Privacy Policy | Crellab

1. Introduction

Crellab ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform. It complies with the Nigeria Data Protection Regulation (NDPR) 2023.

2. Information We Collect

Personal identification information (name, email address, phone number)
Profile information (bio, portfolio, work samples, service packages)
Payment information (processed securely through Paystack)
Communication data (messages between users)
Usage data (pages visited, features used)
Device and browser information

3. How We Use Your Information

To provide and maintain our marketplace platform
To process transactions and manage escrow payments
To communicate with you about bookings and platform updates
To improve our services and user experience
To comply with legal obligations
With your consent, to send marketing communications

4. Legal Basis for Processing (NDPR)

Under NDPR 2023, we process your personal data based on the following lawful bases:

Consent: You have given clear consent for us to process your data for specific purposes (e.g., marketing, analytics). You may withdraw consent at any time.
Contract: Processing is necessary for the performance of a contract with you (e.g., facilitating bookings, processing payments).
Legal obligation: Processing is necessary for compliance with legal obligations.
Legitimate interests: Processing is necessary for our legitimate interests (e.g., fraud prevention, platform improvement).

5. Data Subject Rights

Under NDPR 2023, you have the following rights:

Right to be informed: We provide this Privacy Policy to inform you of our data practices.
Right of access: You can request a copy of your personal data via the Account Export feature.
Right to rectification: You can update your profile information at any time.
Right to erasure: You can request deletion of your account. Financial records will be anonymised rather than deleted to comply with legal retention obligations.
Right to restrict processing: You can request that we restrict processing of your data.
Right to data portability: You can export your data in a structured, machine-readable format.
Right to object: You can object to processing based on legitimate interests or direct marketing.

6. Data Retention

We retain your personal data only as long as necessary to provide our services and comply with legal obligations. Financial records are retained for a minimum of 6 years to comply with Nigerian tax and regulatory requirements. When you delete your account, personal data is anonymised while financial records are retained in anonymised form.

7. Data Sharing and Third Parties

We may share your data with:

Paystack: Payment processing and escrow services
Cloudinary: Video and image hosting
Mux: Video streaming
Google Drive: Portfolio sync (with your explicit consent)
Supabase: Database hosting with row-level security
Resend: Email delivery

We do not sell your personal data to third parties. All third-party data processors are contractually bound to comply with NDPR requirements.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption at rest and in transit, row-level security policies on our database, and access controls. However, no method of transmission over the Internet is 100% secure.

9. Cookies

We use essential cookies for authentication and platform functionality. Analytics cookies are used only with your consent. You can manage your cookie preferences through our cookie consent banner.

10. Contact Us

For questions about this Privacy Policy or to exercise your NDPR rights, please contact our Data Protection Officer at support@crellab.com.