This Privacy Policy explains how Arinola Fashion and Beauty (“Arinola”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects personal data when you visit our website, contact us, place an order, request a consultation, or otherwise interact with us.

Arinola is the data controller for the processing described here. This policy is intended to reflect the Nigeria Data Protection Act 2023 and other applicable privacy requirements. It does not replace our commercial terms, returns, payment, or delivery policies, which are addressed in our Terms and Conditions.

Depending on how you interact with us, we may collect:

• Identity and contact details, including your name, email address, telephone number, delivery address, and social-media or messaging handle.
• Order and transaction details, including products, sizes, measurements, preferences, delivery instructions, payment status, order history, refunds, and correspondence about a purchase.
• Consultation and fit information you choose to provide, including body measurements, photographs, videos, or styling preferences needed to create or alter a garment.
• Technical and usage data, including IP address, browser and device type, approximate location, pages viewed, referring page, and interactions with the website.
• Communications, feedback, survey responses, support requests, and records of your consent or marketing preferences.

Please do not send information that is unnecessary for your order or request. We do not intentionally collect payment-card details directly; payment information is handled by the payment provider used at checkout.

We collect data directly from you when you complete checkout, submit a form, communicate by email, WhatsApp, SMS, telephone, or social media, attend a consultation, or provide measurements. We also collect some technical data automatically through website storage and analytics, and may receive payment confirmation, delivery updates, or fraud-prevention information from service providers involved in your transaction.

We process personal data only where we have a lawful basis, including:

• Contract: to confirm, produce, personalise, deliver, track, alter, return, or refund an order and provide requested customer support.
• Consent: for optional marketing and where consent is the appropriate basis for particular information or technology. You may withdraw consent at any time without affecting earlier lawful processing.
• Legal obligation: to keep required business and tax records, respond to lawful requests, protect legal rights, and meet regulatory duties.
• Legitimate interests: to secure and improve our website, prevent fraud, understand service performance, manage the business, and communicate with customers, where those interests are not overridden by your rights and interests.

Where we need data to enter into or perform a contract, failure to provide it may mean we cannot accept, personalise, or deliver your order.

Made-to-order and alteration services may require body measurements and, where you choose to provide them, photographs or videos showing fit or measurement technique. We use this information only to provide the requested garment, consultation, alteration, quality review, or dispute resolution.

Please share such information only through a channel agreed with our team. We restrict access to people who need it for the relevant order and retain it only for as long as reasonably necessary for that purpose and our legitimate record-keeping needs.

The website uses browser storage for functions such as remembering cart contents, interface preferences, and dismissed notifications. Removing or blocking this storage may cause some website features to stop working correctly.

We use Google Analytics to understand visits and interactions with the website. This service may use cookies or similar identifiers and collect technical and usage information. You can control cookies through your browser and may use Google's available opt-out tools. Where applicable law requires consent for non-essential analytics, we will seek that consent before activating them.

We do not sell your personal data. We may share limited data with:

• Payment providers, including Paystack, to process and verify transactions.
• Delivery companies, fulfilment partners, and customs authorities to deliver and clear orders.
• Website, cloud, database, analytics, communications, and security providers, including Google services.
• Professional advisers, insurers, auditors, or regulators where reasonably necessary or legally required.
• A buyer, investor, or successor in connection with a genuine sale, restructuring, or transfer of the business, subject to appropriate confidentiality and data-protection safeguards.

Service providers may use personal data only for the relevant service or as otherwise permitted by law. We disclose only information that is reasonably necessary for the stated purpose.

Some service providers or their systems may be located outside Nigeria. Where personal data is transferred internationally, we take reasonable steps to use a transfer mechanism or safeguard recognised under applicable law, such as an adequate level of protection, contractual or other approved safeguards, consent where appropriate, or a transfer necessary to perform your contract. You may contact us for information about safeguards relevant to your data.

We retain personal data only for as long as necessary for the purpose for which it was collected, including fulfilling orders, handling support and warranty issues, complying with tax and accounting duties, resolving disputes, preventing fraud, and enforcing agreements.

Retention periods vary according to the type of record, legal duties, the sensitivity of the data, and potential claims. When data is no longer required, we delete, anonymise, or securely isolate it. You may ask about the period applicable to a particular category of data.

We use reasonable organisational and technical safeguards designed to protect personal data from accidental or unlawful loss, alteration, disclosure, or access. These include access controls, restricted staff access, reputable service providers, and secure transmission where appropriate. No internet or storage system is completely secure, so we cannot guarantee absolute security. If a breach creates a risk requiring notification, we will notify affected individuals and the Nigeria Data Protection Commission as required by law.

Subject to applicable conditions and exceptions, you may have the right to:

• Receive information about how your personal data is processed.
• Request access to and a copy of your personal data.
• Correct inaccurate or incomplete personal data.
• Request deletion where there is no lawful reason to retain it.
• Restrict or object to certain processing.
• Receive qualifying data in a commonly used, machine-readable format or request its transfer where technically feasible.
• Withdraw consent and object to direct marketing at any time.
• Not be subject to a decision based solely on automated processing that has legal or similarly significant effects, where applicable.
• Lodge a complaint with the Nigeria Data Protection Commission.

To protect you, we may request information needed to verify your identity. We will respond within the period required by applicable law and explain if an exception prevents us from fulfilling a request.

We send promotional email, SMS, or messaging communications only where we have an appropriate lawful basis. You may opt out at any time using the unsubscribe method in the message or by contacting us. Opting out of marketing does not stop necessary communications about an active order, payment, delivery, or support request.

Our website and products are not directed to children who cannot lawfully consent to the relevant processing on their own. A parent or legal guardian should place and manage an order for a child. If you believe a child has provided personal data without appropriate authorisation, please contact us so we can investigate and take suitable action.

Our website may link to third-party websites, social networks, payment pages, or messaging platforms. Their privacy practices are governed by their own notices, not this policy. We encourage you to review those notices before providing personal data.

We may update this policy when our practices, services, or legal duties change. The effective date above identifies the latest version. Where a change is material, we will provide an appropriate notice through the website or another reasonable channel.

To ask a privacy question, exercise a right, or raise a complaint, email info@arinolafb.com or use our contact page. Please write “Privacy Request” in the subject line where possible.

We encourage you to contact us first so we can address your concern. You also have the right to complain to the Nigeria Data Protection Commission through its official complaint or breach-reporting channels.