Legal
Privacy notice
Who we are and how to contact us
Vlaander LTD, a private company limited by shares incorporated in Nigeria, RC 8298878, registered office Plot 8, Block C, Ilasamaja Industrial Estate, Apapa-Oshodi Expressway, Lagos, Nigeria, is the controller of the personal data described here, under the Nigeria Data Protection Act 2023 (NDPA). For any privacy question or request, write to sales@vlaander.com.
What we collect
- Account: your email address and when you sign in.
- Business details: your company's legal name, registration number, jurisdiction and registered address, and the name and role of its authorised signatory.
- Agreement signature: the signatory's typed name and title, and, as evidence of signing, the signed-in email address, IP address, browser, time, and the agreement version and hash.
- Screening: the results of sanctions and due-diligence checks on the buying company and, for USDC payments, the sending wallet.
- Proof runs: which engines and scenarios you ran, and their results.
- Orders: what you bought and payment status. For bank transfers we record the amount, date and bank reference; for USDC payments, the sending wallet address and the Polygon transaction hash, which, like every Polygon transaction, are public on the blockchain.
- Downloads: when an archive was downloaded and from which IP address, to protect the source from misuse and to evidence delivery.
- Security: Cloudflare Turnstile checks that sign-ups come from people, not bots.
- Analytics: privacy-friendly, cookie-free page statistics from Cloudflare Web Analytics.
What the delivered archive contains
The owner record in your archive, BUYER.json, identifies the buying company (legal name, registration number and jurisdiction) and the transaction, not a person's email address. The signed agreement delivered with it (AGREEMENT.md and AGREEMENT.json) names the authorised signatory and their title. Once delivered, these files stay with the source wherever the buyer keeps, copies or passes it on, and Vlaander cannot recall them. The signed-in email address, IP address and browser behind the signature are not in the archive; Vlaander keeps them in its own records.
Why, and on what lawful basis
| Processing | Primary basis |
|---|---|
| Account, order, contract and delivery records | Contract performance |
| Tax, accounting, AML and sanctions records | Legal obligation and legitimate interest where applicable |
| Payment-fraud controls | Legitimate interest and legal obligation where applicable |
| Download IP and access logs | Legitimate interest: access security, fraud prevention, delivery evidence and incident investigation |
| Marketing email | Consent or another specifically documented lawful basis; use opt-out controls |
| Owner record in delivered archive | Contract performance and legitimate interest, but minimise the personal data used |
Who receives it
- Cloudflare, as our processor: hosting, database, storage, sign-in email delivery, bot protection and analytics.
- Banks and payment networks that carry your payment, and the public Polygon network for USDC payments.
- Authorities, regulators and professional advisers, where the law requires it or to establish, exercise or defend legal claims.
International transfers
Cloudflare runs a global network, so personal data may be processed and stored outside Nigeria. Vlaander transfers personal data outside Nigeria only on a basis the NDPA permits, under Cloudflare's data processing terms.
How long we keep it
| Record | Period |
|---|---|
| Contract, invoice, tax and payment evidence | Seven years after transaction, or longer if law requires |
| Download, security and access logs | 12 months, unless needed for dispute, security or legal hold |
| Buyer account data | Contract term plus 24 months, then delete or anonymise unless retention is required |
| Sanctions and due-diligence records | Five years after relationship end, subject to applicable law |
| Marketing records | Until withdrawal of consent or opt-out, then suppression-list retention only |
| Owner-record file | Retained only within the delivered archive and Vlaander’s transaction record for the applicable contract/tax limitation period |
The owner-record file is BUYER.json and the signed agreement delivered with it.
Your rights
Under the NDPA you can ask for access to your personal data and a copy of it, correction, deletion, restriction of processing, and data portability; you can object to processing based on legitimate interest, and withdraw consent where processing relies on it. Some records must be kept for the periods above even if you ask us to delete them. Write to sales@vlaander.com.
Security
We protect personal data with encryption in transit, access controls on staff and customer accounts, personal download links that expire and work only while you're signed in, and logging of access to delivered archives.
If a breach happens
If a personal data breach occurs, we contain and investigate it, notify the Nigeria Data Protection Commission where the NDPA requires, and tell affected people without undue delay where it is likely to put their rights and freedoms at high risk.
Complaints
Please contact us first so we can try to resolve your concern. You also have the right to complain to the Nigeria Data Protection Commission (NDPC), ndpc.gov.ng.