Privacy Policy

Kintela Privacy Policy

Last updated: 18 April 2025

Thank you for shopping with Kintela. Your privacy matters to us. This policy explains what personal data we collect, how and why we use it, the choices you have, and how we keep it safe. It is designed to comply with both the Nigeria Data Protection Act 2023 (NDPA/NDPR) and the UK GDPR.

1. Who We Are

Controller Contact Address
Kintela Ltd (UK) & Kintela Business Hub (Nigeria) – together “Kintela”, “we”, “us”, “our”. Nigeria (HQ): 59 Mississippi Street, Maitama, Abuja, Nigeria
United Kingdom (mail‑forwarding): 82A James Carter Road, Mildenhall, IP28 7DE, United Kingdom Email: contact@kintela.com

We have not yet appointed a formal Data Protection Officer. For all privacy questions, please use the contact details above.

2. Scope of this Policy

This policy applies to anyone who visits kintela.com or buys our products through our Shopify‑hosted storefront (the “Services”).

3. The Data We Collect

Category Examples Source
Identity & Contact Data First and last name, email address, telephone number, shipping & billing addresses, date of birth* Provided by you at account sign‑up, checkout or newsletter pop‑up
Transaction Data Products purchased, order value, delivery method, payment status (no card details stored by us) Generated when you place an order
Usage Data Pages viewed, referring pages, device type, browser & OS, cookies, IP address Collected automatically via Shopify and standard analytics cookies
Marketing Preferences Email opt‑in status Provided by you
Product Reviews / UGC Photos and written reviews you post Provided by you

*We do not knowingly collect data from anyone under 18. If we learn that a minor has provided data, we will delete it immediately.

4. How We Collect Data

  1. Account registration & checkout forms

  2. Guest checkout

  3. Newsletter / pop‑up opt‑ins

  4. Cookies & similar technologies placed by Shopify, Paystack and our analytics providers (see Section 11).

5. Why We Use Your Data & Legal Bases

Purpose Legal Basis (UK GDPR & NDPA)
Process and deliver your orders, provide customer support Performance of a contract
Fraud prevention and site security Legitimate interest; legal obligation
Basic site analytics & improvement Legitimate interest; consent where required
Marketing emails or SMS Consent (you can opt out anytime)
Compliance with tax, customs and other laws Legal obligation

We do not use automated decision‑making or profiling that produces legal or similarly significant effects.

6. Sharing Your Data

We share the minimum personal data necessary with:

  • Paystack – to process your payment securely (PCI‑DSS compliant; we never see or store your card number).

  • Logistics partners (e.g., DHL, FedEx, Nigerian local couriers) – to deliver your order and send tracking updates.

  • Shopify Inc. – hosts our storefront and stores order data on its secure servers located in the United States, Canada and/or EU depending on traffic routing.

  • Professional advisers (lawyers, accountants) and regulators where required by law.

We never sell or rent your personal data.

7. International Data Transfers

Because we operate in both Nigeria and the United Kingdom and use Shopify’s global infrastructure, your data may be transferred to — and processed in — countries outside your own. Wherever this happens we rely on:

  • UK & EU Standard Contractual Clauses (SCCs) or the UK International Data Transfer Addendum (IDTA); and

  • Shopify’s Binding Corporate Rules and Paystack’s contractual safeguards.

These mechanisms ensure your data receives a level of protection essentially equivalent to that in the UK and Nigeria.

8. Data Retention

Data Category Retention Period
Order & transaction records 6 years after your last purchase (for tax & accounting)
Customer account (inactive) Deleted or anonymised after 2 years of inactivity or on request
Newsletter & marketing data Until you unsubscribe or 2 years after last open/click, whichever is shorter
Analytics logs 26 months (Shopify default)

You may request deletion at any time (Section 10).

9. How We Keep Your Data Secure

  • Encryption in transit (HTTPS/TLS) and at rest (Shopify PCI‑DSS Level 1).

  • Tokenised payments – card details handled by Paystack, never stored on our servers.

  • Access controls – only staff who need the data can see it; all employees sign confidentiality agreements and receive annual privacy training.

  • Incident response plan – if we suspect a data breach we will notify affected users and regulators within the legally required timeframe.

10. Your Rights

Depending on your location, you may have the right to:

  1. Access – obtain a copy of the personal data we hold about you.

  2. Rectification – correct inaccurate or incomplete data.

  3. Erasure (“right to be forgotten”) – request deletion of your data when it is no longer needed.

  4. Restriction – limit the way we use your data.

  5. Objection – object to processing based on legitimate interests or direct marketing.

  6. Portability – receive your data in a structured, machine‑readable format.

  7. Withdraw consent at any time where processing is based on consent (e.g., marketing emails).

To exercise any of these rights, email contact@kintela.com. We will respond within one month.

If you believe we have not handled your request properly, you may complain to:

  • Nigeria Data Protection Commission (NDPC), or

  • UK Information Commissioner’s Office (ICO) if you are in the UK.

11. Cookies & Similar Technologies

Our Shopify store uses:

  • Strictly necessary cookies – session ID, shopping‑cart, checkout token.

  • Analytics cookies – Shopify’s own analytics and Google Analytics (anonymised IP).

  • Marketing cookies – only if you opt‑in to receive marketing.

When you first visit the site you will see a banner asking you to accept or manage non‑essential cookies. You can also block or delete cookies through your browser settings.

12. Changes to This Policy

We may update this policy from time to time. We will post any changes on this page and, if they are material, notify you by email at least 14 days before they take effect.

13. Contact Us

Questions, comments or requests about this policy? Please email contact@kintela.com

Thank you for trusting Kintela with your data.