Privacy Policy
Last updated: 29 September 2026
ShopBuilder ("we", "us") respects your privacy. This policy explains what personal data we collect, why, and the rights you have under the Nigeria Data Protection Act 2023 (NDPA) and the GAID 2025 issued by the Nigeria Data Protection Commission (NDPC).
1. Data we collect
- Account data: name, email address, phone number and password (stored only as a one-way hash).
- Order data: delivery address, items purchased, order notes and order history.
- Payment data: payment reference, amount, channel and the last 4 digits and type of your card. We never receive or store your full card number, CVV or PIN — these are entered directly on our payment provider's secure page.
- Technical data: IP address and security logs used to prevent fraud and abuse.
2. Why we use it (lawful basis)
- Contract: to process, deliver and support your orders.
- Legal obligation: to keep financial and tax records.
- Legitimate interest: to secure our platform and prevent fraud.
- Consent: to send marketing emails — only if you opt in. You can withdraw consent at any time.
3. Who we share it with
We share only what is necessary with: our payment processors (Paystack and Flutterwave), delivery partners (name, phone and address to deliver your order), and email service providers. We never sell your personal data.
4. How long we keep it
Account data is kept while your account is active. Order and payment records are retained for up to 6 years to meet tax and accounting obligations, after which they are deleted or anonymised. Security logs are kept for 90 days.
5. Security
We use HTTPS encryption, hashed passwords, encrypted sessions, rate limiting, strict access controls and continuous logging to protect your data. If a breach affecting your rights occurs, we will notify the NDPC within 72 hours and inform you without undue delay.
6. Your rights
You have the right to access, correct, export (portability), delete, restrict or object to the processing of your data, and to withdraw consent. You can download or delete your data yourself from your Profile page, or contact us. You may also lodge a complaint with the Nigeria Data Protection Commission.
7. Cookies
We group cookies into categories. You choose which optional ones to allow using the cookie banner, and you can change your choice at any time with “Cookie settings” at the bottom of every page. Your choice is remembered for 12 months in a small cookie_consent cookie.
- Strictly necessary (always on): a session cookie that keeps you signed in and holds your cart, a
guest_cartcookie that keeps a guest's cart for up to 30 days so it's still there when you come back, and a security token that protects forms and checkout against fraud (cross-site request forgery). The shop cannot work without these, so the law allows them without consent and they can't be switched off. Clicking “Reject all” turns off everything else. - Preferences (optional): remembers the products you've viewed so we can show them again under “Recently viewed”. Off unless you accept it.
We do not use advertising cookies without your permission.
Cart reminders for guests. If you check out without an account, you can tick “Email me one reminder if I don't finish my order”. Only then do we save your email with your cart, and we send at most one reminder. The email is removed when you untick the box, click “Delete my email from this cart” in the reminder, place your order, or after 30 days without activity.
We also send order updates by SMS to the phone number you provide, via our SMS provider. You can turn SMS updates off in your profile.
8. Changes
We will post any changes on this page and, for significant changes, notify you by email.