Privacy policy

VELT Stores Ltd (“VELT”, “we”) runs veltstores.com and is the data controller for the personal data described here. You can reach us about anything in this policy at hello@veltstores.com.

• Account details: your name and email, and your password (stored securely by our authentication provider; we never see it). If you sign in with Google, we receive your name, email and profile picture from Google.
• Order details: delivery name, phone number, email and address, the pieces you buy and what you paid.
• Payment confirmation: payments are handled by Paystack. We receive confirmation that a payment succeeded and a reference, but never your full card or bank details.
• Newsletter: your email and, if you choose, your WhatsApp number, plus a record of when you agreed to hear from us.
• Favourites and bag: pieces you save or add to your bag. These are kept in your browser and, if you're signed in, on your account.
• Technical data: basic information your browser sends when you visit (such as IP address and device type), used to run and secure the site.
• How you use the site: pages you visit, how long you stay and how far you scroll, pieces you view, save or add to your bag, searches, and checkout steps reached. This is linked to a random identifier, not your name, unless you're signed in.

• To process and deliver your orders, and to contact you about them (performance of a contract)
• To run your account, keep your favourites and show your order history (performance of a contract)
• To send drop announcements and offers by email or WhatsApp, only if you've opted in (consent, which you can withdraw at any time)
• To keep the site secure, prevent fraud and fix problems (legitimate interests)
• To understand how the site is used, such as where people get stuck or leave, so we can improve it, and occasionally to remind a signed-in customer about a piece left in their bag (legitimate interests)
• To keep records we're legally required to keep, such as tax records (legal obligation)

We share personal data only with service providers who help us run VELT, and only what they need:

• Supabase: our database and account sign-in
• Vercel: website hosting
• Paystack: payment processing
• Google: only if you choose to sign in with Google
• Delivery partners: the name, phone number and address needed to deliver your order

Some of these providers process data outside Nigeria. Where that happens we rely on their contractual and security commitments to protect it to the standard Nigerian law requires. We never sell your personal data.

We use essential cookies to keep you signed in, and your browser's local storage to remember your bag, favourites, whether you've seen the newsletter offer, and a random visitor identifier for our own site analytics. Analytics are first-party: the data stays with us and our database provider, and isn't shared with advertisers. If your browser sends a “Do Not Track” or Global Privacy Control signal, we don't record analytics at all. We don't use advertising cookies, and if we ever add third-party analytics or marketing tools we'll update this policy first.

• Order records: as long as tax and accounting law requires
• Account data: until you ask us to delete your account
• Newsletter data: until you unsubscribe, after which we keep only a record that you opted out
• Site usage data: up to 13 months, then deleted

Under the Nigeria Data Protection Act 2023 you can:

• Ask for a copy of the personal data we hold about you
• Ask us to correct anything inaccurate
• Ask us to delete your data, where we don't need to keep it by law
• Object to, or ask us to restrict, how we use it
• Withdraw consent for marketing at any time (every message includes a way to unsubscribe)
• Receive your data in a portable format

Email hello@veltstores.comto use any of these rights; we'll respond within the time the law allows. If you're unhappy with how we've handled your data, you can complain to the Nigeria Data Protection Commission.

Data is stored with access controls so that customers can see only their own records and only authorised staff can see orders. Connections to the site are encrypted. No system is perfectly secure, but we'll tell you and the regulator promptly if a breach affects your data.

If we change this policy we'll update the date at the top, and tell you directly if the change is significant.