Privacy Policy

1. Two Roles: Controller and Processor

1.1 TerraSell acts as a data controller for personal data relating to our own website visitors, marketing contacts, and the business contacts of our Clients who register and administer accounts (for example, a Client's admin user setting up the account). For this data, TerraSell decides why and how the data is processed, and this Policy describes that processing.

1.2 TerraSell acts as a data processor for personal data that our business clients (“Clients”) or their Authorised Users submit into the Service in the course of using it — for example, the names and contact details of healthcare professionals, distributors, retailers, or field representatives entered by a Client. For this data, the Client is the data controller and determines the purposes of processing; TerraSell processes it only on the Client's instructions, as set out in the Data Processing Agreement between TerraSell and that Client. If you are an individual whose data has been entered into the Service by one of our Clients, please direct any privacy request to that Client in the first instance; TerraSell will assist the Client in responding as required by the Data Processing Agreement.

2. Personal Data We Collect

2.1 Account and registration data: name, work email, phone number, job title, employer, and password, when a Client or Authorised User registers for the Service.

2.2 Usage data: log-in activity, pages and features accessed, device and browser type, IP address, and diagnostic information, collected automatically when you use the Service or our website.

2.3 Location data: with device permission, TerraSell collects GPS location data from field representatives' mobile devices while the app is in active use, for the purposes of visit verification, route optimisation, and geofenced attendance features. This data is collected on the instructions of, and belongs to, the relevant Client as data controller.

2.4 Business contact data entered by Clients: names, phone numbers, addresses, and professional details of healthcare professionals, distributors, retailers, and other business contacts, entered into the Service by Clients and their Authorised Users, as described in clause 1.2.

2.5 Payment data: name, address, and transaction details, processed on our behalf by third-party payment processors. TerraSell does not itself store full card details.

2.6 Communications: records of support requests, emails, and other communications you send us.

3. How We Use Personal Data

3.1 We use personal data to: (a) provide, maintain, and improve the Service; (b) authenticate users and secure accounts; (c) process payments and manage subscriptions; (d) provide customer support; (e) send administrative communications, including service updates and security notices; (f) with consent or another lawful basis, send product updates or marketing communications; (g) generate aggregated and anonymised analytics and AI-assisted insights within the Service; and (h) comply with legal obligations and enforce our agreements.

4. Legal Basis for Processing

4.1 Where TerraSell acts as a data controller, we rely on one or more of the following legal bases recognised under the NDPA: performance of a contract with you or your employer; our legitimate interests in operating and improving our business, provided these are not overridden by your rights; your consent, where we rely on consent (for example, for optional marketing communications or non-essential cookies); and compliance with a legal obligation.

5. Sharing of Personal Data

5.1 We share personal data with: (a) sub-processors that provide infrastructure and functionality for the Service, such as cloud hosting providers, mapping and geolocation providers, WhatsApp Business and SMS messaging providers, AI/machine-learning service providers used to power in-app insights, and payment processors, each engaged under a written agreement requiring appropriate data protection safeguards; (b) professional advisors, such as auditors or lawyers, under duties of confidentiality; (c) a buyer or successor in the event of a merger, acquisition, or sale of assets, subject to continued protection of the data; and (d) regulators, law enforcement, or other third parties where required by law.

5.2 TerraSell does not sell personal data to third parties.

6. International Data Transfers

6.1 Some of our sub-processors may store or process personal data outside Nigeria. Where this occurs, we transfer personal data only where the NDPC has determined that the destination country provides an adequate level of protection, or where appropriate safeguards are in place (such as standard contractual clauses recognised by the NDPC), or another lawful transfer mechanism under the NDPA applies. Further detail on specific transfers is available on request to our Data Protection Officer (see clause 13).

7. Data Retention

7.1 We retain personal data for as long as necessary to provide the Service and for the purposes described in this Policy, including to comply with legal, accounting, or reporting obligations. Client Data processed on behalf of a Client is retained and deleted in accordance with the Data Processing Agreement with that Client, and generally deleted or returned within thirty (30) days of termination of that Client's subscription, unless a longer period is required by law.

8. Data Security

8.1 We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, or alteration, including encryption of data in transit and at rest, access controls, and regular security review. No system is completely secure, and we encourage users to use strong, unique passwords and to report any suspected security incident to us promptly.

8.2 In the event of a personal data breach affecting personal data for which TerraSell is the controller, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, as required by the NDPA, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights.

9. Your Rights Under the NDPA

9.1 Subject to applicable exceptions, you have the right to: (a) be informed about how your personal data is processed; (b) access the personal data we hold about you; (c) request correction of inaccurate or incomplete data; (d) request erasure of your data in certain circumstances; (e) object to certain processing, including direct marketing; (f) withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and (g) lodge a complaint with the Nigeria Data Protection Commission (NDPC).

9.2 To exercise these rights in respect of data for which TerraSell is the controller, contact us using the details in clause 13. If your data was entered into the Service by your employer or another organisation using TerraSell (i.e., TerraSell is a processor for that data), please contact that organisation directly; we will support their response to your request as required by our Data Processing Agreement with them.

10. Children's Data

10.1 The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that we have inadvertently collected such data, we will take steps to delete it.

11. Cookies

11.1 Our website and Service may use cookies and similar tracking technologies. Cookies strictly necessary for the operation of the Service are used without consent, as permitted under NDPC guidance. All other cookies (for example, analytics or marketing cookies) are used only with your prior opt-in consent, given via a cookie banner, which you may withdraw at any time through your browser or cookie preference settings.

12. Changes to This Policy

12.1 We may update this Policy from time to time. We will post the updated Policy with a revised “Last updated” date, and where a change is material, we will provide additional notice (such as an in-app notification or email).

13. Contact Us

13.1 For questions about this Policy or to exercise your rights, contact our Data Protection Officer / privacy team at privacy@terrasell.io, or by post at [Insert Registered Address]. You may also lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.