This policy explains what personal data TOMORI collects when you use this site, why we collect it, and what you can do about it. We are the data controller, and we handle your data in line with the Nigeria Data Protection Act 2023.
What we collect
- Order details: your name, email address, phone number and delivery address. We need these to take payment and get the parcel to you.
- Account details: if you create an account, your email address and a password we never see in readable form.
- Payment details: handled entirely by Paystack. Card numbers never reach our servers and we cannot see them.
- Technical data: pages viewed and rough location, used to keep the site working and spot abuse. We count visitors using a code that changes every day, so nobody can be followed from one day to the next. We use no cookies for this and no third-party trackers.
- Scans of our printed codes: if you scan a QR code from one of our delivery bags, a card or a banner, we record that it was scanned, roughly where from, and whether it was a phone or a computer. It uses the same daily code as above, so one scan cannot be joined to another the next day, and it is never linked to your order or your name.
- An unfinished order: if you put something in your bag we keep a note of what is in it. If you reach checkout and type your name and email before stopping, we keep those too, so we can help you finish the order. This is only ever what you typed in yourself, and only on the checkout page.
Why we use it
To process and deliver your order, to answer you when you get in touch, to help you finish an order you started, to meet our tax and accounting obligations, and to protect the shop against fraud. We do not sell your data, and we do not share it with anyone except the suppliers below.
Who we share it with
- Paystack: to take payment.
- Supabase: to store orders and account data.
- Delivery partners: the name, address and phone number needed to deliver.
How long we keep it
Order records are kept for six years to satisfy Nigerian tax and accounting rules. Account data is kept until you ask us to delete it. An unfinished order is deleted after 30 days. Anything we no longer need is deleted.
Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete it. You can also object to how we are using it, or ask us to send it to someone else. Write to us and we will respond within 30 days. If you are not satisfied, you can complain to the Nigeria Data Protection Commission.
Keeping it safe
Data is encrypted in transit, access is restricted to the people who need it, and payment details never touch our systems. No system is perfect, so if a breach ever affects you we will tell you.
Contact us
Questions about this policy can go to tomoricollections@gmail.com or +234 903 397 9663. We are based in Lagos, Nigeria.