Privacy Policy

What data we collect

• Account data (optional accounts): your email address and a password stored only as a cryptographic hash by Firebase Authentication.
• Order data: your name, email, phone number, delivery address, the items you ordered and the order total.
• Payment data: a Paystack payment reference and payment status. We never see or store your card details; card data is handled entirely by Paystack's secure checkout on their servers.
• Messages: the name, email, subject and message you send via the contact form.
• Local data on your device: your cart contents and cookie-notice choice are stored in your browser's localStorage. They never leave your device except as part of an order you place.

Why we process it (legal basis)

• To fulfil your order and deliver it to you (performance of our contract with you).
• To provide order history on your account (performance of our contract, or your consent).
• To process payments through Paystack (performance of our contract).
• To answer your messages (our legitimate interest in customer support).
• To keep records of transactions for tax and accounting obligations (legal obligation).

We do not sell your data, use it for advertising, or run analytics or ad trackers on this site.

Who processes it for us (processors)

• Paystack: payment processing. Paystack receives your payment details directly; we receive only a reference and status.
• Google Firebase: hosting, the product/order database and authentication for this store.
• Our redundant order backend: a copy of your order record (same data, held with equivalent protection) for business continuity.

Card details

Your card details never touch our servers. Payments happen inside Paystack's secure checkout, and we only ever receive a payment reference and a success or failure status.

How long we keep it

• Order records: retained for the period required by tax and consumer-protection law (at least six years), then deleted or anonymised.
• Contact messages: kept up to 24 months after the conversation ends, then deleted.
• Accounts: kept until you ask us to delete them. Deleting your account does not delete transaction records we must legally keep, but they are minimised and unlinkable from your account.

Your rights

Under the NDPA 2023 you have the right to: access the personal data we hold about you; ask us to correct it; ask us to delete it where we have no overriding legal obligation to keep it; object to or restrict processing; and complain to the Nigeria Data Protection Commission (NDPC) if you believe we mishandled your data.

To exercise any right, email jovitmedia@gmail.com with your request. We respond within 30 days.

Children

The store is not directed at children under 18, and we do not knowingly collect their data.