Account information: your name and email address when you register or check out.

Order and delivery information: billing and shipping name, email, phone number, delivery address, order contents, and any notes you add to an order.

Payment information: limited transaction metadata returned to us by our payment processor (see Section 3) — we do not collect or store your full card number, expiry date, or CVV.

Content you submit: product reviews, ratings, and, if you review as a guest, the name and email you choose to enter on that review.

Browsing and usage information: pages viewed, items added to your cart or wishlist, recently viewed products, and standard technical data such as IP address, browser type, and device information, collected via cookies and server logs.

Communications: messages you send us by email, phone, or WhatsApp, and, if you subscribe, your email address for our newsletter.

We use personal data to: create and manage your account; process, pack, and deliver orders; process payments and refunds; respond to enquiries, reviews, and customer service requests; send order and account notifications; send marketing communications where you have opted in (and which you may opt out of at any time); maintain the security of our site and prevent fraud; and comply with our legal, tax, and accounting obligations.

Our legal bases for this processing are, as applicable: performance of a contract with you (fulfilling an order), your consent (e.g. newsletter sign-up), our legitimate interests (e.g. fraud prevention, improving our service), and compliance with a legal obligation.

Payments on abayalagos.com are processed by Paystack, a licensed third-party payment processor. When you check out, you are directed to Paystack's own secure payment page to enter your card or bank details; those details are submitted directly to Paystack and are never received or stored on our servers. We retain only the transaction reference, amount, status, and limited metadata returned by Paystack (such as a masked card summary) to confirm and reconcile your order.

Paystack's processing of your payment data is governed by Paystack's own privacy policy and security standards, and we are not responsible for Paystack's handling of information you provide directly to it.

We use strictly necessary cookies to operate the site, including cookies that keep you signed in, remember the contents of your cart, and protect against cross-site request forgery. These cookies cannot be switched off without affecting how the site functions.

We do not currently use analytics or advertising cookies. If we introduce them in future, we will update this policy and, where required by law, request your consent beforehand. You can control or delete cookies through your browser settings at any time; blocking strictly necessary cookies may prevent parts of the site (such as checkout) from working correctly.

We do not sell your personal data. We share personal data only with: service providers who process it on our behalf and under contract, such as Paystack (payment processing), delivery couriers (to fulfil shipments), and the email service provider we use to send our newsletter, which receives the email address you subscribed with only for that purpose; law enforcement, regulators, or courts where we are required to do so by law or to protect our legal rights; and a buyer or successor in the event of a merger, acquisition, or sale of some or all of our assets, subject to equivalent confidentiality protections.

Where a service provider we use is located outside Nigeria, we take reasonable steps to ensure your data is protected to a standard consistent with the NDPA before it is transferred.

We keep personal data only for as long as reasonably necessary for the purposes described in this policy. Account data is retained while your account remains active. Order, invoice, and transaction records are retained for as long as required to meet our tax, accounting, and other legal obligations under Nigerian law, which may require retention for several years after your last order. Where you ask us to delete your account, we will delete or anonymise personal data that we are not otherwise required to keep.

Subject to applicable law, you have the right to: request access to the personal data we hold about you; request correction of inaccurate or incomplete data; request deletion of your data, subject to our legal retention obligations; object to or request that we restrict certain processing; request a copy of your data in a portable format; and withdraw consent at any time where processing is based on consent (such as marketing emails), without affecting processing carried out before withdrawal.

To exercise any of these rights, email admin@abayalagos.com. We may need to verify your identity before acting on a request, and we aim to respond within 30 days. If you believe we have not handled your data lawfully, you may also lodge a complaint with the Nigeria Data Protection Commission (NDPC).

We apply reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration, including restricted access to customer records and use of a PCI-compliant payment processor for card transactions. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account password confidential and for all activity carried out under your account credentials.

Our site is intended for users aged 18 and over and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at admin@abayalagos.com and we will take steps to delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be reflected by updating the "Last updated" date at the top of this page, and, where required by law, we will provide additional notice. This policy is governed by, and to be construed in accordance with, the laws of the Federal Republic of Nigeria, including the NDPA.

Questions or requests concerning this policy or your personal data can be sent to admin@abayalagos.com, by phone on +234 (0) 809 891 0000, or by post to Abaya Lagos, 64 Adeola Odeku, Victoria Island, Lagos, Nigeria.