1. Who we are
Sourcelio is an online marketplace operated by Sourcelio Ltd(“Sourcelio”, “we”, “us”). Shoppers buy food and goods from independent vendors, and vendors run their shops, through our website, our web app and our vendor dashboard (together, the “Services”).
We are the controller of the personal information described in this policy. If you have a question about it, or want to use any of your rights, contact us at support@sourcelio.com.
2. Information we collect
Information you give us
- Account details: your name, email address, phone number and password, and, if you choose to give them, your date of birth and gender.
- Addresses: delivery addresses you save, and the address you pick when you search for a location.
- Orders: what you buy, from whom, prices, delivery details and order history. Guests who check out without an account give us a name, email address and delivery address.
- Support and messages: what you write to us in support requests, reviews and messages.
Additional information from vendors
- Business details: shop name, business type, business address, product categories, logo and banner.
- Identity verification (KYC): the documents required in your country, such as a government ID or business registration, and the information on them.
- Payout details: bank name, account holder, account number and sort or routing code. After you save them we only ever show the last four digits.
Information collected automatically
- Sign-in and security data: the devices and browsers you sign in from, IP addresses and session history. We use these to keep your account secure and to show you your active sessions.
- Usage of the Services: pages and features used, notifications you read, and error logs.
Information from others
- Sign-in providers: if you sign in with Google, we receive your name, email address and profile photo from Google.
- Payment providers: payment status, a reference and the last digits or type of your payment method. We never see or store your full card number.
- Delivery partners: tracking and delivery status for your parcels.
3. How we use your information
| Purpose | Legal basis |
|---|---|
| Creating and running your account, taking payments, passing orders to vendors and arranging delivery | Performance of our contract with you |
| Sending service emails and notifications: sign-in codes, order confirmations and dispatch updates, payout and verification results, support replies | Performance of contract |
| Verifying vendors’ identity and business, and paying vendors | Legal obligation and our legitimate interest in a safe marketplace |
| Keeping accounts secure and preventing fraud, for example alerting you to new sign-ins and stopping reused session tokens | Legitimate interests |
| Answering support requests and resolving disputes, refunds and returns | Performance of contract and legitimate interests |
| Improving the Services, fixing errors and understanding how features are used | Legitimate interests |
| Keeping financial and tax records | Legal obligation |
We do not sell your personal information, and we do not use it for advertising profiles. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Vendor applications are reviewed by a person.
5. International transfers
We operate in Nigeria and the United Kingdom, and some of our service providers process data in other countries, including the United States and the European Union. Where information leaves the UK or Nigeria, we rely on adequacy decisions, standard contractual clauses or other safeguards recognised by the applicable law.
6. How long we keep it
- Account information is kept while your account is open. When you ask us to delete your account, we delete or anonymise it, except what we must keep.
- Order, payment and payout records are kept for as long as tax and accounting law requires, typically six years.
- Vendor verification documents are kept while the shop is active and for a limited period afterwards, to meet anti-fraud and legal obligations.
- Security logs and session history are kept for a short period, then deleted.
7. Your rights
Depending on where you live, including under the UK GDPR and the Nigeria Data Protection Act 2023, you have the right to:
- access the personal information we hold about you;
- correct anything that is wrong;
- ask us to delete it;
- ask us to restrict how we use it;
- object to our use of it;
- receive a copy of it in a portable format;
- withdraw consent where we rely on it.
You can update most details yourself in your account settings, and request account deletion from the app. For anything else, email support@sourcelio.com. We will reply within one month.
If you are unhappy with how we have handled your information, you can complain to the UK Information Commissioner’s Office (ico.org.uk) or the Nigeria Data Protection Commission (ndpc.gov.ng). We would appreciate the chance to resolve it first.
9. Security
We protect your information with encryption in transit, hashed passwords, short-lived access tokens, alerts for new sign-ins and the ability to sign out other devices. Bank details are masked, and access is limited to staff who need it. No system is perfectly secure: please use a strong, unique password, and tell us at support@sourcelio.com if you think your account has been compromised.
10. Children
The Services are not for children under 18. Vendors must be at least 18. If you believe a child has given us personal information, contact us and we will delete it.
11. Changes to this policy
We may update this policy. When we make an important change, we will tell you by email or in the app before it takes effect. The date at the top shows when it last changed.
12. Contact us
Questions or requests about your personal information: support@sourcelio.com, or use the contact page.