How StylishlyDesigns uses your information
Last updated: [OWNER: date]
Draft — under review
Who we are
StylishlyDesigns ([OWNER: registered business name and CAC number]), [OWNER: business address], Lagos, Nigeria. We decide how your personal information is used, so under the Nigeria Data Protection Act 2023 we are its “data controller”. To ask anything about your information, message us on WhatsApp at [OWNER: number] or email [OWNER: an address someone reads].
The short version
We collect what we need to take, make and deliver your order, and to run our first-order offer fairly. We never sell your information. Our account pages and your order-tracking page carry no advertising trackers.
What we collect, and why
| What | Why | Our legal basis |
|---|---|---|
| Your Google sign-in: your Google account ID, your name, and your email if Google has verified it. We never see your Google password. | To create your account and keep it yours. | To provide the account you asked for (contract). |
| Your WhatsApp number | To fill in your orders, contact you about them, and check the first-order offer (one per number). | Contract; and our legitimate interest in stopping the offer being claimed twice. |
| Delivery addresses: area, street, estate, gate or landmark | To deliver your orders. | Contract. |
| Saved pieces and shared lists | So you can keep pieces and share a list. A shared list shows the pieces only, never your name. | Contract. |
| Orders: your name, WhatsApp number, delivery area and address, the items, prices, payments, dates, and photographs of your piece | To make, check, deliver and guarantee your order, and to keep the business records the law requires. | Contract; legal obligation. |
| WhatsApp enquiries: the page and piece you were on, what you chose (sizes, an event list), where you came from (for example an ad), your approximate city, your device type, and a scrambled code made from your internet address to stop spam. If you are signed in, your account code. | To answer you, and to learn which pages and ads help people. | Our legitimate interests. |
| Measure-visit bookings: your name, WhatsApp number, area, what the visit is for and the day you prefer | To arrange the visit. | Contract. |
| Sign-in records: the kind of device (“Chrome on Android”), when you signed in, and a one-way fingerprint of your sign-in cookie (never the cookie itself) | To keep you signed in, and so you can sign out other devices. | Contract; security. |
| Consent records: which version of this notice and of our terms you accepted, and when | To show what you agreed to. | Legal obligation. |
| A fraud-prevention record: only if you delete an account that had the first-order discount — a one-way scrambled code made from your Google account ID | So the offer can’t be claimed twice by deleting and re-joining. Kept only while the offer runs. | Our legitimate interest in preventing abuse. |
| Visitor statistics: anonymous; no cookies; a code that changes every day | To know which pages work. | Our legitimate interests. |
What we never collect
Card or bank details (we don’t take payments on this website), your location from your phone, your Google password, your contacts, or your Google profile photo.
Cookies
Our sign-in cookie and a one-letter cookie that remembers whether you are signed in are needed for your account; a short-lived cookie protects the Google sign-in step. If you save pieces without an account, your phone keeps only their item codes. On our public shop pages — never on account or tracking pages — the Meta Pixel and, if we switch them on, Google Analytics and Google Ads set their own cookies and are told which pages and pieces you look at (with the piece's name, category and price), when you tap to message us on WhatsApp or send a bespoke or measure-visit request (the piece or budget, not your details), when you share a piece, and that you created an account. Meta and Google may link this to your account with them. We use it to measure our advertising and to show our adverts to people who have visited us. They never receive your name, number, email or address from us. [OWNER/LAWYER: decide whether visitors must be offered a choice before the Meta Pixel loads, and confirm the legal basis for retargeting (likely consent). DRAFT wording for the lawyer under Q6 — not final.]
Who receives your information
- Google, to sign you in; and Google Sheets, if we keep our enquiry sheet [OWNER]; and Google Analytics/Ads on public pages, if we switch them on.
- Neon, our database, in London, UK (on Amazon Web Services).
- Vercel, which runs this website in London and stores its photographs.
- Render, a backup copy of the website in Frankfurt, Germany — only if we use it [OWNER].
- Meta: WhatsApp, where our conversations with you happen; and the Meta Pixel on public pages, as above.
We share nothing else and sell nothing. We would disclose information only if the law requires it.
Transfers outside Nigeria
These providers store information in the UK, the European Union and the USA. [OWNER/LAWYER: the NDPA basis relied on — for example the providers’ data-processing terms and safeguards.]
How long we keep it
- Your account: until you delete it, or [OWNER: 3 years] after your last sign-in.
- Sign-in records: at most 180 days.
- Orders: [OWNER: 6 years] after the order, as business and tax records — also after you delete your account.
- Enquiries: [OWNER: 2 years].
- The fraud-prevention record: until the first-order offer ends, plus 14 days.
- Visitor statistics: 400 days.
Your rights
You can ask to see your information, correct it, delete it, take a copy, object to or restrict how we use it, and withdraw any consent. Most of this you can do yourself in Your account: edit your details, download your data, sign out other devices, or delete your account. Orders stay with us as records after you delete your account; ask us on WhatsApp if you want them removed and we will tell you what the law lets us delete. We reply within [OWNER/LAWYER: 30 days]. You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
Children
Accounts are for people aged 18 and over.
Keeping it safe
The site only works over HTTPS. You sign in through Google, so we hold no passwords. Your sign-in cookie is stored on our side only as a one-way fingerprint. Our back office has its own separate sign-in. If a breach ever puts your information at risk, we will tell the Commission and you as the law requires.
Changes
When we change this notice we update the date above. If a change matters, we ask you to accept it the next time you sign in.
A question about your information? Message us on WhatsApp