Privacy Policy

Roots & Roast Agro Ltd ("we", "us") is the data controller for the personal data described in this policy. We are a Nigerian company sourcing and exporting agricultural commodities, with our office in Lagos, Nigeria.

For any question about this policy or your personal data, write to info@randragro.com. If we appoint a Data Protection Officer, their contact details will be published here.

We collect the following categories of personal data:

Account identity

Your name, work email address and, if you give it, a phone number. We use your email address to sign you in, and your contact details to reach you about trades.

Company and verification

Your company's legal details, signatory details, bank details and the documents you upload to verify the business.

Trade records

Requests, proposals, acceptances, trades, quality results, shipment details, payments, documents and messages.

Security data

Session details such as IP address and browser, one-time code logs that store hashed identifiers, and audit events.

Marketing enquiries

The details you send us through the contact form or by email.

Email delivery

The notifications we send you and their delivery status.

We process personal data for these purposes:

• To create and run your account and your trades, and to perform any contract we enter with you (performance of a contract).
• To verify your business before binding trades (contract and our legal obligations).
• To keep accounting, tax and export records (legal obligation).
• To prevent fraud and abuse, and to keep the service secure (our legitimate interests).
• To answer quote or sample requests you send us (our legitimate interests, before a contract).
• To send the emails you need to sign in and to follow your trade (performance of a contract).

We share personal data with the service providers that run R&R Trade. They process it only on our instructions:

Postmark (ActiveCampaign)

Email delivery, United States.

Hosting provider

Application hosting, country confirmed on request.

Backblaze (off-site backups)

Encrypted backups, region confirmed on request.

When personal data leaves Nigeria, we rely on a transfer basis in the Nigeria Data Protection Act 2023, such as your consent or the performance of a contract. Postmark processes email in the United States. Our hosting and backup provider locations are confirmed when those services are set up.

We keep personal data only as long as we need it. These periods are drafts until the client sign-off described on this page is complete:

Account identity

While your account exists. Anonymised when you delete your account.

Company and verification

While your account exists, then retained with your trade records as below.

Trade records

Six years after the trade completes (draft period, pending review).

Security data

Sessions until they expire or you sign out, one-time code logs for 90 days, audit events with the related trade.

Marketing enquiries

24 months from your last contact with us (draft period).

Email delivery records

12 months (draft period).

Under the Nigeria Data Protection Act 2023 you have the right to access your data, to have it corrected, to have it erased, to restrict or object to its use, to receive a portable copy, and to withdraw consent where consent is the basis.

To exercise any right, write to info@randragro.com. We answer within 30 days. You can also delete your account yourself from the account page.

You can ask to delete your account at any time. If a trade is still open we cannot delete the account until it closes, and the page tells you so. Once deletion completes: your sessions end, your profile is anonymised, and your sign-in identifiers are removed.

Trade records, proposals and acceptances are kept as required by law, no longer linked to your name. Requests that never became a trade are withdrawn.

Go to account deletion

We use only the cookies that are strictly necessary to run the service. There is no cookie banner because we do not use analytics or advertising cookies.

better-auth.session_token

Keeps you signed in. Expires when your session ends.

rr_claim

Matches a request you submitted before signing in. 7 days.

rr_pending_identity

Remembers the address a sign-in code was just sent to. 15 minutes.

Adding analytics later would require a consent mechanism and a change to this policy.

We sign you in with one-time codes instead of passwords, encrypt data in transit with HTTPS, store uploads outside the web root, and restrict administrative access. No system is perfectly secure: if a breach puts you at risk, we will notify you without undue delay.

R&R Trade is a business service and is not directed at anyone under 18. We do not knowingly collect personal data from children.

If you are unhappy with how we handle your personal data, write to info@randragro.com first so we can put it right. You can also complain to the Nigeria Data Protection Commission at ndpc.gov.ng.

This policy is a draft and is under legal review. When it is approved we will publish the effective date here. If a change matters to you, we will tell account holders by email.