How your data is handled.

We collect the following categories of personal data:

• Profile information — name, email address, phone number, profile photo.
• Delivery addresses — shipping and billing addresses you save.
• Payment information — masked card identifiers. Full card numbers are processed by Paystack and never stored by us.
• Order history — pieces purchased, prices, delivery status.
• Browsing behaviour — pages visited, pieces viewed, search queries, time spent (only if you accept analytics cookies — see Section 7).
• Device & technical data — IP address, browser type, operating system, device identifiers.
• Communications — messages sent through our contact or consultation system.

We use your personal data for the following purposes:

• Order fulfilment — processing purchases, handling delivery, managing returns.
• Account management — authentication, profile maintenance, security monitoring.
• Customer support — responding to enquiries, resolving disputes.
• Newsletters — only if you have subscribed via the footer signup. Unsubscribe at any time using the link in every email.
• Analytics — understanding how visitors interact with the site to improve the experience. Only enabled if you accept analytics cookies.
• Fraud prevention — detecting and preventing unauthorised access or fraudulent transactions.
• Legal compliance — meeting obligations under applicable law.

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

• Active accounts — data retained for the duration of your account.
• Deleted accounts — data purged within 90 days of account deletion.
• Order records — may be retained for up to 7 years for tax and legal purposes.
• Security logs — audit logs retained for 12 months.
• Newsletter subscribers — removed promptly upon unsubscription.

Under the UK GDPR, EU GDPR, and Nigeria's NDPR you have the following rights:

• Access — request a copy of the data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your account and personal data.
• Portability — receive your data in a machine-readable format (JSON or CSV).
• Object — object to processing of your data for marketing purposes.
• Restrict — request that we limit processing in certain circumstances.
• Withdraw consent — for anything where consent is the legal basis (including analytics cookies — see Section 7).

We share your data only where necessary with trusted service providers:

• Payment processor — Paystack (PCI DSS Level 1).
• Cloud infrastructure — Firebase / Google Cloud Platform (data processing agreement in place).
• Email transport — Brevo, for transactional emails (order confirmations, password resets) and newsletters.
• Analytics — Google Analytics 4, only if you accept analytics cookies; data is collected by Google as a processor on our behalf.
• Shipping — couriers required to fulfil delivery (DHL, GIG, UPS, FedEx and Nigerian last-mile partners via Shipbubble).
• Legal authorities — where required by law or to protect our legal rights.

We never sell your personal data to third parties.

We implement the following safeguards:

• Encryption in transit — all data transmitted over SSL/TLS (HTTPS).
• Encryption at rest — sensitive data encrypted in our database.
• Authentication — bcrypt password hashing, optional 2FA, session management.
• Access controls — role-based; staff can only access data necessary for their function.
• PCI compliance — card data handled by a PCI DSS Level 1 compliant processor.
• Monitoring — audit logs, fraud detection, and rate limiting are active at all times.

We use a small number of cookies and similar technologies. We do not currently use any marketing, advertising, or cross-site tracking cookies.

• Strictly necessary cookies — authentication, session management, CSRF protection, and your bag contents. These are required for the site to function and are exempt from consent under GDPR.
• Preference cookies — remembering your theme (light / dark) and currency choice. First-party only; no data leaves our servers.
• Analytics cookies (Google Analytics 4) — only loaded after you click Accept on the cookie banner. GA4 sets first-party cookies (_ga, _ga_*) to count unique visitors and pages viewed. We do not enable Google Signals, demographic reports, or cross-device tracking. If you decline, GA4 is not loaded and no analytics cookies are set.

Withdrawing consent. You can change your mind at any time by clicking Cookie preferences in the footer of any page. This re-opens the consent banner and clears any prior choice.

Legal basis. Strictly necessary and preference cookies rely on our legitimate interest in providing the service you requested. Analytics cookies rely on your consent (GDPR Article 6(1)(a)).

You also have the right to lodge a complaint with the relevant data protection authority in your jurisdiction if you believe we have not handled your data in accordance with applicable law.