Privacy

This explains what Hawlarfits does with your personal information. We are the ones responsible for it, which the Nigeria Data Protection Act 2023 calls the data controller. We run a small shop, we collect as little as we can get away with, and we do not sell any of it.

What we collect

Things you give us:

• Your email address, if you join the waitlist or ask us to tell you when a size is back.
• Your name, email, phone number and delivery address when you order.
• What you bought, the size and colour, and what you paid.
• Your transfer receipt, if you pay that way. It is an image you upload.
• Anything you write to us in a note at checkout, a message, or an exchange request.

Things we record as you use the site:

• A random token in a cookie so your bag survives a refresh or a new tab.
• Your IP address against actions taken in our admin, to keep an honest record of who did what.
• A count when someone scans the QR code printed on our packaging.
• A count of page views, with no cookie and nothing that points back to you.

We never see or store your card number, PIN or CVV. Payments happen on the payment provider's own pages and all we learn back is whether the payment worked, the amount, and a reference.

Why we keep it, and what allows us to

• To take your order, make it, deliver it and handle exchanges. We need this to do what you asked, which is our contract with you.
• To send order emails: confirmation, payment received, on its way, exchange updates. Same reason. These are not marketing and you cannot turn them off while an order is running.
• To answer your messages and sort out problems, because it is in our legitimate interest to run the shop properly.
• To remind you once about a bag you left behind, only if you gave us your email and only once, for the same reason.
• To send launch and waitlist emails, because you asked us to. You can ask us to stop at any time.
• To count visits, only with your consent.
• To keep accounting records and answer a payment dispute, because the law requires it.

Cookies

A cookie to hold your bag, and a cookie to keep you signed in when you claim your order history. Both are needed for the site to work and are always set.

We count page views with GoatCounter, which sets no cookie, keeps no profile and cannot follow you to another site. There is nothing to opt out of, and no advertising tracker anywhere on here.

Who else sees it

Only the services that make the shop work, and only the part each one needs:

• Our hosting and database provider, which stores the site and its records.
• Our payment provider, Paystack, which takes the payment.
• The courier delivering your parcel, which gets your name, address and phone number.
• The service that sends our emails.
• GoatCounter, which receives the page address and counts the visit.

None of them are allowed to use your information for their own purposes. We do not sell or rent it to anybody. We will hand it over if a court or a regulator lawfully requires it, and if the business is ever sold your order records go with it.

Information leaving Nigeria

Some of those services keep data on servers outside Nigeria. Where that happens we use providers who commit to protecting it to a standard the Nigeria Data Protection Act accepts.

How long we keep it

Order records stay for seven years, because tax and dispute rules expect it. Waitlist and back-in-stock emails stay until you ask us to remove them. Your bag is cleared out once it has sat unused for a long stretch. Ask us to delete something and we will delete whatever we are not required to keep.

Keeping it safe

The site runs over an encrypted connection, admin passwords are stored as hashes rather than as text, and only a few people have admin access. No system is perfect. If something ever goes wrong in a way that puts you at risk, we will tell you and the Nigeria Data Protection Commission.

Your rights

You can ask us to show you what we hold, correct something wrong, delete it, stop using it a particular way, or send it to you in a portable form. If you gave consent for something you can withdraw it, and that does not undo what was already done. Ask and we will answer within 30 days, free.

If you are not happy with how we handled it, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng.

Children

The shop is meant for adults. We do not knowingly collect anything from a child under 18. If you think we have, tell us and we will delete it.

Changes

When this changes, the date at the top changes with it. If the change is a big one we will say so on the site.

Getting in touch

Email [email protected] or message WhatsApp or Instagram, both @hawlarfits, to see, correct or delete what we hold about you.

Hawlarfits, RC 9645286, Agege, Lagos.