Draft for legal review. This policy was prepared to reflect how CityFarms actually handles personal data, and is written against the Nigeria Data Protection Act 2023. It has not been reviewed by a lawyer. Have it checked before you rely on it, and before submitting it during payment-processor onboarding.
1. Who we are
CityFarms is operated by CityFarms Agritech Investments Limited (RC 1749535), a private company limited by shares incorporated in Nigeria under the Companies and Allied Matters Act 2020.
For the purposes of the Nigeria Data Protection Act 2023 ("NDPA"), we are the data controller for personal data collected through cityfarms.ng and our associated services.
| Registered name | CityFarms Agritech Investments Limited |
|---|---|
| RC number | 1749535 |
| Registered address | 43b, Oduduwa Crescent, Ikeja GRA, Ikeja, Lagos |
| Data protection contact | privacy@cityfarms.ng |
| General support | support@cityfarms.ng |
2. What we collect
We collect only what the platform needs to work. What we hold depends on whether you are a consumer, a farmer, a market trader, or another seller type.
Everyone who registers
- First and last name
- Email address
- Nigerian phone number
- Your password, stored only as a one-way cryptographic hash — we never hold the password itself and cannot read it
- Account type (consumer, farmer, trader, inputs supplier, equipment provider, logistics partner, aggregator)
- State and local government area
- One-time verification codes sent to your phone, retained briefly and then expired
Farmers and sellers
- Farm or business name, size, and primary produce
- Cooperative membership, where you provide it
- Precise geographic coordinates of your farm or market stall
- Market and stall number, for traders
- Listings, prices, ratings and order history
Consumers
- Delivery address, nearest landmark, and delivery coordinates
- Order history and how often you order
- Ratings and reviews you leave
Collected automatically
- IP address and browser user-agent, recorded against each login session
- Session tokens stored in a cookie, so you stay signed in
- Basic usage information about pages visited
What we do not collect. We do not store card numbers, bank account details, or bank verification numbers. Payments are handled entirely by a licensed payment processor — those details go directly to them and never reach our servers. See section 5.
3. Why we use it, and our lawful basis
Section 25 of the NDPA requires a lawful basis for each purpose. Ours are:
| What we do | Why | Lawful basis |
|---|---|---|
| Create and run your account | You cannot buy or sell without one | Performance of a contract |
| Send a verification code to your phone | Confirms the number is yours and reduces fraudulent accounts | Performance of a contract; legitimate interest in platform safety |
| Show farm and stall locations on a map | Traceability is a core promise of the platform — buyers can see where food comes from | Performance of a contract; consent, for sellers publishing their location |
| Process and deliver orders | Fulfilment, including passing your address to the delivery partner | Performance of a contract |
| Hold funds in escrow until delivery is confirmed | Protects both sides of the transaction | Performance of a contract |
| Verify farmers and traders | Cooperative peer-vetting and on-site checks underpin the verified badge | Legitimate interest in marketplace trust |
| Keep security logs of IP and device per session | Detect account compromise and abuse | Legitimate interest in security |
| Send service messages about your orders | You need to know when produce is on its way | Performance of a contract |
| Send marketing messages | Offers and platform news | Consent — you may withdraw it at any time |
| Meet tax, accounting and regulatory obligations | Required of us by law | Legal obligation |
4. Location data — please read
CityFarms is built around knowing where food comes from. If you register a farm or a market stall, the coordinates you provide are published on a public map and are visible to anyone visiting the site, whether or not they have an account.
This is deliberate and it is the point of the platform — but it is also a meaningful decision, particularly where a farm is also a home. Publish the location of the farm gate or the stall, not of a private dwelling. You can ask us to remove or coarsen your published location at any time by writing to privacy@cityfarms.ng.
Consumer delivery addresses are never published. They are shared only with the seller and the delivery partner handling your specific order.
5. Who we share data with
We do not sell personal data. We share it only where it is needed to deliver the service:
| Recipient | What they receive | Why |
|---|---|---|
| Sellers on the platform | Your name, delivery address and order contents — for their orders only | So they can fulfil what you bought |
| Logistics partners | Name, delivery address, landmark, phone number | Last-mile delivery |
| Payment processor Paystack Payments Limited | Payment details you enter with them directly, order amount, reference | Taking payment and holding escrowed funds |
| Termii Limited (Nigeria) | Your phone number and the message content | Delivering verification codes by SMS |
| Google LLC | Map interactions on our Markets page | Rendering the interactive map |
| Hostinger International | All data stored on our behalf | Hosting and database infrastructure |
| Regulators, law enforcement, courts | Only what is lawfully required | Legal obligation |
6. Transfers outside Nigeria
Some of our providers process data outside Nigeria — our hosting infrastructure and Google Maps in particular. Sections 41 to 43 of the NDPA permit such transfers where the destination offers adequate protection, or where appropriate contractual safeguards are in place. We rely on our providers' standard data protection terms for this.
If you want to know where your data is held at any given time, ask us and we will tell you.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account details | While your account is open, then 90 days after closure |
| Order and transaction records | Six years after the transaction, to meet Nigerian tax and accounting requirements |
| One-time verification codes | Ten minutes, then expired; purged periodically |
| Login sessions (IP, device) | Thirty days, or until you log out |
| Support correspondence | Two years |
Closing your account does not erase transaction records we are legally required to retain.
8. Your rights under the NDPA
You have the right to:
- Be informed about how your data is used — this policy exists for that purpose
- Access a copy of the personal data we hold about you
- Rectify anything inaccurate or incomplete
- Erase your data where we have no continuing lawful reason to keep it
- Restrict processing while a dispute about accuracy or lawfulness is resolved
- Port your data to another service in a structured, machine-readable format
- Object to processing based on legitimate interest, and to direct marketing at any time
- Withdraw consent where consent is the basis, without affecting what came before
- Not be subject to a solely automated decision producing legal or similarly significant effects
To exercise any of these, write to privacy@cityfarms.ng. We will respond within 30 days. We do not charge for this, though we may ask you to confirm your identity first so we do not hand your data to someone else.
9. Complaints
If you are unhappy with how we have handled your data, tell us first at privacy@cityfarms.ng — most things are quicker to fix directly.
You also have the right to complain to the Nigeria Data Protection Commission, the supervisory authority established under the NDPA, at ndpc.gov.ng. You do not need our permission to do so.
10. How we protect your data
- The whole site is served over HTTPS
- Passwords are hashed with bcrypt at cost 12 — they are never stored in readable form
- Session tokens are 64-character random values, stored in cookies marked HttpOnly, Secure and SameSite
- Database queries use prepared statements, protecting against SQL injection
- Database credentials sit outside the web root and are blocked from being served
- Sessions expire, and old sessions are cleared when you sign in on a new device
No system is perfectly secure. If we discover a breach likely to result in a risk to your rights and freedoms, we will notify the NDPC within 72 hours as the NDPA requires, and tell you directly where the risk to you is high.
11. Children
CityFarms is not intended for anyone under 18. We do not knowingly collect data from children. Under the NDPA, processing a child's data requires verified parental consent, which our signup flow does not currently obtain — so please do not register if you are under 18. If you believe a child has registered, contact us and we will remove the account.
12. Cookies
We keep cookie use to a minimum and set no advertising or cross-site tracking cookies.
| Cookie | Purpose | Life |
|---|---|---|
cf_session | Keeps you signed in | 30 days |
cf_sess | Server-side session handling | Session |
Both are strictly necessary for the site to function. Blocking them will prevent you from signing in. Google Maps may set its own cookies on the Markets page; those are governed by Google's privacy policy.
We also store a small amount of information in your browser's local storage — your cart contents and which account type you last signed in as. That never leaves your device.
13. Changes to this policy
We will update this page when our practices change, and revise the date at the top. If a change materially affects your rights, we will tell you by email or a notice on the site before it takes effect.
14. Contact
CityFarms Agritech Investments Limited
RC 1749535
43b, Oduduwa Crescent, Ikeja GRA
Ikeja, Lagos, Nigeria
Data protection: privacy@cityfarms.ng
Support: support@cityfarms.ng