Cojude International Limited ("COJUDE", "we", "us") respects your privacy. This policy explains what personal data we collect, why, how we protect it, and the choices and rights you have under the Nigeria Data Protection Act 2023 (NDPA) and other applicable law.
1. Who we are
Cojude International Limited is a fast-moving consumer goods (FMCG) distribution company registered in Nigeria (RC 1765170 — Companies Commission registration number; TIN 2521410923133 — tax identification number), with its office at 3 Temple Avenue, Okpara Avenue, Enugu, Enugu State. For any privacy question or request, contact us at sales@cojude.com.
2. The information we collect
- Business & contact details — your name, business name, role, phone number, email and delivery address when you become a customer, partner, supplier or job applicant, or submit a form on this website.
- Order & transaction records — the products you order, delivery details, invoices, and the bank-transfer reference used to match your payment (field sales staff never collect cash; customers pay to a COJUDE bank account). Where you buy at one of our retail counters and pay cash, we record the takings, not your card or account details.
- Communications — messages you send us by WhatsApp, email, phone or our portals, and our records of them, including voice notes you send us on WhatsApp and the transcript we make of them.
- Identity documents — for investors, the identity and address documents we are asked to hold before we accept money; for staff, national identity and bank verification numbers, which are encrypted in our database.
- Next of kin and guarantors — names and phone numbers of next of kin (staff and investors) and of guarantors, given to us by the person they relate to.
- Photographs and signatures — the photograph and signature taken at the door when we deliver to you, and photographs of shop fronts taken when a shop is added as a customer.
- Location — the map point of a shop or delivery address, and the location our field staff record when they visit or deliver. We do not track a customer's phone.
- Other people's phone numbers — when a customer or staff member refers a friend or business to us, we hold the phone number they give us for that person.
- Website usage — basic, aggregated page-view information to keep the site working and improve it. We do not run third-party advertising trackers. Pages with an embedded map load it from Google, which receives your IP address when it loads.
- Recruitment data — if you apply for a role, the information in your application and any documents you provide.
- Speak-Up reports — if you use our Speak-Up channel, what you tell us. Anonymous is the default: a report filed on the public form stores no IP address and no browser details with it, and is read by the Managing Director. Any contact details you choose to add are encrypted.
3. How and why we use it
- To take, deliver and invoice your orders, and to reconcile your payments accurately.
- To provide customer, supplier and partner support and run your account portal.
- To send you service messages (order and delivery updates) and — only with your consent — marketing about products, prices and offers.
- To meet our legal, tax and regulatory obligations — for example invoicing through the Federal Inland Revenue Service's e-invoicing system (FIRS/eFIRS) and the Corporate Affairs Commission (CAC) filing requirements.
- To protect our business against fraud and to keep accurate, audit-grade records.
- To decide how much credit to extend to a customer and to review that credit every night (see “Automated decisions” below).
4. Our lawful basis
Depending on the situation, we process personal data on the basis of: performance of a contract (fulfilling your orders); your consent (marketing messages); compliance with a legal obligation (tax and statutory records); and our legitimate business interests (fraud prevention, service improvement), balanced against your rights.
5. Marketing & your choices
We only send marketing messages on the channels you agree to (WhatsApp and/or SMS), and our email newsletter only after you click the confirmation link we send to your address. Delivery and order-status messages are not marketing and continue regardless. You can withdraw consent at any time by replying STOP, or by asking us to stop; we put your number on our do-not-disturb list, and every outgoing message is checked against that list before it is sent.
6. When we share data
We never sell your personal data. We share it only as needed to run the business: with the manufacturers whose brands we distribute (for example, aggregated sell-through, where required by our distribution agreements); with logistics and delivery partners to fulfil your orders; with our bank for payment reconciliation; with the companies listed in the next section, which process data for us; and with regulators or authorities where the law requires it, including the Federal Inland Revenue Service's e-invoicing system.
7. Companies that process data for us, and transfers outside Nigeria
Some of these companies are based outside Nigeria, so your data can leave the country when we use them. This list covers every provider our software can send personal data to, including those we have built but not yet switched on: a message rail, the card rail and the bank feed send nothing until they are switched on.
| Company | What we use it for | Personal data that reaches it | Based in | What we do to limit it |
|---|---|---|---|---|
| Anthropic | Our AI assistant: drafting, reading scanned documents, scoring job applications, turning dictated orders and bank-statement lines into suggestions. | Prompt text; document images; dictated orders; bank-statement narrations; job-application text. | United States | Text prompts have phone numbers, email addresses, street addresses, account numbers and national identifiers removed before they are sent. Some inputs are sent as written because the task needs them: dictated orders, the Managing Director's dictation, bank-statement narrations and document images. Job applications are scrubbed field by field. |
| DeepSeek | Backup engine for text prompts when Anthropic cannot answer. | Scrubbed prompt text only. | China | Text prompts have phone numbers, email addresses, street addresses, account numbers and national identifiers removed before they are sent. |
| OpenAI | Speech-to-text for voice notes (the fallback after Google), the Managing Director's voice memos, image reading and text embeddings. | Voice recordings; images; short text passages. | United States | Used only after the first choice fails or for the tasks named. Audio is sent as recorded; we do not scrub a recording. |
| Speech-to-text for customers' WhatsApp voice notes, reading document images, turning addresses into map points and route times, and the maps embedded on some of our pages. Search-index notices carry page addresses only. | Voice recordings; document images; delivery and shop addresses and coordinates; the visitor's IP address when an embedded map loads. | United States | Addresses and coordinates are sent for the lookup only. A map on one of our pages is loaded by your browser, so Google sees your IP address when it loads. | |
| Meta Platforms (WhatsApp Business) | Sending and receiving WhatsApp messages with customers, when that rail is switched on. | Your phone number, the messages and any voice note, image or document you send. | United States | Marketing messages go only to people with a recorded consent; replying STOP withdraws it. Messages are sent only when the WhatsApp connection is switched on. |
| Mapillary (street-level photos) | Letting a supervisor look at street photos around a shop's registered map point to check the shop is where it was recorded. | The shop's map coordinates. | Outside Nigeria (owned by Meta Platforms) | Only a small box of coordinates is sent; no name, phone number or account detail. |
| Twilio | An alternative route for SMS and WhatsApp messages. | Your phone number and the message text. | United States | Used only when that route is selected in our settings. |
| Termii | Sending SMS messages in Nigeria. | Your phone number and the message text. | Nigeria | SMS marketing goes only to people with a recorded consent. |
| Resend (email delivery) | Sending email through an HTTPS relay when our own mail server route is blocked. Otherwise email goes through the SMTP relay named in our settings; the Data Protection Officer will name it on request. | Your email address and the message. | United States | Used only when that route is selected in our settings. |
| Telegram | Free order-status and pickup-code messages to people who have linked Telegram, when that channel is switched on. | Your Telegram chat identifier and the message. | Outside Nigeria | Off unless the Telegram channel flag is on. |
| Cloudflare (R2 file storage) | Keeping files: customer and supplier documents, delivery photos and signatures, payslip PDFs and database backups. | Any file you or we upload, including identity documents, photographs and signed proofs of delivery. | United States | Files are kept in private storage and opened with short-lived links. The storage region is set in our Cloudflare account. |
| Paystack | Taking card payments, when the card rail is switched on. | Your name, email, the amount and the card details you type into Paystack's own form. | Nigeria | Card details go to Paystack's form, never to our servers. |
| Mono | Reading our own bank statements and, when switched on, checking identity numbers. | Our bank statement lines, which can show payers' names and account numbers; identity numbers when verification is on. | Nigeria | Switched on only when the Mono connection is live. |
Our files and databases sit on servers we control and with the storage provider above. Where a provider is outside Nigeria, we rely on the contract terms we accepted with it and on the limits in the last column; we do not claim more than that.
8. Automated decisions
- Credit limits. Each night our software reviews every credit customer's payment record and can lower that customer's credit limit without a person deciding. Raising a limit by software is switched off today: a person approves every increase.
- Job applications. An AI model reads each application and gives it a score to help our recruiters sort. A person decides every application; nothing is rejected by the score alone.
If an automated decision affects you, you can ask us to have a person look at it again. Email sales@cojude.com marked “Attention: Data Protection Officer — review of an automated decision”.
9. How long we keep it
We keep personal data only as long as needed for the purpose it was collected, and as long as the law requires us to retain financial and tax records. When data is no longer needed, we securely delete or anonymise it.
- Job applications — if your application is declined or you withdraw it, we anonymise it 12 months after its last status change (your name, contact details, address, CV and our notes are removed; only the role and dates stay, for hiring counts) unless you ticked "keep me for future roles". You can ask us to erase your application at any time.
- Proof of delivery — the delivery photo, the signature and the name of the person who signed are kept for six years, then deleted.
- Audit records — our record of who did what in our system stays in the live database for 36 months, then moves to archive storage once the copy is checked; a record on legal hold is not removed.
10. How we protect it
COJUDE runs on audit-grade software with role-based access controls, approval steps on money and stock, and tamper-evident records for money and stock. We restrict access to personal data to staff who need it to do their job. What each control does today, and what we do not claim, is on our Security & privacy page.
11. Your rights
Under the Data-protection law you have the right to: access the personal data we hold about you; ask us to correct it; ask us to delete it; object to or restrict certain processing; receive your data in a portable form; and withdraw consent at any time. To exercise any of these, email sales@cojude.com. A request is recorded in our data-request register, which tracks the 30-day deadline and warns our Data Protection Officer and the Managing Director when one is overdue. We do not yet have an online request form.
12. Children
Our website and services are intended for businesses and adults. We do not knowingly collect personal data from children.
13. Changes to this policy
We may update this policy from time to time. The "last updated" date above shows the current version, and material changes will be reflected here. This policy sits beside our Terms of Service, and how we keep your data safe is described on our Security & privacy page.