Version et-pdpp-1321-2024-v1 · Effective 25 September 2026 · Law Personal Data Protection Proclamation No. 1321/2024 of the Federal Democratic Republic of Ethiopia · Languages English and Amharic (the English text prevails if they differ)
This notice explains how 888 Market uses the personal data of sellers on the 888 Market marketplace in Ethiopia, and of the people sellers tell us about — their staff, representatives and beneficial owners. When you give your consent in the seller portal, we record that you consented to this version of the notice, and when.
1. Who we are and how to contact us
The controller of your personal data is SIMINT SEMANYA SIMINT GENERAL TRADE ONE MEMBER PLC, trading as 888 Market — commercial registration AACATB/2/0203514/2017, taxpayer identification number (TIN) 0096176343, registered address House New/07, Woreda 13, Nefas Silk-Lafto Sub-City, Addis Ababa, Ethiopia.
To ask about your data or to use your rights (section 9):
- In the seller portal: open a Support request at seller.888market.com.et and choose “Privacy request”. This is our privacy contact channel: the request is dated when you send it and handled by our compliance team.
- In writing: by letter or in person at our registered address above, marked “Privacy request”.
2. The law this notice is given under
We process your personal data under the Personal Data Protection Proclamation No. 1321/2024. The authority that supervises it is the Ethiopian Communications Authority (section 13).
3. What we collect from you, and when
| When | What we collect |
|---|---|
| Registering a seller account | Your business name (in English and Amharic), phone number, email address and an optional description |
| Signing in | Your phone number; we send one-time codes to it by SMS |
| Onboarding | Whether you sell as an individual or a business; your consent to this notice (version and date); your acceptance of the marketplace agreement (version, date and the language you read) |
| Identity and business documents | Your Fayda national ID or passport, bank statement, business licence and TIN certificate — the files and their review status |
| Business verification (businesses) | Legal name, Amharic trade name, business licence number, issuing authority and expiry date, TIN, and the name of your authorised representative |
| Beneficial owners (businesses) | For each person you declare: full name, date of birth, nationality, and ownership share or other means of control |
| Tax | VAT status, TIN, the name on the tax certificate, tax address and turnover band |
| Payouts | The bank, account number and account holder name of the account we pay you into |
| Stores | Store names and addresses, city, sub-city and map location |
| Staff you invite | The staff member’s phone number |
| Using the seller portal | The devices you sign in from, a one-way hash of your IP address recorded with each consent and agreement acceptance, and a record each time someone opens one of your documents |
| Support | The messages you send us and our replies |
4. Records we create about you
We also create records about you: the results of screening your business, its representative and its declared owners against published sanctions lists; our reviewers’ decisions and notes on your application and documents; the history of your account’s status; your orders, statements and payouts; and security records of sign-ins and one-time codes.
5. Why we use your data, and our legal grounds
The Proclamation allows processing on the grounds listed in its Article 7(2). We rely on these:
| Why | Legal ground |
|---|---|
| Creating and securing your seller account and signing you in | Performance of our contract with you (the marketplace agreement); your consent |
| Verifying your identity and, for businesses, the business and its owners | Performance of our contract; our legitimate interest in keeping fraud and illegal trade off the marketplace |
| Screening names against published sanctions lists | Our legitimate interest in not trading with sanctioned persons; legal obligations where they apply |
| Running your store, receiving and delivering orders, and handling returns | Performance of our contract |
| Issuing receipts and tax invoices, and keeping accounts and tax records | Our legal obligations (tax and commercial record-keeping law) |
| Paying out your sales | Performance of our contract |
| Keeping evidence of the consents and agreements you give | Our legal obligations; our legitimate interest in being able to establish and defend legal claims |
| Keeping the seller portal secure | Our legitimate interest in protecting you, buyers and the marketplace |
You give your consent to this notice before you can submit your application, and we record it. Much of the processing above also rests on the other grounds listed, so if you withdraw your consent (section 10) we stop processing that relies only on consent, but we continue what is needed to perform our agreement with you and to meet our legal obligations.
We do not sell your personal data, and we do not use it for advertising by other companies. Decisions to approve or reject your application are taken by a person. Some restrictions apply automatically when a clear condition is met — for example when a business licence expires without an approved renewal (clause 15 of the marketplace agreement) — and you can ask for any such decision to be reviewed by a person.
6. Where your data is stored
Ethiopian sellers’ data is hosted by Amazon Web Services in the European Union, in its eu-central-1 region (Frankfurt, Germany). Our recovery design adds a database replica in the eu-west-1 region (Ireland).
7. Who we share your data with
Service providers who process data for us:
| Service | Provider | Where |
|---|---|---|
| Hosting, databases, file storage and transactional email | Amazon Web Services | European Union: Frankfurt, Germany; database recovery replica in Ireland |
| SMS delivery of one-time codes and seller account notices (application status, staff invitations, licence reminders, payout notices) | AfroMessage | We have not yet confirmed where it processes data |
| Mobile push notifications | Google Firebase Cloud Messaging | We have not yet confirmed where it processes data |
| Delivery route and distance calculation | Google Maps Platform (Routes API) | We have not yet confirmed where it processes data |
They may use your data only to provide their service to us.
Others:
- 888 Market staff who need it for their work, such as the compliance officers who review applications. Identity documents are reviewed by our own officers; we do not send them to an outside identity-verification company. Sanctions screening compares names with lists we download and hold ourselves; we do not send your data to a screening company.
- Buyers see your store name and the details in your listings.
- Couriers delivering your orders see your store’s name and pickup address.
- Public authorities — the Ministry of Revenues, courts, regulators or the police — when the law requires us to share data or a competent authority orders us to.
8. How long we keep your data
| Records | How long we keep them | Why |
|---|---|---|
| Identity, business licence and sanctions-screening records | For the life of your seller account and 10 years after it closes | To keep the evidence behind our commercial records and to be able to establish or defend legal claims — the general period of limitation for contractual claims is ten years (Civil Code, Art. 1845) |
| Orders, payouts, receipts and tax invoices, and ledger records | 10 years from the end of the year in which the record was made | Books of account and accounting documents are kept for ten years (Commercial Code, Proclamation No. 1243/2021, Art. 66); receipts for ten years (Proclamation No. 813/2013, Art. 17(2)); tax records for at least the Commercial Code period (Federal Tax Administration Proclamation No. 983/2016, Art. 17) |
| Your agreement acceptances and consent records | For the life of your seller account and 10 years after it closes | Civil Code, Art. 1845 |
| Applications that were never activated | 2 years after the last activity on the application, then deleted — unless a legal hold or a sanctions-screening match requires us to keep them | No trading took place, so no longer period is needed |
| Support messages | 10 years from the date of the message | Business correspondence is kept for ten years (Commercial Code, Art. 67) |
| Sign-in and security logs | 1 year | To investigate misuse of accounts |
| Decisions and notes of our reviewing officers (the audit trail) | 10 years from the decision | Civil Code, Art. 1845 |
| Records of one-time codes sent to you | 90 days | To investigate delivery problems and misuse |
If a record is needed for a legal proceeding or a legal hold, we keep it until the matter is closed, even if its period has ended. At the end of its period a record is deleted or made anonymous. Our automated deletion is not yet switched on; until it is, nothing is deleted automatically, and you can ask us (section 9) to delete data whose period has ended — we will do so, and confirm it to you.
9. Your rights and how to use them
Under the Proclamation you have the right to:
- be told how your data is used (this notice);
- see the data we hold about you and receive a copy of it;
- receive the data you gave us in a structured, commonly used, machine-readable form;
- have inaccurate or incomplete data corrected;
- have your data erased, where we no longer need it or it was processed unlawfully — except data we must keep by law (section 8);
- ask us to restrict processing, and object to processing, in the cases the Proclamation provides; and
- withdraw your consent (section 10).
How to make a request. Open a Support request in the seller portal and choose “Privacy request”, then the kind of request: a copy of your data, correction, deletion, objection or withdrawal of consent. You can also write to us at our registered address.
Checking it is you. Before we act on a request or disclose any data, we check that it comes from you: a request sent from your signed-in seller account is linked to that account, and we may ask you to confirm it with a fresh one-time code in the seller portal. A person who has no seller account (for example a declared beneficial owner) must show a valid identity document (Fayda national ID or passport). We never ask for a one-time code by phone, SMS or email, and we never act on an email address or phone number alone.
How long we take. We record the date each request arrives and respond within 30 days. If we need more information to identify you or to understand the request, we will tell you, and the 30 days run from when we receive it.
What we may withhold. We do not disclose another person’s data to you (for example the date of birth of a co-owner you declared, unless it is yours), and we may withhold information where the Proclamation allows, including where disclosing it would harm the prevention or detection of crime. We will tell you if we withhold something and why, unless the law forbids that.
Deletion and the records we must keep. When you ask us to delete your data, we delete what we are not required to keep and make the rest inaccessible except for the legal purpose it is kept for, until its period in section 8 ends.
10. Withdrawing your consent
You can withdraw your consent at any time on the onboarding page of the seller portal, or by a privacy request. The withdrawal is recorded when you make it. What it changes: you cannot submit or resubmit your application while your consent is withdrawn, and the consent step of your onboarding shows as needing action again. What it does not change: if your application has already been submitted, its review continues and your store may still be activated; an active store is not closed; and data already collected is not deleted by the withdrawal — to delete data, make a deletion request (section 9). You can give your consent again later.
11. People you tell us about
When a business declares its representative and beneficial owners, or when a seller invites staff, we receive those people’s data from the seller rather than from them. For each declared owner we collect full name, date of birth, nationality and ownership share or control, to verify the business and to screen the names against sanctions lists; for each invited staff member, their phone number.
The seller must tell each such person that their data is being given to 888 Market and where to read this notice, which is published at seller.888market.com.et/legal/privacy-notice-et-pdpp-1321-2024-v1.en.html (English) and seller.888market.com.et/legal/privacy-notice-et-pdpp-1321-2024-v1.am.html (Amharic). If we contact them, we will point them to it. They have the same rights as you (section 9) and use them the same way.
12. How we protect your data
Your data is encrypted in transit (TLS) and at rest. Tax identification numbers, licence numbers and other sensitive identifiers are additionally encrypted field by field. Identity documents are held in a separate protected store, and every time someone opens one of your documents it is recorded. Only staff who need your data for their work can reach it.
If a breach of personal data occurs, we notify the Ethiopian Communications Authority within 72 hours of becoming aware of it and tell you within the same time where the Proclamation requires (Art. 43 and Art. 44).
13. Complaints
If you are unhappy with how we use your data, please tell us first through a privacy request, so that we can put it right. You also have the right to complain to the Ethiopian Communications Authority (www.eca.et), which supervises the Proclamation (Art. 58).
14. Changes to this notice
Each version of this notice has its own version identifier, and the version you consented to is recorded with your consent. When we publish a new version we will tell you in the seller portal and by email or SMS before it takes effect, and if a change needs your consent we will ask for it.