review your onboarding and verification documents, confirm that accounts are run by real businesses, approve vendor upgrades, and decide which accounts can issue Verified Supply Reports or appear in the directory. Lawful basis: performance of our contract and our legitimate interest in keeping the platform trustworthy.
• To generate, lock and publish Verified Supply Reports and their QR verification pages when you finalise them. Lawful basis: performance of our contract with you.
• To show your public profile, listings, offerings and posts to other users, as described in section 4. Lawful basis: performance of our contract with you.
• To send you service messages, such as email confirmation, password resets, review outcomes, deal and order updates, document expiry reminders, and reminders to finish setting up your account. Lawful basis: performance of our contract and our legitimate interest in helping you use the platform.
• To moderate Export Conversations and enforce our Terms of Service. Lawful basis: our legitimate interest in keeping the community safe and accurate.
• To detect, investigate and prevent fraud, misuse and security incidents, and to keep an audit trail of important actions. Lawful basis: our legitimate interest and, where relevant, legal obligation.
• To understand how the platform is used and improve it. Lawful basis: your consent (for analytics cookies) and our legitimate interest (for error and performance data).
• To reply to your enquiries and manage the waitlist. Lawful basis: our legitimate interest and, where you asked to hear from us, your consent.
• To comply with the law, respond to lawful requests from authorities, and establish, exercise or defend legal claims. Lawful basis: legal obligation and legitimate interest.

We do not sell your personal data, and we do not use it for third party advertising. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Account and document reviews are carried out by members of our team.

Weporta is built so that the records you choose to share can be checked by people outside the platform. That means some information is visible to others:

• Verified Supply Reports: anyone with the link or QR code can view a finalised report, including your business name and verification status, the report number, commodity, total quantity, origin state, the date it was finalised, and the status of its NAFDAC and phytosanitary documents. Report pages are kept out of search engine results but are not password protected. Individual producer names and GPS locations are not shown on the public report page.
• Exporter profiles and offerings: buyers and other signed-in users can see your business name, products, offerings, verification status, credentials summary, track record and reviews.
• Vendor products: exporters can see vendor product listings. Buyers cannot see vendor accounts or vendor products.
• Service provider listings: once approved, your directory listing is publicly visible.
• Export Conversations: approved posts, along with your display name and business name, are publicly visible. Comments and reactions are visible to other users.
• Deals and orders: the details of a deal or order are visible to the parties to it.

Your identity documents, CAC and NEPC certificates, passport, phone number and email address are never shown publicly. They are visible only to you, authorised members of your organisation, and the Weporta team members who review them.

We share personal data only in the following situations:

• With service providers who process data on our behalf to run the platform, under contracts that require them to protect it and use it only on our instructions. These include Supabase (database, file storage and sign-in), Vercel (website hosting and performance measurement), Sentry (error monitoring), Resend (sending emails), and PostHog (product analytics, only if you consent).
• With other users, to the extent described in section 4 and as needed to complete deals and orders you take part in.
• With members of your own organisation, who can see the records your organisation creates.
• With law enforcement, regulators, courts or other public authorities when the law requires it, or when we believe in good faith that disclosure is needed to protect the rights, property or safety of Weporta, our users or the public.
• With professional advisers, such as lawyers, auditors and insurers, under a duty of confidentiality.
• With a buyer, investor or successor if Weporta is involved in a merger, acquisition, financing or sale of assets. We will tell you before your personal data becomes subject to a different privacy policy.

Some of our service providers store or process data on servers outside Nigeria. When personal data is transferred outside Nigeria, we do so in line with sections 41 to 43 of the NDPA, by relying on an adequate level of protection in the receiving country, appropriate contractual safeguards with the recipient, or another basis the NDPA permits, such as your consent or the performance of our contract with you.

You can contact us for more information about the safeguards we use for a particular transfer.

We keep personal data only for as long as we need it for the purposes in this policy:

• Account and business details are kept while your account is active. When an account is closed, we remove it from the platform and delete or anonymise the personal data in it, except where we need to keep it for the reasons below.
• Finalised Verified Supply Reports are kept for as long as the report remains verifiable, because buyers and others rely on its QR link continuing to work. If your account is closed, we will discuss with you whether a report should be withdrawn.
• Verification documents are kept while your account is active and for as long afterwards as is reasonably needed to show how a verification decision was made or to deal with a dispute.
• Audit records of important actions, such as document reviews and report finalisation, are kept as a permanent, unalterable record because they protect the integrity of verified reports.
• Error reports and technical logs are kept for a short period and then deleted automatically.
• Waitlist and enquiry data is kept until it is no longer needed to respond to you or until you ask us to remove it.

We may keep data for longer where the law requires it, or where it is needed to establish, exercise or defend a legal claim.

Under the NDPA you have the right to:

• be told how your personal data is processed, which this policy does;
• get a copy of the personal data we hold about you;
• ask us to correct personal data that is inaccurate or incomplete;
• ask us to delete your personal data;
• ask us to restrict how we use your personal data;
• object to processing we carry out on the basis of our legitimate interests;
• receive personal data you gave us in a structured, commonly used and machine readable format, and ask us to send it to another organisation where this is technically possible;
• withdraw your consent at any time, where we rely on consent, without affecting processing that already took place;
• not be subject to a decision based solely on automated processing that significantly affects you.

You can update most of your account and business details yourself from your dashboard settings. To exercise any other right, email us from the address linked to your account. We may need to confirm your identity before acting on a request. We will respond without undue delay and in any case within the time the law allows.

Some rights have limits. For example, we may not be able to delete information that forms part of a finalised Verified Supply Report or an audit record, or that we must keep by law. If we cannot fully meet a request, we will explain why.

If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the Nigeria Data Protection Commission (ndpc.gov.ng). We would appreciate the chance to resolve your concern first, so please contact us before you do.

If you record personal data about other people on Weporta, such as the names and farm locations of producers you source from, or the details of colleagues you invite to your organisation, you are responsible for making sure you are allowed to share it with us. Where the law requires, you should tell those people that their information will be recorded on Weporta and point them to this policy.

We use technical and organisational measures appropriate to the risk to protect personal data against loss, misuse and unauthorised access. These include encryption of data in transit, hashed passwords, database rules that keep each organisation's records separate from every other organisation's, private storage for identity and compliance documents, short lived links for downloading generated documents, and restricted, logged access for our team.

No system is completely secure. Please use a strong password that you do not use elsewhere and keep it private. If you think your account has been compromised, contact us immediately.

If a personal data breach occurs that is likely to put your rights and freedoms at risk, we will notify the NDPC within 72 hours of becoming aware of it, as the NDPA requires, and we will tell you without undue delay where the breach is likely to put you at high risk.

Weporta is a business platform for adults. You must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it.

We use a small number of cookies and similar technologies. Essential cookies keep you signed in and remember your cookie choice. Analytics cookies are used only if you accept them in our cookie banner. Our Cookie Policy lists them in detail and explains how to change your choice.

We may update this policy as the platform or the law changes. The date at the top of the page shows when it was last changed. If we make a significant change, we will tell you by email or through a notice on the platform before the change takes effect.

If you have any questions about this policy or how we handle your personal data, or you want to exercise your rights, email us at contact@weporta.com or use the Contact page on our website.