Privacy Policy

Slay by Candie (“Slay by Candie,” “we,” “us,” or “our”) is a Nigerian women's fashion retailer operating the website [slaybycandie.com] (the “Website”). We source and sell limited-run dresses, co-ord sets, loungewear, bags, and related fashion products.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when you visit our Website, create an account, place an order, contact us, or otherwise interact with us.

This Policy is intended to comply with applicable Nigerian data protection requirements, including the Nigeria Data Protection Regulation 2019 (“NDPR”), the Nigeria Data Protection Act 2023 (“NDPA”), and applicable guidance issued by the Nigeria Data Protection Commission (“NDPC”).

1. Who is responsible for your personal data?

The data controller responsible for your personal data is:

Slay by Candie
Legal entity: SlayByCandie Ventures
Website: [slaybycandie.com]
Email: legal@slaybycandie.com
Address: Lekki, Lagos, Nigeria

If a different legal entity operates or processes orders through the Slay by Candie brand, that entity will be identified in the applicable order confirmation, invoice, or other customer communication.

2. Personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data:

2.1 Information you provide to us

This may include:

• Full name;
• Email address;
• Telephone number;
• Billing and delivery address;
• Account login details;
• Order history and product preferences;
• Items purchased;
• Delivery and fulfilment details;
• Communications with our customer support team;
• Reviews, feedback, enquiries, and other information you voluntarily submit; and
• Marketing preferences and consent choices.

2.2 Payment and transaction information

When you pay for an order, we may receive payment confirmation, transaction references, payment status, amount paid, and related transaction details from our payment service provider.

We do not store full card numbers, CVV numbers, PINs, or other complete card details on our servers. Payment information is handled through secure payment-processing services, and checkout information is encrypted in transit.

We may retain limited payment and transaction information where necessary for order fulfilment, accounting, fraud prevention, dispute resolution, and legal compliance.

2.3 Technical and usage information

When you use the Website, we may automatically collect limited technical information, such as:

• IP address;
• Browser type and version;
• Device type and operating system;
• Website pages viewed;
• Referring website or link;
• Approximate location derived from technical information;
• Date, time, and duration of visits; and
• Cookie identifiers and similar online identifiers.

We use this information to operate, secure, improve, and understand use of the Website.

2.4 Information from third parties

We may receive personal data from:

• Payment processors confirming payment;
• Logistics and delivery partners providing delivery updates;
• Website, hosting, analytics, security, and technology providers;
• Fraud-prevention and identity-verification providers, where applicable; and
• Marketing or social media platforms where you interact with our content or advertisements.

We expect third parties that process personal data for us to handle it lawfully, securely, and only for authorised purposes.

3. How we use your personal data

We may use personal data to:

• Create and administer your customer account;
• Process, confirm, fulfil, ship, and deliver your orders;
• Process order-related and customer requests;
• Confirm payment and prevent or investigate fraud;
• Communicate with you about orders, deliveries, account activity, and support matters;
• Provide customer service and respond to enquiries;
• Apply promotional offers, including the 20% first-order discount using code SLAY20;
• Send marketing communications where you have provided the required consent;
• Personalise and improve your shopping experience;
• Understand product demand, customer preferences, and Website performance;
• Maintain, troubleshoot, and secure the Website;
• Detect, prevent, and respond to unlawful activity, misuse, security incidents, and abuse;
• Establish, exercise, or defend legal claims;
• Comply with applicable legal, regulatory, tax, accounting, and law-enforcement requirements; and
• Carry out other purposes disclosed to you at the time of collection or otherwise permitted by law.

We will not use your personal data for purposes that are incompatible with the purpose for which it was collected unless we have a lawful basis to do so and provide any notice required by law.

4. Lawful bases for processing

Depending on the circumstances, we may process your personal data on one or more of the following lawful bases recognised under the NDPR, NDPA, and other applicable law:

4.1 Performance of a contract

We process information where it is necessary to:

• Accept and fulfil your order;
• Arrange payment or delivery;
• Manage your customer account; or
• Provide services you have requested.

4.2 Consent

We may rely on your consent to:

• Send promotional emails, messages, or other marketing communications;
• Use optional analytics, advertising, or personalisation cookies;
• Process information for another purpose where consent is specifically required; or
• Carry out other activities clearly presented to you for approval.

You may withdraw consent at any time. Withdrawal will not affect processing that took place before withdrawal or processing that may lawfully continue on another basis.

4.3 Legal obligation

We may process personal data where necessary to comply with legal or regulatory obligations, including tax, accounting, consumer protection, fraud prevention, court, and law-enforcement requirements.

4.4 Legitimate interests

We may process personal data where necessary for our legitimate interests, or those of a third party, provided that those interests are not overridden by your rights and freedoms. These interests may include:

• Operating and improving our fashion e-commerce business;
• Securing our Website and systems;
• Preventing fraud and misuse;
• Managing customer relationships;
• Measuring and improving customer experience; and
• Establishing, exercising, or defending legal claims.

4.5 Vital or public interests

Where permitted by law, we may process personal data where necessary to protect vital interests or perform a task carried out in the public interest.

5. Marketing communications

We may send you marketing communications about new arrivals, limited-run collections, restocks, promotions, best sellers, events, and other Slay by Candie updates where:

• You have provided consent;
• We are otherwise permitted to do so by applicable law; or
• You have made a purchase and the communication concerns similar products or services, subject to applicable requirements.

Every marketing communication will include an unsubscribe or opt-out method where required. You may also contact us at legal@slaybycandie.com to withdraw marketing consent.

Withdrawing marketing consent will not affect transactional communications, such as order confirmations, delivery updates, or important service messages.

6. Who we share personal data with

We do not sell, rent, or trade your personal data.

We may share personal data with carefully selected recipients where necessary for the purposes described in this Policy, including:

• Payment processors, to securely process payments and confirm transactions;
• Logistics and delivery partners, to deliver orders and provide delivery updates;
• Website hosting, cloud storage, technology, and security providers, to operate and protect the Website;
• Customer support and communication providers, to help us respond to enquiries;
• Analytics, advertising, and marketing providers, where permitted and, where required, based on your consent;
• Professional advisers, including legal, accounting, audit, insurance, and financial advisers;
• Government authorities, regulators, courts, and law-enforcement agencies, where disclosure is required or legally permitted;
• Business purchasers or advisers, in connection with a proposed or completed merger, acquisition, restructuring, financing, or sale of assets; and
• Other service providers where disclosure is necessary to provide a service you have requested or to protect our rights, customers, Website, or business.

Where a third party processes personal data on our behalf, we require appropriate confidentiality, security, and data protection commitments consistent with applicable law.

7. International transfers

Some of our service providers, including technology, hosting, payment, analytics, security, or communications providers, may process personal data outside Nigeria.

Where personal data is transferred outside Nigeria, we will take reasonable steps to ensure that the transfer is permitted under the NDPR, NDPA, and applicable regulatory guidance. Depending on the circumstances, we may rely on:

• An adequacy decision or other recognised basis;
• Appropriate contractual, organisational, or technical safeguards;
• The necessity of the transfer to perform your contract or fulfil your order;
• Your informed and specific consent, where required;
• The establishment, exercise, or defence of legal claims;
• The protection of vital interests; or
• Another lawful transfer mechanism recognised under Nigerian law.

We will take reasonable steps to ensure that recipients protect personal data and process it only for authorised purposes.

8. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including to:

• Fulfil orders and provide customer support;
• Maintain accurate business, tax, accounting, and transaction records;
• Prevent fraud and protect the security of our systems;
• Establish, exercise, or defend legal claims;
• Comply with legal or regulatory obligations; and
• Manage your marketing preferences and consent records.

When personal data is no longer required, we will delete it, anonymise it, or securely restrict access to it in accordance with our retention procedures.

Retention periods may vary depending on the type of information, the reason it was collected, legal requirements, and whether a dispute or investigation is ongoing.

9. Your data protection rights

Subject to applicable legal exceptions and verification requirements, you may have the right to:

• Be informed about how your personal data is processed;
• Request access to personal data we hold about you;
• Request correction of inaccurate, incomplete, or outdated personal data;
• Request deletion or erasure of your personal data;
• Request restriction of processing in appropriate circumstances;
• Object to processing based on legitimate interests;
• Object to direct marketing;
• Request transfer or portability of personal data where applicable;
• Withdraw consent where processing is based on consent;
• Request information about international transfers and recipients;
• Request human review of certain decisions based solely on automated processing, where applicable; and
• Lodge a complaint with the relevant data protection authority.

These rights are not absolute. For example, we may need to retain certain information to comply with law, complete a transaction, prevent fraud, protect the rights of others, or establish or defend legal claims.

10. How to exercise your rights

To exercise a privacy right or ask a question about this Policy, contact:

Email: legal@slaybycandie.com
Subject line: Privacy Request

Please provide enough information for us to understand your request. We may need to verify your identity before responding, particularly where the request involves access to or deletion of personal data.

We will respond within the period required by applicable law. If we need additional information, or if a lawful exception applies, we will explain this where permitted.

You may also contact the Nigeria Data Protection Commission if you believe your personal data has been processed unlawfully or your rights have not been adequately addressed.

11. Cookies and similar technologies

Cookies are small text files placed on your device when you visit a website. We may use cookies and similar technologies to:

• Keep the Website functioning;
• Remember items in your shopping bag and checkout preferences;
• Maintain account sessions;
• Protect the Website against fraud and abuse;
• Understand how visitors use the Website;
• Improve Website performance and design;
• Measure the effectiveness of campaigns; and
• Personalise content or advertising where permitted.

11.1 Necessary cookies

Necessary cookies support core Website functions, including account access, shopping-bag functionality, checkout, security, and order processing. The Website may not operate correctly if these cookies are disabled.

11.2 Optional cookies

Where applicable, analytics, advertising, personalisation, or other non-essential cookies will be used in accordance with applicable consent requirements.

You may manage cookies through your browser settings and, where available, our cookie banner or consent controls. Blocking or deleting cookies may affect certain Website features.

Third-party providers may place their own cookies or similar technologies when they provide services through the Website. Their use of information may be governed by their own privacy policies.

12. Security measures

We use reasonable technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, access, or other unlawful processing.

These measures may include:

• Encrypted checkout and secure transmission of payment information;
• Not storing full card details on our servers;
• Access controls and role-based permissions;
• Use of reputable service providers;
• Authentication and account safeguards;
• Monitoring for suspicious activity;
• Secure handling of customer support and order information; and
• Staff and contractor confidentiality obligations.

No method of transmission or storage is completely secure. You should protect your account credentials and notify us promptly if you believe your account or personal data has been compromised.

If we become aware of a personal data breach affecting your rights or freedoms, we will take the steps required by applicable law, which may include notifying the NDPC and affected individuals where required.

13. Children's privacy

The Website is intended for adults. You must be at least 18 years old to create an account or place an order through the Website.

We do not knowingly collect or intentionally request personal data from children under 18 for account creation or purchases. If we learn that we have collected personal data from a person under 18 without an appropriate lawful basis or parental or guardian involvement where required, we will take reasonable steps to delete the information.

If you believe a person under 18 has provided personal data to us, please contact legal@slaybycandie.com.

14. Automated decision-making and profiling

We may use automated tools provided by payment, fraud-prevention, security, analytics, or technology providers to help identify suspicious activity, protect the Website, or improve services.

We do not intend to make decisions producing legal or similarly significant effects about you solely through automated processing. Where applicable law gives you a right to request human intervention or review, you may contact us using the details in this Policy.

15. Third-party websites and services

The Website may contain links to third-party websites, social media platforms, payment services, delivery services, or other external services.

We are not responsible for the privacy practices, security, or content of third-party websites or services. We encourage you to review their privacy policies before providing personal data.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business, Website, service providers, technology, or legal requirements.

When we make changes, we will publish the updated version on the Website and revise the effective date above. Where required, we will provide additional notice or obtain fresh consent.

17. Contact us

For privacy questions, requests, complaints, or concerns, please contact:

Slay by Candie
Email: legal@slaybycandie.com
Website: [slaybycandie.com]
Address: Lekki, Lagos, Nigeria

We are always happy to help keep your data — and your shopping experience — handled with care.