Privacy policy

1. Who this policy is from

Carlots.ng ("we", "us") runs the vehicle marketplace at carlots.ng. This policy explains what personal data we collect, why we hold it, who else sees it, and what you can require of us. For the purposes of the Nigeria Data Protection Act 2023 we are the data controller for the data described here, and our regulator is the Nigeria Data Protection Commission (NDPC).

It applies to the website, to the accounts and listings on it, and to the e-mail we send you about them. It does not apply to what a buyer or seller does with information after they have contacted each other — once you share your phone number with someone, how they treat it is between you and them.

2. What we collect

When you register an account we collect and store:

• your e-mail address, which must be unique on the site and is how you sign in;
• your display name, and a username if you choose one;
• your password, stored only as a one-way hash — we cannot read it, and neither can anyone who obtains the database;
• a phone number, a landline, a website address, a postal address, a city, a region, a country and a postcode, where you supply them — all optional except as noted on the form itself;
• a profile photograph, if you upload one;
• whether the account is an individual or a business, which decides how it is presented on the site;
• the date and time you last signed in.

When you post a car we collect and store:

• the title, description and asking price, in Naira;
• the make, model, year and the technical attributes you select;
• the contact name, e-mail address and phone number you give for enquiries, which may be different from the ones on your account;
• the location of the vehicle, down to the city and area, and map coordinates where you provide them;
• up to seven photographs, each up to 50 MB, in JPEG, PNG or GIF form, and the camera and location information inside them — section 3 explains what happens to that, because the answer is not the same for the copies we publish and the copy we keep;
• the IP address the listing was posted from, together with the publication and modification times. We keep this to investigate fraud, duplicate postings and abuse; it is never shown on the site.

When you write to us through the contact form we collect the name, e-mail address, subject and message you type, and deliver them to our own inbox with your address set as the reply address so we can answer you.

When you ask to reset your password we store a single-use reset code, the time you asked, and the IP address the request came from — the last of these because a reset e-mail sent to the wrong person is the most damaging thing this site can do by accident, and we want to be able to see where a request originated.

Automatically, our servers log the requests they serve, which includes IP addresses, timestamps, the pages requested, and the browser and operating system reported by your device. Section 7 covers cookies.

We do not ask for and do not want your bank details, your BVN, your NIN, a copy of your driving licence or a photograph of your identity document. No part of this site needs them. If anyone contacts you claiming to be Carlots.ng and asks for them, it is not us.

3. Photographs and the data inside them

A photograph taken on a phone carries hidden information about the camera, and about where and when the picture was taken — usually including GPS coordinates. Two things happen to that information, and they are deliberately different.

Nothing we publish carries it. Every copy of your photograph that appears on the site, in an advert or anywhere we share it — thumbnail, gallery image and full-size image alike — is written without camera or location data. Someone who downloads a photograph from your listing cannot read where it was taken.

We keep the file you uploaded, with that information intact, privately. It is held in storage that is not reachable from the web and is not linked from anywhere, and we use it to investigate fraud: a stolen-vehicle report, the same car advertised by two different people, a photograph lifted from another seller's advert. Where and when a picture was taken is often the only thing that settles those, which is why this is a marketplace that retains it rather than discards it. We disclose it outside the company only to the police, a court or a regulator, as described in section 9.

4. Why we hold it, and on what legal basis

• To run your account and publish your listing — because that is the agreement between us. Without an e-mail address and the content of your advert there is no service to provide.
• To confirm your e-mail address before a listing goes live — our legitimate interest in a marketplace that is not full of fake adverts, and yours in one.
• To prevent fraud, spam, stolen-vehicle listings and abuse, which is why we keep posting IP addresses — our legitimate interest, and the clearest one on this page.
• To answer you when you use the contact form.
• To produce the price guides at pricing and the price checker. These are built from asking prices across many listings in aggregate; they do not identify the seller of any particular car.
• To market the site, including by showing listing content and photographs in our own advertising — see section 6 and clause 6 of the terms of use, which is where the licence to do so comes from.
• To show advertising that pays for the site, and to set the cookies advertising needs — see section 7. We rely on our legitimate interest in funding a marketplace that is free to use, and on your acceptance of this policy, which using the site signals.
• To comply with the law, and to respond to a lawful request from the police or a court.

Where we rely on your consent — marketing e-mail is the case that matters — you can withdraw it at any time, and withdrawing it does not affect anything done before you did. Where we rely on a legitimate interest, you can object, and we will stop unless we have a reason that overrides your objection, which we will explain. Cookies work differently, and section 7 says how: the choice there is one you make in your browser rather than one you make with us.

5. What we publish

A listing is a public advertisement. That is its purpose, and it means the title, description, price, photographs, vehicle attributes, city and the seller name shown on the advert are visible to anyone, indexed by search engines such as Google, and may be cached or copied by services we do not control. We cannot un-publish something from a third party's cache; we can only remove our own copy.

Your contact details are shown only if you choose to show them. Each listing carries separate switches for the e-mail address and the phone number. We suggest leaving the e-mail address hidden and using the site's enquiry route, because an address published on a web page is harvested by spammers within days.

Your account profile page shows the name and the business status on the account, and the listings it owns. Your e-mail address, postal address, postcode and password are never shown on it.

6. Using listing photographs in our own marketing

We advertise Carlots.ng using cars listed on it. In practice that means a photograph from a listing may appear on our social media channels, in paid advertising, in e-mail, on banners and in printed material, usually alongside the make, model, year, price and city, and sometimes with the seller name shown on the advert. The licence that permits this is clause 6 of the terms of use, which you accept when you post.

We do not use your account's postal address, phone number or e-mail address in marketing material. You can tell us through the contact form that you do not want your listing used this way, and we will stop and withdraw what we can — but material already printed, posted or served by an advertising platform cannot always be recalled, and we will say so plainly rather than promise otherwise.

7. Cookies and advertising

Today the site sets two cookies of its own, both necessary:

• sessionid — keeps you signed in. Set when you sign in, and removed when you sign out.
• csrftoken — proves that a form was submitted from our own page and not from an attacker's, which is what stops someone else posting a listing or changing a setting as you.

We set no analytics cookie and run no analytics tracker of our own.

The cookie notice stores one thing in your browser when you dismiss it — the date you did so, which is how the notice knows not to interrupt you again for a month. It is kept in your browser's own storage rather than in a cookie, so it is never sent to us.

Advertising. Part of what pays for Carlots.ng is advertising, including Google AdSense. Where third-party advertising runs on a page, Google and its advertising partners may read and set cookies or similar device identifiers in order to serve and measure adverts, to limit how often you see the same one, and to select adverts based on your interests and your browsing elsewhere. Whether that last one happens is governed by your own Google account settings, not by anything we collect. In doing so Google acts on its own account and not on ours, under its own advertising policies and privacy policy. You can review and switch off personalised advertising across Google's services at My Ad Center.

Using Carlots.ng means accepting the cookies described above. The notice on your first visit tells you so and links to this page; dismissing it acknowledges the notice rather than granting a permission, because there is no switch on this site that turns these cookies off and we would rather say that than offer a choice we do not honour. They are how the site keeps you signed in, how it protects its own forms, and how the advertising that pays for it is served and measured.

The choice that does exist is in your browser, which is where it genuinely sits. Every current browser can block or delete cookies, block third-party cookies alone, or clear them when you close it, and My Ad Center above switches off personalised advertising across Google's services. Note that blocking the two necessary cookies stops signing in and posting a listing from working, because they are the mechanism by which those work. If you are not willing to accept cookies on these terms, the remedy is to stop using the website.

8. Promoted listings and payments

A listing can be promoted so that it appears ahead of others. When you pay for a promotion, the payment is taken by a licensed payment provider, not by us: they receive what they need to process it, which includes your card or bank details, and they handle that data as controller under their own policy. We never see or store your full card number. What we keep is the record that a particular listing was promoted, when, for how long, and that it was paid for.

9. Who else receives your data

• Our hosting and infrastructure providers, who store the database and the photographs on our instructions.
• Our e-mail provider, which delivers confirmation, password-reset and contact-form messages.
• Payment providers, for promoted listings, as described above.
• Google, as the advertising provider described in section 7.
• The police, a court or a regulator, where we are required to disclose something or where we believe disclosure is necessary to prevent a crime — vehicle fraud and stolen-vehicle listings being the cases that arise here.
• A buyer of the business. If Carlots.ng is sold or merged, or its assets are transferred, the accounts and listings transfer with it, and the buyer may use the data only as described in this policy until it tells you otherwise.

We do not sell your personal data, and we do not share your e-mail address or phone number with advertisers or data brokers.

10. Data leaving Nigeria

Some of the providers above operate outside Nigeria, so your data may be stored or processed abroad. Where that happens we transfer it only on a basis the Nigeria Data Protection Act 2023 permits — which in practice means a recipient under laws or binding commitments that protect the data adequately, or your explicit consent.

11. How long we keep it

• Your account — for as long as it exists, and then as described below when you ask us to delete it.
• A listing — it is published until it expires, which by default is a year after posting, and some categories are shorter. After it expires we keep the record so that the aggregate price history stays accurate and so that a dispute about a past sale can be investigated.
• Posting and reset IP addresses, and server logs — only as long as they are useful against fraud and abuse.
• The private copy of an uploaded photograph (section 3) — for as long as the listing is on the site, and afterwards for as long as a dispute or a fraud report about it could still be raised.
• Password-reset codes — a short window, after which the code stops working whether it has been used or not.
• Contact-form messages — kept in our inbox as correspondence.

12. Your rights

Under the Nigeria Data Protection Act 2023 you may ask us to:

• show you the personal data we hold about you, and tell you where it came from and who has received it;
• correct anything inaccurate — most of it you can correct yourself in your account;
• delete your data, including your account and your listings;
• restrict or object to a particular use, including our use of listing content in marketing;
• give you a copy of what you gave us, in a form you can take elsewhere;
• withdraw a consent you previously gave.

Ask through the contact form from the e-mail address on the account, and we will act without undue delay. Two honest limits: deleting your account does not remove a listing's content from a search engine's cache or from somewhere a third party has already copied it, and we may keep the minimum needed to meet a legal obligation or to stop a banned account simply registering again.

If you are not satisfied with how we have handled a request, you can complain to the Nigeria Data Protection Commission. We would rather you came to us first, but you are not obliged to.

13. Keeping it safe

Passwords are stored as one-way hashes, the site is served over HTTPS, session and form-security cookies are marked so that a browser will not send them over a plain connection or expose them to scripts, and access to the database is limited to the people who need it. No website can promise that it will never be breached, and we are not going to be the first to claim it. If a breach affects your personal data in a way that puts you at risk, we will tell you and the NDPC as the Act requires.

14. Age

Carlots.ng is for adults. You must be at least 18 to register, post a listing or pay for a promotion, and we do not knowingly collect data from children. If you believe a child has registered, tell us and we will remove the account.

15. Changes to this policy

When this policy changes, the date at the top of the page changes with it, and the previous wording stays in our version history. If a change materially affects how we use data you have already given us — a new purpose, a new category of recipient — we will say so prominently on the site rather than rely on you re-reading this page.

Getting in touch

Questions about this page, requests about your own data, and reports about a listing or a photograph all reach us the same way: through the contact form. It helps to tell us the URL of the listing or account involved.

See also our terms of use, which cover the licence your listing photographs carry.