Privacy Policy

Bounty Barn Nigeria Limited is the data controller for personal data collected through bountybarnhq.com. We are responsible for deciding why and how that data is used, in line with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation 2019 where it still applies.

For privacy requests, email hello@bountybarnhq.com with the subject “Data request”. You can also write to 14, Amusa Alabi Street, Ipaja, Lagos, Nigeria.

When you place an order we collect your name, email address, phone number, delivery address, the items you bought, the amount paid, any coupon or referral code, and the Paystack payment reference. We do not collect or store your card number or bank PIN. Paystack processes the payment.

When you use the contact form we collect your name, email, phone number if you give one, subject, and message.

When you apply as an affiliate we collect your name, email, chosen referral code, and a hashed password. We do not store the password in plain text. After approval we store commission records tied to orders.

The shopping cart is stored in your browser’s local storage on your device. A referral cookie named bb_ref may be stored if you arrive through a link that contains a referral code. Staff and affiliate login use separate session cookies. We do not run third-party advertising trackers on this site.

We use order details to take payment, pack and deliver your goods, send you the order reference, handle refunds, and keep accounting records. The lawful basis is performance of the contract and our legal duty to keep business records.

We use contact messages to reply to you. The lawful basis is your request and our legitimate interest in answering customers and partners.

We use affiliate data to review applications, attribute sales, calculate commission, and secure the affiliate login. The lawful basis is the affiliate contract and our legitimate interest in preventing misuse of referral codes.

We use the referral cookie so a referring affiliate is credited if you later buy. It lasts 30 days. The lawful basis is our legitimate interest in running the programme you arrived through. It does not change the price you pay.

We do not sell personal data. We do not send marketing messages unless you have asked us to. You can tell us to stop at any time.

Paystack receives the payment amount, your email, and the transaction reference so it can collect payment and process refunds. Paystack is a payment processor operating in Nigeria.

A courier or delivery rider receives your name, phone number, and delivery address so the order can be delivered. They may use that information only for that delivery.

Our hosting and database providers store the site and order records so the shop can run. They process that data on our instructions.

We may disclose data if a Nigerian court, the Nigeria Data Protection Commission, the Federal Competition and Consumer Protection Commission, or another authority with lawful power requires it.

If a provider processes data outside Nigeria, we do so only where the NDPA allows the transfer, including where it is necessary to perform your order or where appropriate safeguards are in place.

Order and payment records are kept for six years from the order, which matches the period in which a contract claim can ordinarily be brought and the period we need for tax and accounting.

Contact messages are kept for two years, or longer if a message is still part of an open complaint.

Affiliate account data is kept while the account is open and for six years after the last commission record. Rejected applications are kept for twelve months.

The cart stays in your browser until you clear it or clear site data. The referral cookie expires after 30 days. An affiliate login cookie expires after 30 days. You can delete cookies in your browser; deleting the referral cookie only means a later purchase may not be attributed.

Under the NDPA you can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it where we have no lawful reason to keep it, object to processing based on legitimate interest, ask us to restrict processing, and ask for data you provided to be given to you in a usable format.

We will respond within one month. We may ask you to confirm your identity before we release order details, so that we do not give your address or phone number to someone else. Some records, especially paid orders, must be kept for the periods above even if you ask for deletion. We will tell you if that applies.

You may complain to the Nigeria Data Protection Commission at ndpc.gov.ng if you believe we have handled your data unlawfully. Please contact us first so we can try to put it right.

This shop is for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, email us and we will delete it unless we must keep a record of a completed order placed by an adult.

Affiliate and staff passwords are stored as hashes. Session cookies are httpOnly. Checkout runs over HTTPS in production, and payment details stay with Paystack. No method of storage is perfect. If a breach is likely to risk your rights, we will notify the Nigeria Data Protection Commission and, where the NDPA requires it, notify you.

We may update this policy by posting a new version on this page. The date at the top will change. Our Terms & Conditions explain the contract for a purchase.