SimBazaar

Privacy Policy

Last updated 23 October 2026

In short: we collect what we need to run your account, deliver your orders and stop fraud. We share it only with the partners who make that possible, or with authorities when the law requires it. We never sell it. You can ask to see, correct or delete your data under the Nigeria Data Protection Act 2023.

1. Who is responsible

Simbazaar (CAC RC391045), No 2 Ayodele Fanoiki Street, is the data controller for personal data processed through SimBazaar. For anything in this policy, email [email protected].

2. What we collect

  • Account: name, email address, phone number if given, and your password (stored only as a one-way hash).
  • Wallet and payments: top-ups, amounts, payment references and status from our payment partners. We never receive or store your full card or bank details.
  • Orders: which numbers you bought, for which service and country, when, and the SMS messages and codes delivered to them.
  • Store purchases: what you bought and its status. For eSIMs, the ICCID and the activation code, which we store encrypted.
  • Identity checks (RMM and where required): full name, business name and phone number.
  • Projects: content, logins and files you give us to build or set up a tool or website.
  • Technical: IP address at sign-up, login and purchase; API key usage; basic device and browser details; error logs.
  • Support: what you write to us and our replies.

3. Why we use it, and on what legal basis

  • To provide the Service (account, wallet, orders, deliveries, support): needed to perform our contract with you.
  • To prevent fraud and abuse (purchase limits, unusual-activity checks, blocking risky platforms): our legitimate interest in keeping the Service, our customers and our suppliers safe.
  • To meet legal duties (financial records, tax, lawful requests from authorities): legal obligation.
  • To send product news or offers: only with your consent, which you can withdraw at any time. Service messages such as receipts and security alerts are not marketing.

We do not make decisions with legal or similarly significant effects about you by automated means alone. Automatic fraud checks can temporarily limit an account, and a person reviews it if you ask.

4. Who we share it with

  • Payment partners (Paystack, Flutterwave, NOWPayments): the amount and reference for each top-up, and your email address where the partner needs it to process the payment.
  • Number providers: only what is needed to place an order (service and country). We do not send them your name or contact details.
  • eSIM suppliers (such as Airalo): the package ordered and our internal order reference. We do not send them your name or email unless a destination country's rules require identity details, and then only with your knowledge.
  • Service providers who host, email, secure or monitor SimBazaar for us, under contracts that require them to protect your data and use it only for us.
  • Authorities: law enforcement, regulators or courts, when Nigerian law requires it or to protect people from serious harm.
  • A buyer of our business, if SimBazaar is sold or merged. They must protect your data under this policy.

We do not sell your personal data and do not share it for other companies' advertising.

5. Transfers outside Nigeria

Some partners (for example number providers, eSIM suppliers and hosting or error-monitoring services) process data outside Nigeria. When we transfer personal data abroad, we do so as the Nigeria Data Protection Act 2023 permits, for example where the transfer is needed to perform our contract with you, or with appropriate safeguards in place. We send only what the partner needs.

6. How long we keep it

  • SMS messages and codes delivered to your numbers: deleted automatically 12 months after they arrive.
  • Order records (which number, for which service, when, and the price): kept with your wallet records, because they explain each charge. This also lets us answer lawful requests.
  • Wallet and payment records: for as long as Nigerian tax and accounting law requires.
  • Identity-check details: kept with the purchase they were given for, so we can show who held an RMM seat if a question is raised later. Once the product has ended, you can ask us to delete them.
  • Project files and logins you give us for a tool or website: kept while we build or run it, and deleted within 12 months after the project or subscription ends, unless you ask us to keep them.
  • Account details: while your account is open, and then only as long as needed for the purposes above.
  • Account history and sign-ins: every change to your name, email, phone or password (what it changed from and to, when, and from which IP address and device), and every sign-in or failed attempt. We keep these for 6 years after your account closes, even if you ask us to delete your account. We need them to prevent and investigate fraud, to answer lawful requests from the authorities, and to defend legal claims.

7. Security

We use encrypted connections, hashed passwords, encryption for sensitive fields such as eSIM activation codes and provider keys, two-factor authentication for staff, restricted staff access, and audit logs of staff actions. No system is perfectly secure. If a breach is likely to put your rights at risk, we will tell you and the Nigeria Data Protection Commission as the law requires.

8. Your rights

Under the Nigeria Data Protection Act 2023 you can ask us to:

  • confirm whether we hold your data and give you a copy;
  • correct data that is wrong or incomplete;
  • delete your data, unless we must keep it by law (for example financial records) or need it for a legal claim;
  • restrict or object to how we use it, including withdrawing consent;
  • give you your data in a commonly used format, or send it to another provider where that is possible.

Email [email protected] from the address on your account. We may need to confirm your identity. We will respond within the time the law allows, and we don't charge for reasonable requests. You can also complain to the Nigeria Data Protection Commission (NDPC).

9. Cookies and local storage

We use only essential cookies: one to keep you signed in and one to protect forms from forgery. Your browser also remembers your light or dark theme choice. We don't use advertising or cross-site tracking cookies. If we enable a bot-check (Cloudflare Turnstile) on sign-up or payments, Cloudflare processes basic device signals to tell people from bots.

10. Children

SimBazaar is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has an account, tell us and we will close it.

11. Changes

When we change this policy, we update the date at the top. If a change significantly affects how we use your data, we will tell you by email or in your account before it takes effect.