Skip to main content
Qlutterbox logo

PRIVACY

Privacy notice

This notice explains how Qlutterbox collects, uses, shares, and protects personal data in line with NDPR/NDPA and GDPR, while staying aligned with the wider Qubicbox trust commitments published on Qubicweb and Qubictry.

Version 1.0. Effective 27 August 2026.

Who we are

  • Qlutterbox is a commerce product operated by Qubicbox Limited, which also operates Qubicweb, Qubictry, the Trust Badge, and E-Fraud Watch. Qubicbox Limited generally acts as controller for direct customer and platform processing, and may act as processor only under a verified agreement with another controller.
  • Registered office: 61 Ondo Street, Irawo, Mile 12, Kosofe, Lagos State, Nigeria.

Information we collect

  • Identity and verification: names, pronouns, NIN and CAC evidence, guild references, and selfie or video captures used to issue badges or curate protected payment.
  • Contact details: email, phone, messaging handles, notification preferences.
  • Listings & inspections: inventory metadata, provenance notes, diagnostic logs, proof-of-condition media, dispute artefacts.
  • Protected Payment & payout: bank account details, transaction IDs, invoice references, commission statements, settlement preferences.
  • Technical telemetry: device fingerprints, IP addresses, session identifiers, MFA events, moderation audit logs, rate-limiting fingerprints.
  • Trust graph signals: Trust Badge status, referrals, leaderboard rank, TrustOps annotations that feed Qubicweb overlays and Qubictry referrals.

Purposes & lawful bases

  • Contract: onboarding Curators, publishing listings, processing protected payment, inspections, payouts, disputes, and restitution workflows.
  • Legal obligation: meeting a specific applicable legal, tax, payment, consumer-protection, or preservation requirement where it applies.
  • Legitimate interest: preventing fraud, securing the platform, measuring product usage with privacy-preserving telemetry, and improving moderation accuracy. Assessments are reviewed annually.
  • Consent: optional marketing updates, referrals, saved searches, biometric capture where explicit consent is mandated. Withdraw anytime without affecting prior lawful processing.

Retention

  • Operational records (listings, protected payment logs, payout statements): transaction close plus 7 years for audit and restitution.
  • Curator KYC dossiers: duration of the relationship plus 5 years for regulatory requirements.
  • TrustOps dispute files: 5 years post resolution.
  • Evidence uploads: 24 months unless legal holds apply, then securely deleted from primary and backup storage.
  • Marketing preferences: until withdrawn; requests honoured within 72 hours.

International transfers

  • Some approved providers may process data outside Nigeria. We assess applicable transfer requirements and safeguards before relying on a cross-border transfer, and do not represent an unverified country or transfer mechanism as current fact.

Security controls

  • Mandatory MFA for Curators, TrustOps, payout actors, and admin tooling.
  • Role-based access, attributable audit records, and reviewable exceptions protect sensitive operational actions.
  • Evidence access is restricted and material evidence actions are recorded. Additional sanitisation applies where the relevant workflow supports it.
  • Rate limiting, abuse prevention, anomaly review, and incident procedures are applied according to the affected workflow and risk.

Sharing & processors

  • Payment providers, including Paystack where used, process payment and payout data under their applicable provider terms. Qubicbox does not represent itself as a bank or escrow provider.
  • Approved hosting, database, storage, communications, monitoring, and security providers receive only the data needed for their service. Provider and region details are verified before being represented as current.
  • Ecosystem partners: Qubicweb (trust overlays), Qubictry (pro referrals), and the Trust Badge service when required to fulfil your request.
  • Lawful disclosures: only when legally compelled or necessary to prevent imminent harm. Every disclosure is logged in immutable AuditLog trails.

Your rights

  • Access, rectification, deletion, restriction, objection, portability, and withdrawal of consent without affecting prior lawful processing.
  • Right to complain to the Nigeria Data Protection Commission (NDPC) or your local EU supervisory authority.
  • Right to understand automated decision-making; we do not run solely automated decisions with legal effects without human review.

How to exercise your rights

  • Email privacy@qubicbox.com with the subject "Data Subject Request" and include the email/phone tied to your account. We acknowledge within one working day and fulfil within 30 days (extendable by 15 days for complex cases).
  • Escalations: NDPC (complaints@ndpc.gov.ng) or your EU supervisory authority.
  • Registered office: Qubicbox Limited, 61 Ondo Street, Irawo, Mile 12, Kosofe, Lagos State, Nigeria. Telephone: +234 1 700 2100.

Product-specific notes

  • Qlutterbox protected payment and inspections rely on Trust Badge verification data; badge state synchronises with Qubictry referrals and Qubicweb trust overlays.
  • Community submissions feeding E-Fraud Watch or OSINT Lab are reviewed and anonymised before publication. Reporters can remain anonymous.

Updates

  • We review this notice whenever regulations, processors, or product scope changes. Updated versions appear here with a new revision date.
  • Latest revision: 27 August 2026.
Checking your session. We will reconnect automatically.