Privacy Policy

1. Who We Are

Liftude ("we", "our", "us") is an online gift retail store operating in Lagos, Nigeria. We are the Data Controller responsible for your personal data.

Contact: privacy@liftude.com | Lagos, Nigeria

2. What Data We Collect

We collect the following categories of personal data:

• Identity Data: Full name, date of birth, gender, government ID information (for KYC)
• Contact Data: Email address, phone number, delivery address (Lagos only)
• Transaction Data: Order history, payment records, purchase details
• Technical Data: IP address, browser type, device information, cookies
• KYC Data: National Identification Number (NIN), BVN, driver's license, voter's card, or passport information
• Communication Data: Customer service correspondence

3. Legal Basis for Processing

We process your personal data under the following lawful bases as provided by the NDPA 2023:

• Contract Performance: To process orders, arrange delivery, and manage your account
• Legal Obligation: For KYC/AML compliance and financial regulations
• Consent: For marketing communications and non-essential cookies (you may withdraw consent at any time)
• Legitimate Interests: For fraud prevention, security, and improving our services

4. How We Use Your Data

• Processing and fulfilling your orders
• Managing your account and delivering customer support
• Verifying your identity (KYC) as required by Nigerian law
• Processing payments through Paystack (our licensed payment processor)
• Sending order confirmations and delivery notifications
• Sending promotional messages (only with your consent)
• Detecting and preventing fraud and security threats
• Complying with legal and regulatory obligations

5. Data Sharing

We share your personal data only in the following circumstances:

• Paystack: Our payment processor, who handles all card and bank transactions. They process data under their own Privacy Policy.
• Delivery Partners: Logistics providers operating in Lagos who need your address to deliver orders.
• Legal Authorities: When required by Nigerian law, court order, or regulatory requirement.
• Service Providers: Cloud hosting and IT service providers under strict data processing agreements.

We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.

6. KYC Data Handling

Your KYC documents (government IDs, identification numbers) are:

• Encrypted at rest using industry-standard AES-256 encryption
• Accessed only by authorised Liftude verification staff
• Not shared with third parties except where required by law
• Retained for 7 years as required by Nigerian financial regulations
• Deleted upon your verified request (subject to legal retention requirements)

7. Data Retention

• Account Data: Retained while your account is active, plus 2 years after closure
• Order/Transaction Data: 7 years (legal and tax requirement)
• KYC Documents: 7 years from account closure
• Marketing Consent: Until withdrawn
• Technical/Log Data: 90 days

8. Your Rights Under NDPA 2023

As a data subject, you have the following rights:

• Right to Access: Request a copy of all personal data we hold about you
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data (subject to legal obligations)
• Right to Restriction: Request we limit processing of your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw marketing consent at any time
• Right to Lodge a Complaint: File a complaint with the Nigeria Data Protection Commission (NDPC)

To exercise any of these rights, visit your Account Privacy Settings or email privacy@liftude.com. We will respond within 30 days.

9. Security

We implement appropriate technical and organisational security measures including:

• HTTPS/TLS encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Password hashing using bcrypt with a cost factor of 12
• Role-based access controls
• Regular security audits and vulnerability assessments
• Activity logging and audit trails

10. Cookies

We use session cookies (essential for site function) and optional analytics cookies. You can manage cookie preferences in your browser settings. Essential cookies cannot be disabled as they are required for the website to function.

11. Children's Privacy

Our services are intended for persons aged 18 and above. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on our website. Continued use of our services after changes constitutes acceptance.

13. Contact & Complaints

For privacy-related questions or to exercise your rights:

• Email: privacy@liftude.com
• Address: Liftude Data Protection Officer, Lagos, Nigeria

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC): ndpb.gov.ng