Privacy Policy

Kentaz Emporium (“Kentaz Emporium”, “we”, “us”, or “our”) is a lifestyle emporium based at Suite 35, 911 Mall, Usuma Street, Abuja, Nigeria. This Privacy Policy explains how we collect, use, share, store, and protect personal information when you visit kentazemporium.com, place an order, book a service, or otherwise interact with us.

It applies to our website visitors, customers, and users of our services — including mental-health consultations and therapy sessions, and hourly podcast-studio rentals. Where this Policy refers to processing personal data, we do so as a data controller under the Nigeria Data Protection Act 2023 (“NDPA”) and the Nigeria Data Protection Regulation 2019 (“NDPR”), issued by the Nigeria Data Protection Commission (“NDPC”).

By using our website or services, you agree to the collection and use of information in accordance with this Policy. If you do not agree, please discontinue using our services.

We collect information in three ways: what you give us directly, what we gather automatically when you use the site, and what we receive from trusted partners.

A. Information you provide directly

• Account details — your name, email address, password (stored as a secure hash), phone number, and any delivery addresses when you create an account.
• Order details — the products you purchase, chosen sizes and colours, quantities, delivery address, order notes, and payment reference numbers.
• Booking details — for therapy or consultations: the service selected, preferred date/time, session type (in-person or virtual), and any information you share about your needs; for studio rental: your booking schedule and requirements.
• Communications — messages you send through our contact form, WhatsApp, Instagram, or email, including any attachments.
• Newsletter — your email address when you subscribe to receive updates.
• Payment data — we do not store your card numbers. Card details are processed directly by our payment partner, Paystack, whose own privacy and security practices apply.

B. Information we collect automatically

• Device and browser information, such as browser type and version, operating system, and screen size.
• IP address and approximate location, to protect our services and improve localisation.
• Pages visited, referral sources, time spent, and interactions (clicks, items added to cart) used in aggregate to improve the experience.
• Cookies and local storage — see Section 06 below.

C. Information from third parties

• Google — your name, email address, and profile picture when you sign in using Google OAuth.
• Paystack — payment status and a payment reference so we can confirm and reconcile your order.
• Delivery partners — delivery confirmation or status information for your orders.

Some of our services — in particular mental-health consultation and therapy — may involve information about your health or wellbeing. Under the NDPA 2023, health-related information is sensitive personal data and receives additional protection.

• We only process health-related data where it is necessary to deliver the service you requested, and only with your explicit consent.
• Access is restricted to your therapist and authorised staff on a strict need-to-know basis.
• This information is never used for marketing, profiling, or shared with third parties except where required by law or with your express permission.
• Session notes and clinical details are stored securely and kept in line with professional and legal record-keeping standards.

• To process, fulfil, and deliver your orders, including coordinating same-day delivery across Abuja with our logistics partners.
• To process payments and refunds through Paystack.
• To create and manage your account, verify your identity, and keep you signed in securely.
• To schedule, manage, and deliver bookings for therapy sessions and podcast-studio rentals.
• To provide customer support by email, phone, WhatsApp, or Instagram.
• To send transactional messages — order confirmations, dispatch notices, and booking reminders.
• To send marketing updates and newsletters, but only where you have consented and you can unsubscribe at any time.
• To improve our website, analyse usage trends, and personalise your experience.
• To protect our business and customers — preventing fraud, resolving disputes, and enforcing our Terms of Service.
• To comply with legal and regulatory obligations, including tax, accounting, and records requirements.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

Under the NDPA 2023, we must have a lawful basis to process your personal information. We rely on the following:

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing that took place before the withdrawal. To withdraw consent, email info@kentazemporium.com.

Our website uses cookies, local storage, and similar technologies to keep you signed in, remember your cart, and understand how the site is used. Cookies are small files placed on your device that we and our service providers use.

You can control cookies through your browser settings — most browsers let you block or delete cookies. Please note that disabling essential cookies may prevent you from using parts of our site, including shopping and signing in.

We share personal information only with the people and partners needed to run our business, and only to the extent necessary. These partners process data on our instructions and are bound by data-processing agreements.

We may also disclose personal information where required by law, regulation, legal process, or governmental request, or where necessary to protect the rights, property, or safety of Kentaz Emporium, its customers, or others.

Some of our service providers — for example cloud-hosting and payment infrastructure — may store or process data on servers located outside Nigeria. When we transfer personal information across borders, we ensure the transfer is subject to appropriate safeguards consistent with the requirements of the NDPA 2023, such as data-processing agreements, standard contractual clauses, or equivalent protections.

For residents of other countries (including the UK or the European Union), we take reasonable steps to respect applicable data-protection standards and provide the rights described below.

We keep personal information only for as long as necessary for the purposes described in this Policy, or as required by law. Our retention periods include:

• Account data — kept while your account is active, and for a reasonable period afterwards to honour rights or handle disputes.
• Order records — retained in line with applicable tax and commercial record-keeping obligations.
• Clinical / therapy records — retained in accordance with professional and legal standards, and access-restricted at all times.
• Marketing data — kept until you unsubscribe or withdraw consent, after which we stop using it.
• Cookies & analytics — session cookies for the life of your visit; persistent preferences for up to 12 months.

When information is no longer needed, we delete or anonymise it in a secure manner.

We implement appropriate technical and organisational measures to protect your personal information, including:

• Encryption of data in transit (TLS/HTTPS) and at rest where applicable.
• Password hashing — plaintext passwords are never stored or visible to us.
• Role-based access controls, so only authorised staff can reach the data they need.
• Restricted, audited access to health and clinical records.
• Payment card data handled by Paystack, a PCI-DSS compliant processor — card details never touch our servers.
• Regular review of our security practices and staff training on data handling.

No method of transmission or storage is 100% secure. While we work hard to protect your data, we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately.

Under the NDPA 2023 and NDPR 2019, you have the following rights regarding your personal information:

To exercise any of these rights, email info@kentazemporium.com with the subject line “Privacy Request” and clearly state the right you wish to exercise. We respond to verified requests as soon as possible, typically within 30 days, free of charge.

If you are not satisfied with our response, you may raise a complaint with the Nigeria Data Protection Commission (NDPC) — ndpc.gov.ng.

Our e-commerce site sells fashion for children (“kiddies fashion”), but we understand that such purchases are made by adults. Under the NDPA 2023, where we process the personal data of a child under the age of 16, we require consent given or authorised by the child's parent or guardian.

We do not knowingly collect personal information directly from children under 16. If you believe a child under 16 has provided us with personal information, please contact us so we can delete it.

Should a data breach occur, we follow a documented response plan: we contain and investigate the incident, take steps to mitigate any harm, and — where the law requires it — notify affected individuals and the Nigeria Data Protection Commission without undue delay.

If we hold your contact details and a breach is likely to result in a risk to your rights or freedoms (for example, involving sensitive data), we will inform you directly and clearly set out the steps you can take to protect yourself.

Our website and communications may link to third-party services such as Instagram, WhatsApp, Google Maps, or payment providers. These services operate under their own privacy policies, and we are not responsible for their privacy practices. We encourage you to review the privacy policy of any third party you visit.

We may update this Privacy Policy from time to time to reflect changes in our services, technology, or legal requirements. The current version will always be posted on this page, with the date of the last update shown at the top.

If we make changes that materially affect your rights, we will make reasonable efforts to notify you — for example, by email or a prominent notice on our website — before the changes take effect.

If you have any questions about this Privacy Policy, or wish to exercise any of your rights, please reach us here:

Office hours: Mo-Sa 09:00–19:00, Su 12:00–18:00 (WAT).