Privacy Policy

1. Scope and Nigerian privacy context

This policy applies to personal information handled by MarvellousGrace through this website and its official customer channels. MarvellousGrace aims to process personal data consistently with the Nigeria Data Protection Act 2023 and other applicable Nigerian requirements.

2. Information we may collect

• Identity and contact details, such as your name, telephone number, email address, and delivery or service address.
• Enquiry and transaction details, including requested products or services, sizes, colours, preferences, appointment information, order history, and customer-service correspondence.
• Payment-confirmation and record information, such as amount, date, payment reference, status, and limited payer details supplied by you or a payment provider.
• Delivery and collection information, including recipient details, delivery instructions, and fulfilment status.
• Information you choose to provide during beauty or styling enquiries, including relevant preferences, sensitivities, or accessibility needs.
• Technical information normally supplied when a website is accessed, such as IP address, browser or device type, requested pages, timestamps, and security or hosting logs.

MarvellousGrace does not need, and will never ask for, your banking PIN, one-time password, online-banking password, or confidential banking credentials.

3. WhatsApp, email, and telephone communications

When you choose WhatsApp, email, or telephone, MarvellousGrace receives the information you send and uses it to respond, take pre-contract steps, confirm a transaction, provide service, or maintain appropriate records. Those communication providers process information under their own privacy terms.

4. Why we use personal information

• Respond to enquiries and confirm product or service details.
• Process and fulfil orders, appointments, delivery, collection, returns, or refunds.
• Verify payments and keep accounting, transaction, and customer-service records.
• Communicate operational updates and manage customer relationships.
• Protect customers, the business, and the website against error, misuse, security incidents, and fraud.
• Comply with legal, regulatory, tax, accounting, and dispute-resolution requirements.
• Improve services and website reliability using proportionate operational information.

5. Lawful bases

Depending on the context, processing may be based on steps requested before a contract, performance of a contract, consent, compliance with a legal obligation, or a legitimate interest that is assessed against your rights and interests. Where processing depends on consent, you may withdraw that consent, although earlier lawful processing remains valid.

6. Sharing and service providers

MarvellousGrace may share only the information reasonably needed with delivery or logistics providers, communications providers, hosting and technical providers, professional advisers, and payment providers if an approved payment service is activated. Information may also be disclosed where legally required, to protect lawful rights, or to investigate fraud or security concerns.

MarvellousGrace does not sell personal information. Where a provider processes information outside Nigeria, appropriate consideration will be given to the applicable transfer safeguards and the level of protection required by Nigerian law.

7. Cookies and similar technology

The current Phase 1 website does not intentionally use advertising or behavioural-analytics cookies. Essential technical cookies or similar storage may be used by the website, browser, hosting, security, or embedded service only where needed to deliver, protect, or maintain the service. This section will be updated before optional analytics or marketing technology is introduced.

8. Marketing preferences

Promotional messages will be sent only where there is an appropriate lawful basis. You may ask MarvellousGrace to stop direct marketing at any time through the channel used or an official contact channel. Operational messages about an active enquiry, order, delivery, return, or appointment are not marketing.

9. Retention

Personal information is retained only for as long as reasonably necessary for the purpose collected, including customer service, fulfilment, accounting, tax, legal, fraud-prevention, and dispute records. Retention depends on the type of record and applicable requirements; information is then securely deleted, anonymised, or otherwise disposed of where appropriate.

10. Security and data incidents

MarvellousGrace uses reasonable administrative, technical, and physical measures appropriate to the nature of the information. No system is completely secure. Suspected incidents will be assessed, contained, documented, and notified to affected people or the relevant authority where required by applicable law.

11. Your privacy rights

Subject to applicable conditions and exceptions, you may have rights to:

• receive information about processing and request access to your personal data;
• request correction of inaccurate or incomplete information;
• request deletion or restriction where applicable;
• object to certain processing, including direct marketing;
• withdraw consent where consent is the lawful basis;
• request portability where applicable; and
• lodge a complaint with the Nigeria Data Protection Commission.

MarvellousGrace may need to verify your identity and clarify your request before responding. You can also learn about the regulator or its complaint channels on the Nigeria Data Protection Commission website.

12. Accuracy, children, photographs, and testimonials

Please keep your information accurate and tell MarvellousGrace when it changes. The website and general services are not directed to children acting independently; a parent or lawful guardian should provide information and consent where a child’s data is required for an appropriate service.

Customer photographs, names, reviews, or testimonials will not be published as customer endorsements without an appropriate permission or other lawful basis. Permission may be withdrawn for future use where consent is relied upon, subject to lawful record-keeping and material already lawfully produced.

13. Third-party links and future services

External sites and services have their own privacy practices. Future checkout, payment, media-management, or other features will be assessed and this policy updated before they materially change current processing. The current policy does not claim that Paystack or another online gateway is active.

14. Updates and contact

MarvellousGrace may update this policy to reflect operational, technology, or legal changes. The date above identifies the current version. For a privacy question or rights request, use an official channel and describe the information or request clearly.

For the commercial terms that apply to website use and orders, see the Terms & Conditions.