1. Who We Are
This website, zingybeddings.com, is run by Zingy Beddings (RC 7452356), of 2 Ajagba Street, off Fijabi Street, Agric, Ikorodu, Lagos, Nigeria ("Zingy", "we", "us"). We are the data controller for the personal data described in this policy.
We process personal data in line with the Nigeria Data Protection Act 2023 ("NDPA") and the regulations and directives issued under it by the Nigeria Data Protection Commission ("NDPC").
For any privacy question or request, email hello@zingybeddings.com with "Privacy" in the subject line.
2. What This Policy Covers
This policy applies when you browse our website, buy from us, contact us by email, phone, WhatsApp or our contact form, or follow us on social media. It does not cover other websites we link to, such as Paystack's payment page, which have their own privacy policies.
3. Information We Collect
Information You Give Us
- Order details: your name, email address, phone number, delivery address and any delivery notes.
- Messages: what you tell us when you contact us, including your name, email, phone number and the content of your message.
- Returns and complaints: details and photos you send us about an order.
Information Created When You Buy
- Your order history: what you bought, prices, delivery option, order status and dates.
- Payment confirmation from Paystack: the transaction reference, amount, currency, time and outcome. We never see or store your full card number, PIN, CVV or bank login. These are handled entirely by Paystack.
Information Collected Automatically
- Technical data: your IP address, browser type, device type and the pages you request. Our hosting provider, Cloudflare, processes this to deliver the website and protect it from attacks.
- Cookies: a small number of strictly necessary cookies, such as the one that remembers your cart. See our cookie policy.
We do not use advertising trackers, and we do not collect sensitive personal data such as health, religious or biometric information.
4. How and Why We Use It
The NDPA requires us to have a lawful basis for each use of your personal data. Ours are:
| What We Do | Lawful Basis |
|---|---|
| Process and deliver your order, take payment, send order and delivery updates | Performance of a contract with you |
| Handle returns, refunds, exchanges and complaints | Performance of a contract; legal obligation |
| Reply to your messages and questions | Legitimate interests (helping customers); performance of a contract where it relates to an order |
| Keep accounting and tax records | Legal obligation |
| Prevent fraud, spam and abuse, and keep the website secure | Legitimate interests; legal obligation |
| Send marketing emails or messages, if you opt in | Consent, which you can withdraw at any time |
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Who We Share It With
We never sell or rent your personal data. We share it only with trusted service providers who help us run the business, under contracts that require them to protect it and use it only on our instructions:
- Paystack (payments): to process your payment securely.
- Cloudflare (hosting, database, security and file storage): to run this website and store order records.
- Mailgun (email delivery): to send order confirmations, delivery updates and replies to your messages.
- Delivery partners and dispatch riders: your name, phone number and delivery address, only so they can deliver your order.
We may also disclose personal data where the law requires it, for example to a court, a regulator or law enforcement with a valid legal request, or to protect our rights, our customers or the public from fraud or harm.
6. Transfers Outside Nigeria
Some of our service providers process data on servers outside Nigeria. Cloudflare operates a global network, and Mailgun processes email on servers in the United States or the European Union. Where personal data leaves Nigeria, we rely on the transfer grounds allowed by the NDPA, including appropriate contractual safeguards with the provider and, where needed, your consent, and we take steps to make sure your data receives an adequate level of protection.
7. How Long We Keep It
| Data | How Long |
|---|---|
| Order and payment records | Six years after the order, to meet tax and accounting obligations |
| Unpaid or abandoned orders | Up to 90 days, then deleted |
| Contact form messages and emails | Up to two years after our last exchange |
| Cart cookie | 30 days, or until you check out or clear your cookies |
| Marketing preferences | Until you unsubscribe, then kept only as a "do not contact" record |
When data is no longer needed, we delete it or anonymise it so it can no longer identify you.
8. How We Protect It
We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS) on every page, payments handled entirely by Paystack, an administration area protected by Cloudflare Access with verified sign-in, access limited to staff who need it, and security headers that protect against common web attacks.
No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the NDPC within 72 hours of becoming aware of it, as the NDPA requires, and tell you without undue delay where the risk to you is high.
9. Your Rights
Under the NDPA, you have the right to:
- Be informed about how we use your personal data, which is the purpose of this policy.
- Access the personal data we hold about you and receive a copy.
- Correct data that is inaccurate or incomplete.
- Erase your data where we no longer have a lawful reason to keep it.
- Restrict how we use your data in certain circumstances.
- Data portability: receive your data in a structured, commonly used, machine-readable format, or have it sent to another organisation where technically feasible.
- Object to processing based on our legitimate interests, and to direct marketing at any time.
- Withdraw consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.
To use any of these rights, email hello@zingybeddings.com. We may need to confirm your identity first. We aim to respond within 30 days and will not charge you, unless a request is clearly unfounded or excessive. Some rights have limits; for example, we must keep order records for tax purposes even if you ask us to erase them, and we will explain if that applies.
10. Marketing
We will only send you marketing messages if you have agreed to receive them. Every marketing email includes a link to unsubscribe, or you can email us at any time. Service messages about your order, such as confirmations and delivery updates, are not marketing and will still be sent.
11. Children
Our website is intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it.
12. Cookies
We use only the cookies needed to run the shop and keep it secure. Full details are in our cookie policy.
13. Changes to This Policy
We may update this policy when our services or the law change. The date at the top shows when it was last updated. If a change significantly affects how we use your personal data, we will tell you by email or with a clear notice on the website.
14. Contact and Complaints
Questions or concerns? Contact us first and we will do our best to help:
- Email: hello@zingybeddings.com
- Phone: +234 805 048 1015 or +234 701 146 9597
- Post: Zingy Beddings, 2 Ajagba Street, off Fijabi Street, Agric, Ikorodu, Lagos, Nigeria
If you are not satisfied with our response, you have the right to complain to the Nigeria Data Protection Commission (NDPC), the regulator for data protection in Nigeria.