About this policy
This policy explains how MANDE ("we", "us") collects and uses personal information when you visit our website, create a maker account, book time on our furniture machines, receive our emails, see our adverts or contact us. MANDE is the data controller for this information.
We handle personal information in line with the Nigeria Data Protection Act 2023 and the regulations made under it.
What we collect
Your account: your name, email address, phone number, date of birth, profile photo and password. Passwords are stored in a form that cannot be read back, not as you typed them.
Your business: your company name and address, team size, specialities, production lead time and materials, and on the Workshop and Studio plans your company tax number and business licence number.
Your identity: your NIN and a photo of your NIN card. Your NIN is stored encrypted, and only its last 4 digits are shown again.
Bank and payment details: the bank account you are paid into (the account number is stored encrypted, and the account name comes from your bank), and your plan and wallet transactions. When you save a card, the card details are held by our payment partner, never by MANDE. We keep only the card brand, its last 4 digits, its expiry date and an encrypted token that lets us charge it for renewals.
Your work: job applications, proof photos and notes, delay requests, ratings and reviews, appeals and their attachments, and your points and rank.
Machine bookings: your name, email, phone number and address, what you are making, the machines and times you book, a photo or scan of your government ID, and your payment reference.
Messages: what you send us through the contact form (your name, email, phone number if you give one, topic and message, and when you agreed to this policy) and feedback from your dashboard, including any screenshot.
Marketing choices: whether you have agreed to marketing emails, and whether you open or click on them.
How you use our website (with your consent): the pages you visit, what you click, how you arrived (for example from an advert or a search), your browser and device, and your approximate location worked out from your IP address. This comes from cookies and similar technologies, explained in our Cookie policy.
Security information: your IP address and browser or device details, which we keep with your login sessions and in our security logs.
How we use it
We use your information, and rely on these legal grounds, to:
- run our agreement with you: create and run your account, offer and manage jobs, pay you, take plan and booking payments, and provide support
- meet our legal duties: verify identities, keep financial records and respond to lawful requests from authorities
- protect MANDE and our users (our legitimate interests): keep accounts secure, prevent fraud and misuse, review the quality of work and improve our service
- with your consent: reply to your messages, send you marketing emails, measure how our website is used, and show and measure our adverts on other platforms
You can withdraw your consent at any time. That stops the use from then on, but does not affect what was done before. We do not sell your personal information.
Identity checks
To verify makers, we send your NIN, name and date of birth to our verification partner, Youverify, which checks them against the national identity records. On the Workshop and Studio plans, we also check your company registration details with them. Our team reviews the photo of your NIN card by hand.
We do these checks to keep MANDE safe for makers and customers, and because our payment partners require us to know who we're paying.
Analytics and advertising
With your consent, we use tools from Google, Meta (Facebook and Instagram) and TikTok to understand how people use our website and to show and measure our adverts:
- Google Analytics tells us how many people visit, which pages they use and where they came from, so we can improve the website.
- Google Tag Manager lets us manage these tools in one place. It loads them only when you have agreed to them.
- Meta Pixel and TikTok Pixel tell us when someone who saw or clicked our advert on Facebook, Instagram or TikTok visits our website or takes an action, such as signing up or booking. This helps us measure our adverts and show them to people who are likely to be interested, including people similar to our makers.
These tools can receive your IP address, browser and device details, the pages you visit and the actions you take on our website. When you sign up, book or contact us, we may also send a scrambled (hashed) form of your email address or phone number so the platform can match the action to its own users. The scrambled form cannot be turned back into your details by people reading it.
Google, Meta and TikTok may also use this information for their own purposes, under their own privacy policies. You can choose which tools to allow, and change your mind at any time, as explained in our Cookie policy. You can also manage the adverts you see in your Google, Facebook, Instagram and TikTok ad settings.
Marketing emails
We send marketing emails, such as news, tips for makers, offers and new features, only if you've agreed to receive them, for example by ticking the box when you sign up or book. We use an email marketing service to send them, which receives your name, email address and the choices you've made.
Our marketing emails may tell us whether you opened them and which links you clicked, so we can make them more useful. Every marketing email has a link to unsubscribe, and you can also contact us to stop them. Unsubscribing does not stop the emails you need about your account, jobs, payments, bookings and security.
With your consent, we may also use your email address in scrambled form to show you our adverts on Google, Facebook, Instagram or TikTok, or to keep them from showing to existing makers.
Who we share it with
We share personal information only where it is needed, with:
- Payment partners (Paystack and Flutterwave): to take payments, save cards, check bank account names, send withdrawals and make refunds
- Youverify: for identity and company checks
- Cloudinary: which stores the files you upload. ID documents, NIN cards, business documents, appeal files and screenshots are stored privately, and our staff can only open them through links that expire after 5 minutes.
- Our hosting and email providers: our database (MongoDB Atlas), our servers, Cloudflare, which protects and delivers our website, the email service that sends our account emails and our email marketing service
- Google, Meta and TikTok: for analytics and advertising, only with your consent
- DiceBear: if you have no profile photo, your name is sent to DiceBear to draw a placeholder picture with your initials
- Professional advisers: such as lawyers and accountants, where they need it to advise us
- A new owner: if MANDE is reorganised, merged or sold, in which case this policy continues to protect your information
- Authorities: when the law requires it, or to protect the rights and safety of MANDE, our users or others
Our service providers may only use your information to provide their service to us, except where this policy says otherwise.
Information sent outside Nigeria
Some of our providers, including Google, Meta, TikTok, Cloudinary, MongoDB Atlas and Cloudflare, store or process information outside Nigeria. When they do, we make sure there is a lawful basis for the transfer and that your information is protected to the standard the Nigeria Data Protection Act requires, for example through contract terms with the provider.
What's shown publicly
Open jobs are listed on our website and can appear in search engines. With your agreement under our terms, we may show photos of finished work, your company name and a customer's review on our website, social channels and adverts. Your NIN, ID documents, contact details and bank details are never shown publicly.
Automated decisions
Some decisions on MANDE are made automatically, following set rules: your points and rank are calculated from your jobs and ratings, finished work that is not reviewed in time is signed off automatically, and job alerts are sent based on your specialities. None of these decide whether you can use MANDE.
Decisions with serious effects, such as rejecting work, flagging or suspending an account, or verifying your identity, are made or reviewed by our team. You can ask for any decision to be looked at by a person, dispute a rejected delivery, or appeal a suspension.
Who at MANDE can see it
Only MANDE staff who need your information for their role can see it: for example, your project lead sees your jobs, and our verification team sees your NIN card. Staff access to wallets and sensitive actions is recorded in an audit log.
How long we keep it
- Account, job and payment records are kept while your account is open, and afterwards for as long as the law requires us to keep business and financial records (generally at least six years).
- Machine booking records, including the ID you uploaded, are kept as part of our business records. You can ask us to delete your ID once your booking is completed.
- Marketing information is kept until you unsubscribe or ask us to delete it. We keep a note that you unsubscribed, so we do not email you again.
- Website analytics information is kept for up to 14 months.
- Notifications are deleted after 180 days, and security and activity logs after 365 days.
- Login sessions end after up to 30 days. Verification codes expire within minutes. Uploads that are never attached to anything are deleted after 24 hours.
When an account is closed, we stop using it and keep only what we need for these purposes.
Your rights
Under the Nigeria Data Protection Act 2023, you have the right to:
- be told how your personal information is used, as this policy does
- ask for a copy of the personal information we hold about you
- correct information that is wrong or incomplete (you can update most of it yourself in Settings)
- ask us to delete your information, where we no longer need to keep it
- object to, or ask us to restrict, how we use your information
- object to marketing at any time, which we will always respect
- receive your information in a format you can take elsewhere
- withdraw your consent where we rely on it
- not be subject to a decision based only on automated processing that has a serious effect on you
To use any of these rights, email hello@mande.com.ng. We may need to confirm your identity first, and we will reply within 30 days. If you are unhappy with how we handle your information, you can complain to the Nigeria Data Protection Commission.
How we protect it
We encrypt your NIN, bank account number, saved-card tokens and two-step verification settings, keep ID documents in private storage, and send everything over secure connections. You can turn on two-step verification for your account, and withdrawals need your password and a one-time code.
No system is completely secure. If you think your account or information is at risk, contact us straight away. MANDE will never ask for your password or a one-time code.
If something goes wrong
If a breach of security puts personal information at risk, we will report it to the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as the law requires. If it is likely to put you at high risk, we will tell you without delay, with what happened and what you can do to protect yourself.
Cookies
We use essential cookies to keep you signed in and to remember your choices. We use analytics and advertising cookies and pixels only if you agree to them. Our Cookie policy lists them and explains how to change your choices.
Other websites
Our website and emails link to other websites and services, such as our payment partners and social media pages. Their own privacy policies apply when you use them.
Children
MANDE is not for anyone under 18, and we do not knowingly collect information about children. If you think a child has given us their information, contact us and we will delete it.
Changes to this policy
We will update this policy when we change how we handle personal information, and tell you about significant changes by email or in your dashboard. The date at the top shows when it last changed.
Contact us
For anything about your personal information, email hello@mande.com.ng with "Data protection" in the subject line, and it will go to the person responsible for data protection at MANDE. We're available Monday to Saturday, 8am to 6pm (WAT).