Privacy policy

Privacy Policy Last updated: 16 November 2026 Tobiya Marketplace ("Tobiya", "we", "us") runs the online marketplace at tobiyamart.com and the Tobiya mobile app. This policy explains what personal data we collect, why, who we share it with and the choices you have. We handle personal data in line with the Personal Data Protection Proclamation of Ethiopia and other applicable law. 1. WHO IS RESPONSIBLE Tobiya Marketplace is the controller of your personal data. Contact us at [email protected] for any privacy question or request. 2. DATA WE COLLECT - Account data: your name, email address, password (stored only as a salted hash) and language. If you sign in with Google we receive your Google account ID, name, email address and profile photo. If you link Telegram we receive your Telegram ID and username. - Phone number: only if you choose to verify a phone number so you can post ads. We send a one-time code to confirm it. - Listings and content: ads, photos, descriptions, prices, locations you choose, messages to other users, reviews, reports, wanted requests and support tickets. - Shop and seller data: business name, trade licence, TIN, address and contact details. ID documents and ID numbers submitted for verification are stored encrypted and the document image is deleted after the review period below. - Orders and payments: orders, delivery details, wallet balance and transaction records. Payments are made through licensed payment providers. We do not see or store your card details or mobile-money PIN. - Device and usage data: IP address, browser and device type, pages viewed, searches, saved items and security events such as sign-ins and failed attempts. - Location: only a city or area you choose. If you allow it, your device location may be used to show nearby items. You can refuse this in your browser or phone settings. - Photos and camera: only when you choose to add photos to an ad or search by photo. 3. HOW WE USE YOUR DATA - To create and secure your account and sign you in. - To publish your ads and let buyers and sellers contact each other. - To process orders, payments, refunds, wallet top-ups and disputes. - To verify sellers and shops, and to prevent fraud, scams, spam and prohibited items. - To send service messages by email, in-app notification or Telegram: account activation, password reset, order and security notices, and messages from other users. - To send marketing only if you agree. You can withdraw consent at any time in your account. - To measure how the site is used and improve it, including search, recommendations and price guidance. - To comply with legal obligations and respond to lawful requests from authorities. Our legal bases are your consent, performing our agreement with you, our legitimate interest in running a safe marketplace, and legal obligation. 4. COOKIES AND ANALYTICS We use cookies and similar storage that are needed to keep you signed in, remember your language, calendar and data-saver choices, and recently viewed items. We also use Google Tag Manager and Google tags to understand traffic and measure performance. These may set analytics cookies and send usage data such as pages viewed and approximate location to Google. You can block or delete cookies in your browser settings; some features may then stop working. 5. WHO WE SHARE DATA WITH - Other users: your public ad content, shop profile, display name and ratings are visible to everyone. Your phone number and email are not shown on your ads unless you choose to publish them. When you place an order, the seller receives the details needed to deliver it. - Service providers who work for us: hosting and security (Cloudflare and our server provider), email delivery, Google (sign-in and analytics), Telegram (if you use Telegram sign-in or alerts), payment providers, and AI services used for features such as photo search and ad assistance when enabled. They may only use data to provide their service to us. - Authorities: when required by law or a valid legal request, or to protect people from harm or fraud. - A successor, if Tobiya is reorganised or sold, under the same protections. We do not sell your personal data. 6. INTERNATIONAL TRANSFERS Some providers process data outside Ethiopia. Where this happens we rely on contracts and safeguards that require them to protect your data to a comparable standard. 7. HOW LONG WE KEEP DATA - One-time phone codes: 2 days. - Sign-in sessions: until they expire, and revoked sessions for 30 days. - Notifications: 180 days. - ID document images: deleted 90 days after the verification decision. - Your account and profile: until you ask us to delete the account. After you request deletion we erase your personal details after 30 days. - Orders, payments and audit records: kept for as long as the law requires, in anonymised form where possible. 8. YOUR RIGHTS You can access and download your data, correct it, withdraw consent, object to certain uses and ask us to delete your account from your account page or by emailing [email protected]. We will reply within 30 days. You may also complain to the Ethiopian data protection authority. 9. SECURITY We use encrypted connections (HTTPS), salted password hashing, encryption of sensitive ID data, access controls, audit logs and rate limits. No system is perfectly secure, so use a strong, unique password and never share your codes. 10. CHILDREN Tobiya is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it. 11. CHANGES We may update this policy. We will post the new version here with a new date, and tell you about important changes by email or in the app. 12. CONTACT Tobiya Marketplace, Addis Ababa, Ethiopia Email: [email protected]