Legal
Privacy Policy
Last updated: 25 May 2026 · Effective: 25 May 2026
Sokofa Ltd is committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, how we use it, and what rights you have under UK and EU data protection law.
Who We Are
Sokofa Ltd (“Sokofa”, “we”, “us”, or “our”) is the data controller responsible for the personal data processed through sokofa.com and our associated apps and services.
Sokofa Ltd — Data Controller
Email: privacy@sokofa.com
Address: 24 Halmyre Street, Edinburgh EH6 8QD, United Kingdom
We are registered as a data controller with the UK Information Commissioner's Office (ICO). Our ICO registration number is available on request.
Data We Collect
We collect personal data in the following categories, depending on how you interact with Sokofa:
Buyers
- Account information: name, email address, phone number, password (stored as a one-way hash)
- Order & shipping data: delivery address, billing address, order history, item preferences
- Payment data: processed exclusively by our payment providers (Stripe and Paystack). We do not store card numbers or bank credentials.
- Wishlist & cart data: products saved or added to cart during a session
- Reviews: written feedback and ratings you leave on products
- Device & usage data: IP address, browser type, pages viewed, referral source, time on site (via cookies and analytics tools)
Sellers (Vendors)
- Business information: store name, store description, profile photo, location, social media handles
- Identity verification: government-issued ID and certification documents uploaded during onboarding
- Product data: product listings, images, descriptions, pricing, stock levels
- Bank account information: used for vendor payouts; stored encrypted
- Sales & analytics: order history, revenue figures, commission calculations
- Social connections: see the Social Storefront & Instagram section below
All users
- Communications: emails, support tickets, WhatsApp messages, and push notifications you send to or receive from us
- Technical logs: server request logs, error reports, and security event data retained for up to 90 days
How We Use Your Data
| Purpose | Data used |
|---|---|
| Processing & fulfilling orders | Name, address, order details, payment confirmation |
| Account creation & management | Email, name, password hash |
| Seller onboarding & verification | ID documents, bank details, store info |
| Customer support | Communications, order history, account details |
| Sending transactional emails & notifications | Email, phone, push notification tokens |
| Marketing & promotional messages (opt-in only) | Email, name, purchase history |
| Platform analytics & improvements | Usage data, device data |
| Fraud prevention & security | IP address, login events, payment signals |
| Legal compliance | Any data required by applicable law |
| Social Storefront feature | Instagram OAuth token, post content, import history |
Legal Basis for Processing (UK GDPR)
Under UK GDPR and the Data Protection Act 2018, we rely on one or more of the following lawful bases for each processing activity:
- Contract performance — processing necessary to fulfil orders, manage your account, and deliver our services to you
- Legitimate interests — fraud prevention, platform security, product analytics, and improving our services, where our interests are not overridden by your rights
- Legal obligation — complying with tax law, accounting requirements, and court orders
- Consent — marketing emails, non-essential cookies, and social media integrations. You can withdraw consent at any time.
Your Rights
Under UK GDPR and the Data Protection Act 2018, you have the following rights:
Right of access
Request a copy of all personal data we hold about you (subject access request).
Right to rectification
Ask us to correct any inaccurate or incomplete data.
Right to erasure
Request deletion of your data where there is no overriding legal reason to keep it ("right to be forgotten").
Right to restriction
Ask us to pause processing your data in certain circumstances.
Right to data portability
Receive your data in a structured, machine-readable format.
Right to object
Object to processing based on legitimate interests, including profiling for direct marketing.
Right to withdraw consent
Withdraw consent to marketing or cookies at any time without affecting prior processing.
Rights related to automated decisions
Not to be subject to decisions made solely by automated processing that significantly affect you.
To exercise any of these rights, email privacy@sokofa.com. We will respond within 30 days. We may ask you to verify your identity before acting on a request.
Data Retention
| Data type | Retention period |
|---|---|
| Active customer account data | Retained while account is active |
| Inactive customer accounts | Archived after 24 months of inactivity, deleted after 36 months |
| Order records | 7 years (UK tax and accounting law) |
| Payment records | 7 years (financial regulation) |
| Vendor identity documents | Duration of seller relationship + 5 years |
| Instagram OAuth tokens | Until disconnected or token expires (max 60 days); revoked tokens deleted within 30 days |
| Social import records | Retained with vendor account; deleted if vendor account is closed |
| Marketing consent records | Retained until consent is withdrawn + 3 years |
| Server & security logs | 90 days |
| Analytics data (anonymised) | 26 months (Google Analytics default) |
Data Security
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, or unauthorised access. These include:
- Encryption in transit: all data exchanged with sokofa.com is protected by TLS/HTTPS
- Encryption at rest: database and file storage encrypted with AES-256
- Access control: row-level security policies restrict database access; sensitive fields (tokens, bank details) are accessible only to server-side processes
- Password hashing: all passwords are stored as bcrypt hashes (12 salt rounds); plaintext passwords are never stored
- Service role isolation: our server uses a Supabase service role key — never exposed to browser clients
- Security monitoring: automated alerting for unusual login patterns and data access
Despite these measures, no method of transmission over the internet is 100% secure. If you believe your account has been compromised, contact us immediately at security@sokofa.com.
International Data Transfers
Sokofa is a UK company that operates a global marketplace. As a result, your data may be transferred to and processed in countries outside the UK and European Economic Area (EEA), including Nigeria (for Paystack payment processing) and the United States (for Vercel hosting and Meta/Instagram services).
Where we transfer data internationally, we ensure appropriate safeguards are in place, including:
- Adequacy decisions by the UK Secretary of State (where applicable)
- Standard contractual clauses (SCCs) approved by the ICO or European Commission
- Data processing agreements with all processors
Children's Privacy
Sokofa is not directed at children under the age of 13. We do not knowingly collect personal data from anyone under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact privacy@sokofa.com and we will delete the data promptly.
Sellers connecting the Social Storefront Instagram feature must be at least 18 years old, in line with Meta's terms of service.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, technology, or legal requirements. When we make a material change, we will:
- Update the “Last updated” date at the top of this page
- Send an email notification to registered users if the change significantly affects how we use your data
- Where required, seek fresh consent before using your data in a new way
We encourage you to review this policy periodically. Continued use of Sokofa after a change is posted constitutes acceptance of the updated policy.
Contact & Complaints
For any questions, requests, or concerns about this Privacy Policy or how we handle your data:
Sokofa Ltd — Data Controller
Email: privacy@sokofa.com
Address: 24 Halmyre Street, Edinburgh EH6 8QD, United Kingdom
If you are not satisfied with our response, or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Social Storefront & Instagram Data
Sokofa offers a Social Storefront feature that allows sellers to connect their Instagram account and import product posts directly into their Sokofa shop. This section explains exactly what data is collected, how it is used, and how to disconnect at any time.
What we access when you connect Instagram
When a seller authorises Sokofa via Instagram/Meta OAuth, we request the following permissions:
We do not request permission to post, comment, send messages, or take any action on your Instagram account. We only read your media.
Data stored when you connect Instagram
Data stored when you import posts
When you choose to import posts from Instagram, we store the following for each imported post:
How we use this data
We do not use your Instagram data to train machine-learning models, sell to third parties, or display your Instagram content publicly anywhere outside your vendor dashboard.
Token storage and security
Your Meta OAuth access token is encoded and stored in our database, which is protected by Supabase row-level security, encrypted at rest (AES-256), and accessible only to server-side processes under your vendor account. It is never exposed in API responses or browser-side code.
Tokens expire automatically after 60 days. When a token expires, we update the connection status to “expired” and prompt you to reconnect. Expired tokens are not used to make any requests.
How to disconnect Instagram
You can revoke Sokofa's access to your Instagram at any time by:
Disconnecting removes the stored access token and marks the connection as revoked. Your imported posts and any product drafts created from them remain in your vendor account until you request their deletion (see below).
How to request deletion of your Instagram data
You can request that Sokofa permanently deletes all data collected through the Instagram connection — including your OAuth token, connection record, imported post data, and any analytics events linked to your Instagram account — at any time. Product drafts created from imported posts are also deleted unless they have already been published, in which case they become standard Sokofa product records.
There are two ways to make a deletion request:
After deletion is confirmed, your Instagram data will be permanently removed from Sokofa's live database. Encrypted backups are purged within 90 days in line with our backup rotation schedule.
Meta / Facebook data policy
When you use the Instagram connection feature, your interaction with Meta's OAuth is also governed by Meta's own privacy policy: facebook.com/privacy/policy. Sokofa is not responsible for Meta's data practices.