Privacy policy · ASHABI

DRAFT: this policy is a starting point for ASHABI to review with a legal adviser. Replace every item in [SQUARE BRACKETS] before launch.

Who we are

ASHABI ("we", "us") is a fashion brand operated by [LEGAL BUSINESS NAME], registered in Nigeria with the Corporate Affairs Commission under number [RC NUMBER], at [REGISTERED ADDRESS]. We are the data controller for the personal data described in this policy.

We follow the Nigeria Data Protection Act 2023 (NDPA) and, for customers in the United Kingdom, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Questions about your data: [PRIVACY EMAIL]. Our Data Protection Officer is [DPO NAME OR "not appointed"].

What we collect

Account details: your name, email address, phone number and password (stored encrypted by our sign-in provider).
Order details: the pieces you buy, sizes, lengths, colours, your delivery and billing address, and any notes you add.
Measurements, if you choose to save them for custom orders.
Payment details: payments are taken by Paystack. We see the payment status and the last four digits of your card, never your full card number.
Messages you send us by email, WhatsApp or Instagram.
Newsletter sign-up: your email address and the date you joined.
Technical data: your IP address, browser and device, used to keep the site secure and to suggest your store and currency.

Why we use it, and our legal basis

To take, make and deliver your order and handle returns (performance of a contract).
To run your account, bag and wishlist (performance of a contract).
To keep financial and tax records (legal obligation).
To prevent fraud and keep the site secure (legitimate interests).
To send our newsletter and offers, only if you have opted in (consent). You can unsubscribe at any time from the link in each email or from your account.

Who we share it with

We only share what each provider needs to do its job:

Paystack, to process payments.
DHL Express and our local courier [COURIER NAME], to deliver your order. Your name, address and phone number go on the shipping label.
Supabase, which stores our database and accounts.
Vercel, which hosts this website.
Resend, which sends our order emails.
Our professional advisers, and authorities where the law requires it.

We never sell your personal data.

International transfers

Some of these providers store or process data outside Nigeria and the UK, for example in [COUNTRY/REGION OF SUPABASE AND VERCEL SERVERS]. Where that happens we rely on the safeguards the law requires, such as adequacy decisions or standard contractual clauses.

How long we keep it

Order and payment records: [6] years, for tax and accounting.
Your account: until you delete it. When you delete it, your orders are kept for our records but no longer linked to you.
Newsletter: until you unsubscribe.
Messages: [2] years after our last conversation.

Your rights

You can ask us to:

give you a copy of your data (from your account you can also use "Download my data");
correct data that is wrong;
delete your data (from your account you can also use "Delete my account and data");
restrict or object to how we use it;
move your data to another provider;
withdraw your consent at any time, without affecting what we did before.

Email [PRIVACY EMAIL] and we will reply within [30] days. If you are unhappy with our reply you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or, in the UK, the Information Commissioner's Office (ico.org.uk).

Cookies

We use a small number of cookies and similar browser storage to run the store. See our Cookie notice for the full list and to change your choices.

Children

Our store is not meant for children under [18]. We do not knowingly collect their data.

Changes to this policy

We may update this policy. The date at the top shows when it last changed, and we will tell account holders by email about any important change.