Rawura runs the Rawura online store and is responsible for your personal data (the “data controller”). We handle it in line with the Nigeria Data Protection Act 2023.

• Contact and account details: your name, email address, phone number, and delivery and billing addresses. If you sign in with Google, we receive your name, email and Google account ID.
• Orders: what you bought, prices, delivery method, order and return history, and messages or photos you send with a return.
• Payments: Paystack processes your payment. We receive the payment reference, amount and status, and may receive the card type and its last four digits. We never receive or store your full card number or PIN.
• Reviews you write, with your name as shown on the review.
• Technical data: your IP address and device/browser information, kept in security logs to protect accounts (for example to limit repeated sign-in attempts) and to notify you of password changes.

• To take, deliver and support your orders, including returns and refunds: needed to perform our contract with you.
• To send service emails such as order confirmations, delivery updates, password resets and return decisions: needed for the contract and to keep your account secure.
• To send marketing emails about new products and offers: only with your consent, which you can withdraw at any time.
• To prevent fraud and keep the site secure: our legitimate interest in protecting you and the store.
• To keep financial records required by tax and accounting law: a legal obligation.

We don't sell your personal data. We share only what each provider needs to do its job for us:

• Paystack, to process payments and refunds.
• GIG Logistics, to deliver your order (name, phone number and delivery address).
• Our email provider, to send you emails.
• Hosting and storage providers (including Bunny.net for uploaded images), who store data on our behalf.
• Google, only if you choose to sign in with Google.
• Authorities, where the law requires it.

Some of these providers process data outside Nigeria. Where they do, we rely on the safeguards the Nigeria Data Protection Act allows.

We use only what the site needs to work: a cookie that keeps you signed in, and storage in your browser for your cart, wishlist and recent searches. We don't use advertising or analytics cookies. If you block cookies, you won't be able to sign in or check out.

• Account details: while your account is open. When you delete your account, they are removed 7 days later (you can cancel until then).
• Orders, payments and refunds: as long as tax and accounting law requires (generally six years).
• Security logs: for a short period, then deleted.
• Marketing consent: until you unsubscribe; we keep a record that you opted out so we don't email you again.

Passwords are stored as one-way hashes, the site uses encrypted connections (HTTPS), and only staff who need your data to do their job can see it, with their actions logged.

You can ask us to:

• give you a copy of the personal data we hold about you;
• correct data that is wrong (you can also edit your details in My Account);
• delete your data, where we don't need to keep it by law;
• stop or restrict using it, or object to how we use it;
• send your data to you or another organisation in a portable format;
• stop marketing emails (use the unsubscribe link in any marketing email, or My Account → Settings).

You can download a copy of your data or delete your account yourself, in My Account → Settings → Your data. For anything else, contact us from the email address on your account. We reply within 30 days. If you're not satisfied, you can complain to the Nigeria Data Protection Commission.

The store is not intended for children under 13, and we don't knowingly collect their data.

We'll update this page when our practices change, and change the date at the top. If a change is significant, we'll tell you by email or on the site.