Privacy Policy
Last updated: June 2026
1. Who we are
Xurray Mart is an online marketplace operated by Xurray Mart Ltd, registered at 32/33 Coca-Cola Complex Road by Tony D Junction, Ikpoba Hill, Edo State, Nigeria. We serve buyers and sellers in the European Union and Nigeria. This policy explains how we handle your personal data under the EU General Data Protection Regulation (GDPR) and the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR). For data-protection questions, contact our Data Protection Officer at contact@xurray.com.
2. Information we collect
We collect information you provide directly (such as your name, email address, phone number, delivery address, and order details), seller verification documents where applicable, and information collected automatically (such as device and usage data through cookies) to operate and improve our services.
3. How and why we use your information (legal bases)
We use your information to process orders, verify accounts, provide delivery, send transactional and opt-in newsletter emails, prevent fraud, and improve the platform. Our legal bases are: performance of a contract (to fulfil your orders), consent (for marketing and non-essential cookies), legal obligation (tax, KYC and consumer-law duties), and legitimate interests (security and service improvement) — as recognised under both GDPR and the NDPA. We never sell your personal data.
4. Cookies and advertising
We use cookies for essential functionality and analytics. This site displays advertising served by Google AdSense. Google and its partners may use cookies to serve ads based on your prior visits, and may show personalised ads according to your preferences. You can opt out of personalised advertising via Google Ads Settings.
5. International data transfers
Because we operate in both the EU and Nigeria, your data may be transferred between these regions. Where personal data of EU/EEA residents is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. Transfers of Nigerian residents' data are carried out in accordance with the NDPA's cross-border transfer requirements.
6. Your rights
EU/EEA (GDPR): you have the right to access, rectify, erase, restrict or object to processing, data portability, and to withdraw consent at any time. Nigeria (NDPA/NDPR): you have equivalent rights to access, correction, deletion, objection, and to withdraw consent. To exercise any of these rights, email contact@xurray.com or use our Contact page. We respond within one month (GDPR) / the timeframe required by the NDPA.
7. Data retention
We keep personal data only as long as necessary for the purposes described here or as required by EU and Nigerian law (for example, tax and transaction records). When no longer needed, data is securely deleted or anonymised.
8. Data security
We use industry-standard measures including encrypted connections and secure authentication to protect your data. No method of transmission is 100% secure, but we work hard to safeguard your information.
9. Complaints
If you have concerns, contact us first. You also have the right to lodge a complaint with a supervisory authority: EU/EEA — your local Data Protection Authority; Nigeria — the Nigeria Data Protection Commission (NDPC).
10. Contact
Questions about this policy? Reach us at contact@xurray.com or via our Contact page.