What we keep, and why.

1. Who we are

This store is operated by Ribnac Nigeria Limited (“Ribnac”, “we”, “us”), a company registered in Nigeria, operating from Enugu. We are the data controller for the personal information collected through ribnac.com. We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA). Questions, requests or complaints: hello@ribnac.com.

2. What we collect

• Account details — name, email address, phone number and a password (stored only as a secure hash, never in plain text), plus your member number.
• Order details — what you bought, when, delivery address and order history.
• Payment — payments are processed by Paystack. Your card or bank details go directly to Paystack and never touch our servers. We receive only a payment reference and confirmation of the amount paid.
• Messages — anything you send to hello@ribnac.com.

We do not run advertising trackers or sell analytics profiles. The only browser storage we use is the session cookie that keeps you signed in and the local storage that remembers your bag.

3. Why we use it (lawful bases)

• To fulfil your orders (performance of a contract): processing payment confirmations, delivering, and sending order emails.
• To run your account (performance of a contract): sign-in, order history, saved addresses, member benefits.
• To tell you about new pieces and member offers (consent): only if you opt in, and every email includes a way out. Transactional emails (receipts, sign-in links) are sent regardless because your orders don’t work without them.
• To meet legal obligations: tax and accounting records of sales.

4. Who touches your data

We share personal data only with the services that run this store, each bound by their own compliance obligations:

• Paystack (Paystack Payments Limited) — payment processing.
• Supabase — our database and sign-in system (hosted in the EU, Frankfurt region).
• Cloudflare — website hosting, security and email routing.
• Resend — sending our emails.
• Delivery partners — your name, phone and address, so your order can reach you.

We never sell your personal data. Some of these providers store data outside Nigeria; where that happens, transfers rest on the providers’ standard contractual safeguards as permitted by the NDPA.

5. How long we keep it

Your account lives until you delete it. Order records are kept for six years for tax and accounting purposes, then removed. Emails to hello@ribnac.com are kept as long as needed to resolve the conversation.

6. Your rights

Under the NDPA you can, at any time:

• ask for a copy of the personal data we hold about you;
• ask us to correct anything that’s wrong;
• ask us to delete your data (we’ll do it within 30 days, keeping only what tax law requires us to keep);
• withdraw marketing consent with one click or one email;
• complain to the Nigeria Data Protection Commission if you think we’ve fallen short.

All requests: hello@ribnac.com. We answer within a working day and resolve within 30 days.

7. Security

Connections to this site are encrypted (HTTPS). Passwords are hashed. Database access is locked so that each customer can only ever read their own records. Payment credentials never reach us at all.

8. Children

This store is not directed at children under 18, and we do not knowingly collect their data.

9. Changes

If this policy changes materially, we’ll say so on this page and, for signed-in customers, by email. The date at the top always tells you when it last moved.