The Multi Barbers Association of Nigeria (“M.B.A”, “we”, “us”) is the data controller for personal data processed through mbabarbers.ng, the member directory, gift vouchers, the savings program and the store. This Policy explains that processing in plain English, in line with the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act 2023.
1. Who we are
M.B.A is a registered trade association (RC 1648920) operating from 14B Marina Street, Lagos Island, Lagos 102274, Nigeria. For the purposes of Nigerian data protection law we are the data controller: we decide why and how personal data is processed.
Our Data Protection Officer can be reached at privacy@mbabarbers.ng or +234 803 000 1234 (Mon–Sat, 8:00–20:00 WAT). We are not required to appoint a representative outside Nigeria, and we do not carry out solely automated decisions with legal or similarly significant effects.
2. Data we collect
2.1 From you
- Identity: full name, date of birth, photograph, and a government-issued ID (NIN slip, driver's licence, international passport or voter's card) where you apply for membership.
- Contact: phone number, email address, delivery address and state/chapter.
- Trade: barber name or shop name, specialities, price list, opening hours, years of experience, trade photographs, salon address and profile biography.
- Booking & voucher: appointment details, redeemed voucher codes, reviews you submit and customer service messages.
- Financial: bank account name and number for payouts and savings withdrawals, and transaction references. Full card numbers are never collected by us.
- Savings: contribution cadence, amounts, plan choice, maturity date and withdrawal history.
2.2 Automatically
- Device and browser type, IP address, approximate location derived from IP, pages viewed, referring page and timestamps.
- Cookie and similar identifiers as described in section 6.
2.3 From others
- Identity verification from our verification partner (name and ID match only).
- Payment status from Paystack and other licensed processors.
- Complaints or conduct reports from customers and chapter officers, which may include correspondence and outcome notes.
- Public trade registry details used to confirm a business name where you apply as a shop owner.
| Category | Examples | Kept for |
|---|---|---|
| Identity | Name, photo, ID number, date of birth | Membership term + 6 years (statutory) |
| Trade & directory | Shop details, prices, specialities, photos | While listed + 24 months after delisting |
| Bookings & vouchers | Appointments, redeemed codes, reviews | 36 months from redemption |
| Savings | Contributions, withdrawals, statements | Account life + 7 years |
| Store orders | Order lines, delivery address, invoices | 7 years (tax & consumer law) |
| Technical | IP, device, cookies, session logs | 13 months maximum |
| Support | Enquiries, complaints, call notes | 24 months after closure |
3. How we use it
- To verify members and maintain the public directory customers rely on.
- To process membership applications, renewals, fees and M.B.A numbers.
- To issue, redeem and settle gift vouchers, and to pay barbers what they are owed.
- To operate savings money boxes, including debits, withdrawals, statements and the member emergency fund.
- To fulfil store orders, handle returns and prevent fraud.
- To secure the platform: sign-in, OTP checks, rate limits and fraud monitoring.
- To provide support, investigate complaints and mediate disputes between customers and barbers.
- To send service messages (order updates, voucher expiry, plan maturity) and, only with your consent, trade newsletters and offers.
- To meet legal, tax and regulatory obligations, and to defend or exercise legal claims.
We do not sell or rent personal data, and we do not use member financial details for advertising.
4. Legal bases
We rely on one or more of the following for each use:
- Contract
- Processing needed to provide what you asked for — membership, a voucher, a savings plan or an order.
- Legitimate interests
- Operating a trusted trade directory, preventing fraud, securing the platform, improving the service and defending claims, balanced against your rights.
- Consent
- Marketing messages, optional cookies and any collection that is genuinely optional. You can withdraw consent at any time without affecting past processing.
- Legal obligation
- Retaining financial records, responding to lawful requests and complying with tax and consumer protection law.
Where you provide another person's details (for example, gifting a voucher), you confirm you have their permission to do so.
5. Who we share with
- Your chosen barber or shop: the minimum needed to deliver your booking — name, contact, service and voucher balance.
- Payment processors: Paystack and other licensed providers process card, transfer and USSD payments on their own secure systems.
- Verification partner: receives your name and ID number to confirm a match, and returns a pass or fail.
- Trust partner & bank: hold savings contributions in a segregated account and execute withdrawals to your registered account.
- Couriers: receive your delivery address and phone number to complete store orders.
- Professional advisers: auditors, accountants, insurers and lawyers under confidentiality obligations.
- Authorities: courts, the police or regulators where the law requires it, or where necessary to protect members and customers.
- Chapter officers: receive only the records needed to verify, mediate and renew members in their state.
Everyone who processes data for us is bound by written data-processing terms and may use it only on our instructions.
6. Cookies & tracking
We use a small number of cookies and local-storage keys. Necessary cookies keep you signed in and secure your basket — they cannot be switched off. Optional ones remember your preferences and tell us which pages help members most. You can change your choice at any time.
You can also block or clear cookies in your browser settings. Turning off necessary cookies will sign you out and stop voucher codes being applied at checkout.
7. Retention
We keep personal data only as long as needed for the purpose it was collected for, then delete or irreversibly anonymise it. The table in section 2 shows the main periods. Where the law requires a record — tax, accounts, consumer claims — we retain that record but stop using it for anything else.
When you delete your account we remove your directory listing, photographs and contact details within 7 days, and delete the rest within 30 days unless a legal hold or an open dispute applies. Residual copies in encrypted backups expire within 90 days.
8. Savings & payments data
- Card details are handled entirely by our licensed payment provider. M.B.A stores only a masked card reference and the last four digits for receipts.
- Bank accounts are held for payouts and withdrawals and are verified to match the name on your membership record before any transfer.
- Savings records — contributions, debits, bonuses and withdrawals — are kept in the trust ledger with date, time, channel and reference, and are available to you as a statement at any time.
- Separation: savings balances are held with our trust partner and are never mixed with association operating funds or used as collateral for our debts.
- Statements may be shared with your bank, auditors or regulators where required, or where you ask us to in writing.
We will never ask for your PIN, full card number or OTP by phone, WhatsApp or email. If someone does, it is not M.B.A — report it to 0803 000 1234.
9. Your rights
Access & portability
- Ask for a copy of the personal data we hold about you.
- Receive it in a structured, machine-readable format where feasible.
- Get an explanation of how it has been used.
Correction & deletion
- Correct anything inaccurate or out of date.
- Complete anything incomplete, including your trade profile.
- Request erasure where we no longer need the data or consent is withdrawn.
Control
- Withdraw consent for marketing or optional cookies at any time.
- Object to processing based on legitimate interests.
- Restrict processing while a complaint or correction is being handled.
Objection & complaint
- Object to direct marketing, including directory-based outreach.
- Be notified of a personal data breach that affects you.
- Complain to the Nigeria Data Protection Commission if you are not satisfied.
To exercise any of these, email privacy@mbabarbers.ng from your registered address, or write to the Data Protection Officer at the head office address. We acknowledge within 7 working days and complete requests within 30 days, extending once by a further 30 days for complex requests with notice to you. We may ask for ID to confirm it is really you. We do not charge for a first request.
10. Children
The platform and membership are for people aged 18 and over. We do not knowingly create accounts for children or market to them. Apprentice members under 18 are only accepted with written consent from a parent or guardian, are never listed publicly without that consent, and their data is limited to name, trade details and chapter.
If you believe a child has given us personal data without consent, contact privacy@mbabarbers.ng and we will delete it promptly.
11. Security
- TLS encryption in transit and encryption at rest for databases and backups.
- Multi-factor and OTP checks for member and staff accounts; role-based access so officers see only their chapter.
- Segregated trust account for savings, separate from operating funds.
- Penetration testing and dependency reviews at least annually, plus continuous monitoring for unusual traffic.
- Staff and chapter volunteers trained on the NDPR and bound by confidentiality agreements.
- Documented breach-response process: we notify the Nigeria Data Protection Commission and affected members within 72 hours of a notifiable breach.
No system is completely secure. If you suspect your account has been compromised, change your password immediately and call 0803 000 1234.
12. International transfers
Our primary storage and processing take place in Nigeria. Where a tool we rely on (for example cloud hosting, email delivery or payment infrastructure) processes data outside Nigeria, we ensure an adequate level of protection through contractual safeguards consistent with the NDPA, and we disclose the countries involved on request.
We will not transfer your personal data to a country without appropriate protections, and we will not transfer it in a way that undermines the rights this Policy gives you.
13. Changes to this policy
We review this Policy at least once a year. The version number and effective date at the top of this page always reflect the current text. Material changes are notified by email and by a notice in your dashboard at least 14 days before taking effect, and previous versions are available on request from privacy@mbabarbers.ng.
14. Contact & complaints
- Data Protection Officer: privacy@mbabarbers.ng
- Post: The Data Protection Officer, Multi Barbers Association of Nigeria, 14B Marina Street, Lagos Island, Lagos 102274, Nigeria.
- Phone & WhatsApp: +234 803 000 1234, Mon–Sat 8:00–20:00 WAT.
- Regulator: Nigeria Data Protection Commission (NDPC) — you may lodge a complaint there if you are unhappy with our response.
For general support and complaints that are not about your data, see Contact & support. For the agreement governing your use of the platform, see our Terms & Conditions.
Version 3.1 supersedes version 3.0 dated 12 September 2025. Archived versions: privacy@mbabarbers.ng.