Privacy Policy · The Powede Edit

We do not sell your data, and we do not track you. The site sets one cookie, to keep your reservation attached to you. There is no analytics, advertising or social pixel anywhere on it.

1. Who we are

The Powede Edit LTD (RC 9692440) operates thepowedeedit.com and is the data controller for the personal data described in this policy.

Address: E5 Finima Close, Cowrie Creek Estate, Ikate, Lekki, Lagos
Country of establishment: Nigeria
Contact for any privacy question or request: admin@thepowedeedit.com

We process personal data under the Nigeria Data Protection Act 2023 (NDPA). Where you are in the European Economic Area or the United Kingdom and we offer goods to you there, we also process it under the EU or UK GDPR.

2. What we collect

When you browse

A randomly generated session identifier, stored in one cookie, so that a hold you place on a piece stays attached to your browser. Standard server request data such as your IP address, the time of the request and your browser user agent, which our hosting provider logs.

When you place a hold on a piece

Your email address and phone number, your session identifier, and the piece you are holding. Your IP address is used at this point for anti-abuse rate limiting and to verify the Cloudflare Turnstile challenge that separates people from bots.

When you check out

Your full name, email address, phone number, delivery address including city and state, the delivery area you are in, the piece, the delivery fee and the total. We also store the payment reference our payment provider returns.

We never see or store your card details. Card, bank transfer and USSD details are entered on Paystack's own payment page and never reach our servers or our database.

When you email us

Whatever you put in the message, including any photographs you send with a return or damage claim, and your email address.

We do not collect special category data, and nothing on this site asks you for it. Please do not send us health, religious, biometric or political information in a message to us.

3. Why we process it, and on what basis

Purpose	Data used	Legal basis
Hold a piece for you and take your order	Email, phone, session identifier, the piece	Contract
Take payment, deliver, and handle returns and refunds	Name, email, phone, delivery address, payment reference	Contract
Send hold, order, lapse and refund emails	Email, order details	Contract
Keep accounting, tax and sales records	Name, order details, amounts paid, payment reference	Legal obligation (Nigerian tax and company records)
Prevent fraud and abuse: rate limits, bot challenges, payment checks	IP address, hashed request identifier, challenge token	Legitimate interests in protecting buyers, stock and the shop
Secure and operate the site	Server request data: IP address, time, user agent	Legitimate interests in a safe, working storefront

Contract means NDPA s.25(1)(b) and GDPR Art. 6(1)(b). Legal obligation means NDPA s.25(1)(c) and GDPR Art. 6(1)(c). Legitimate interests means NDPA s.25(1)(f) and GDPR Art. 6(1)(f). Transactional emails are not marketing, and there is no marketing list to unsubscribe from.

4. Cookies

The storefront sets one cookie, tpe_session. It holds a random identifier, it is marked HttpOnly so scripts cannot read it, it is scoped to this site only, and it lasts twelve months. Its only job is to keep a hold you place on a piece attached to you while you complete checkout.

Because it is strictly necessary to deliver a service you asked for, it does not require consent, and there is no cookie banner to click through.

Our admin area sets a separate sign-in cookie, which applies to us and not to shoppers.

There are no analytics cookies, no advertising cookies, and no social media pixels on this site. We do not build profiles of you and we make no automated decisions that produce legal or similarly significant effects.

5. Who else processes your data

We use a small number of service providers. Each processes your data on our instructions, under a contract, and for no purpose of their own.

Provider	What it does	What it receives
Paystack (Nigeria)	Payment processing, regulated by the Central Bank of Nigeria	Name, email, phone, and the card or bank details we never see
Zoho Corporation	Inventory and invoicing	Name, email, phone, delivery address
Resend	Transactional email delivery	Email address, message content
Neon	Database hosting	The order and reservation records in section 2
Vercel	Website hosting	Request data, including IP address, in server logs
Cloudflare	Turnstile bot challenge on the hold form	IP address, challenge token
Upstash	Rate-limit counters	A hashed request identifier
Backblaze	Product photography storage	No customer data
Courier partners	Delivery, and customs declaration on international orders	Name, delivery address, phone

We may also disclose personal data where we are required to by law, by a court, or by a regulator, and to our professional advisers where necessary.

We do not sell personal data, and we do not share it for advertising.

6. International transfers

We are established in Nigeria. Some of the providers listed above store or process data outside Nigeria, principally in the United States and the European Union. Where personal data leaves Nigeria we rely on the transfer conditions in Part IX of the NDPA, including contractual safeguards with the recipient that bind it to an adequate level of protection.

Where personal data of people in the EEA or UK is transferred to Nigeria or elsewhere outside those areas, we rely on Standard Contractual Clauses or another safeguard permitted under Chapter V of the GDPR. You can ask us for details of the safeguard that applies to you.

7. How long we keep it

Order records, including name, address, phone and email: Six years from the end of the year of the order, to satisfy Nigerian tax and company record-keeping obligations, then deleted or anonymised.
Payment and refund records: Six years, on the same basis.
Holds that lapsed or were never paid for: Ninety days from the date the hold lapsed, then deleted.
Email correspondence: Two years from the last message in the thread, or six years where it relates to a disputed order.
Server and rate-limit logs: As retained by our hosting and rate-limit providers, typically under thirty days.
The session cookie: Twelve months, or until you clear your browser cookies.

8. How we protect it

All traffic to and from this site is encrypted in transit over HTTPS.
The database is encrypted at rest by our hosting provider.
Card details are never entered on, transmitted to, or stored by this site. Payment happens on Paystack.
The admin area is behind authentication and rate limiting, restricted to our staff.
The session cookie is HttpOnly and same-site, so it cannot be read by scripts.
Reservation and checkout endpoints are rate limited and protected by a bot challenge.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to you, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and will tell you directly where the risk to you is high (NDPA ss.40–41; GDPR Arts. 33–34).

9. Your rights

Under the NDPA, and under the GDPR where it applies to you, you can ask us to:

Confirm what personal data we hold about you, and give you a copy
Correct anything that is wrong or incomplete
Delete data we no longer have a lawful reason to keep
Restrict how we use it while a dispute about it is resolved
Give you the data you provided in a portable, machine-readable form, or send it to someone else
Stop processing carried out on the basis of our legitimate interests, where your circumstances outweigh them
Withdraw a consent you gave, without affecting what was lawful beforehand

Some of these have limits. We cannot delete an order record we are legally required to keep for tax purposes until that period expires, though we can restrict its use in the meantime.

To exercise any of these, email admin@thepowedeedit.com from the address on your order, or tell us your order number. We will respond within one month of receiving your request, and sooner where we can. If a request is complex enough that we need longer, we will tell you why inside that first month. We will not charge you, and we will not ask you to justify the request.

10. Complaints

If you are unhappy with how we have handled your data, please tell us first at admin@thepowedeedit.com, because most of it we can simply fix.

You also have the right to complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng. If you are in the EEA or the UK, you may instead complain to the supervisory authority where you live or work.

11. Children

This shop is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, email us and we will delete it.

12. Changes to this policy

We update this policy when what we do changes. The date at the top of this page is the date of the current version. Material changes will be flagged on the site rather than made quietly.

13. Contact

The Powede Edit
admin@thepowedeedit.com

How we use your delivery address to fulfil an order is set out in the Shipping & Delivery Policy, and the contract this data is processed under is in the Terms & Conditions.