Privacy notice
Last updated 12 November 2026
This notice explains what personal data NaijaCrate collects when you shop with us or book a service, why, who we share it with, where it goes, how long we keep it and the rights you have.
Read it with our terms of sale and use.
1. Who is responsible for your data
NaijaCrate is an online marketplace run from Lagos, Nigeria, selling to customers in Nigeria and around the world. The operator named below decides how your personal data is used, and is the data controller for the purposes of the Nigeria Data Protection Act 2023 and, for customers in the United Kingdom or the European Union, the UK GDPR or the EU GDPR.
For any question about your data, or to use any of your rights, contact us through our Contact page.
2. What we collect
- Account details: your name and email address. If you create an account with a password, we keep only a scrambled (hashed) form of it, never the password itself.
- Google or Yahoo sign-in: if you sign in with Google or Yahoo, they send us your name, your email address, whether the email is verified and, if your profile has one, a link to your profile picture. We never see your Google or Yahoo password.
- Contact and delivery details: your phone number and the delivery addresses you give us, including the name and phone number of the person receiving the parcel.
- Orders: what you ordered, the weights, prices and delivery charge, the order status and the delivery tracking events. If you check out as a guest, we keep the email address and delivery details for that order.
- Quotes, made-to-measure and services: what you ask us for, your measurements, the names, photos and designs you want on personalised items, and for services the address, dates and details the provider needs (for example the size of a home to be cleaned, or what you need from a nanny or driver).
- Messages: what you send us by email or WhatsApp, and our replies.
- Your lists: shopping lists and saved items you create in your account.
- Payment records: Paystack tells us whether a payment succeeded, the amount, the payment reference and the payment method used. For card payments it also sends limited card details (the card type, issuing bank and country, expiry date, and the first six and last four digits) and the IP address the payment came from. You enter your card or bank details on Paystack's page, not ours, and we do not receive or store your full card number.
- Technical data: when you sign in we record the time, your IP address and your browser type with the session, so we can keep your account secure.
3. Why we use it, and our legal basis
We use personal data only where the law allows. The Nigeria Data Protection Act 2023, the UK GDPR and the EU GDPR use the same legal bases for what we do:
| What we do | Legal basis |
|---|---|
| Take your order or quote, buy, make or arrange what you ordered, charge the right amount and refund any difference | Performance of our contract with you |
| Book delivery and give the carrier the recipient's name, phone number and address | Performance of our contract with you |
| Pass the details a service provider or maker needs to do the job you booked | Performance of our contract with you |
| Send order and quote updates by email or WhatsApp, and answer your messages | Performance of our contract with you |
| Run your account: sign-in, order history, buy again, lists, saved items and addresses | Performance of our contract with you |
| Give customs the information on the customs declaration for parcels sent abroad | Performance of our contract with you, and compliance with a legal obligation |
| Keep order and payment records for accounting and tax | Compliance with a legal obligation |
| Keep accounts secure, prevent fraud and misuse, and defend legal claims | Our legitimate interests in running a safe shop |
| Marketing messages, if we ever send them | Your consent, asked for first and withdrawable at any time |
We do not make decisions about you by automated means alone, and we do not build advertising profiles.
5. Transfers between countries
We run the shop from Nigeria, our website is hosted in the United States, our email is held in the European Union, and parcels sent abroad go through carriers in several countries. Your data therefore moves between countries.
Where it does, we rely on the grounds the law allows, mainly that the transfer is necessary to perform our contract with you (for example to deliver your parcel or to answer your email), and we choose providers that protect personal data. If you would like more detail about a particular transfer, contact us through our Contact page.
6. How long we keep it
- Account details, addresses, lists and saved items: for as long as you have an account. When you delete your account, we delete them.
- Order and payment records: for as long as Nigerian accounting and tax law requires. If you delete your account, we keep these records with your name, email address, phone number and street address removed.
- Measurements: kept so that repeat orders fit, until you ask us to delete them or you delete your account.
- Quotes and messages that did not lead to an order: up to 24 months after our last contact.
- Sign-in sessions: until you sign out or the session expires.
7. Your rights
Wherever you live, you can ask us to:
- Access the personal data we hold about you and get a copy of it.
- Correct anything that is wrong or incomplete. You can change your addresses yourself in your account.
- Delete your data. You can delete your account yourself on the Delete your account page.
- Restrict or object to how we use your data, including any use based on our legitimate interests.
- Move your data: ask for it in a common electronic format.
- Withdraw consent at any time, where we rely on it.
To use a right, contact us through our Contact page, from the email address on your account if you have one. We may ask you to confirm who you are before we act. We reply within one month.
8. Complaints to a regulator
Please tell us first if you are unhappy, so we can try to put it right. You can also complain to a data protection regulator:
- Nigeria: the Nigeria Data Protection Commission (NDPC), ndpc.gov.ng.
- United Kingdom: the Information Commissioner's Office (ICO), ico.org.uk.
- European Union: the data protection authority of the country where you live or work.
9. Children
You must be 18 or over to open an account or place an order, and we do not knowingly collect personal data from children. Some orders include information about a child that a parent or guardian gives us, such as a name to print on school items, or what a family needs from a nanny. We use that information only for the order and keep it only as long as this notice says.
11. Keeping it safe
The site is served over an encrypted connection (HTTPS), passwords are stored only in hashed form, and order details are visible only to NaijaCrate staff who need them, who sign in to a separate staff area. If a breach of personal data puts your rights at risk, we will tell you and the regulator as the law requires.
12. Changes to this notice
When we change this notice, we update the date at the top of this page. If a change matters to you, we will also tell you by email.