Privacy policy

“PersonalDataBreach”meansabreachofsecurityleadingtotheaccidentalorunlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed;

“Policy”meansthisDataProtectionPolicy;

“Privacy by Design and Default”means implementing appropriate technical and organisationalmeasuresinaneffectivemannertoensurecompliancewiththeGDPR;

“Processing”means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording,organisation,structuring,storage,adaptationoralteration,retrieval,consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

“Pseudonymisation”means replacing information that directly or indirectly identifies an individual with one or more artificial identifiers or pseudonyms so that the person, to whom thedatarelates,cannotbeidentifiedwithouttheuseofadditionalinformationwhichismeant to be kept separately and secure;

 
“Sensitive Personal Data”means Data relating to religious or other beliefs, sexual tendencies,health,race,ethnicity,politicalviewstradeunionmembership,criminalrecords or any other sensitive personal information; 

“Third Party”means any natural or legal person, public authority, establishment or any otherbodyotherthantheDataSubject,theDataController,theDataAdministratorandthe persons who are engaged by the Data Controller or the Data Administrator to process Personal Data; and

1. Introduction
1.1 Welcome to our privacy policy. We are PA76 Limited, trading as iStore Nigeria (PA76). We respect your privacy and take its protection very seriously.
1.2 This policy applies generally to the business of iStore Nigeria (PA76), including online and offline transactions you have with us as well as the personal data that we hold about you.

2. Audience and scope
2.1 This policy applies to you if you are:
2.1.1 a visitor to our website; or
2.1.2 a customer who has ordered or requested the goods or services that we provide.
2.2 This policy applies to all personal data we process regardless of the location of the store. 

3. Acceptance of this privacy policy
3.1 Persons accessing the PA76 web site, subject themselves to and agree to PA76’s privacy policy, as set out below. 

4. What is personal data?
4.1 Personal data includes:
4.1.1 certain information that we collect automatically when you visit our website;
4.1.2 certain information collected on registration on our website (see below);
4.1.3 certain information collected on submission; and
4.1.4 optional information that you provide to us voluntarily (see below);
   but excludes:
• information that has been made anonymous so that it does not identify a specific person;
• permanently de-identified information that does not relate or cannot be traced back to you specifically;
• non-personal statistical information collected and compiled by us.
4.2 Common examples of the types of personal data we may collect and process include your:
4.2.1 identifying information – such as your name, date of birth, or identification number of any kind;
4.2.2 contact information – such as your phone number or email address;
4.2.3 address information – such as your physical or postal address; and
4.2.4 financial information – such as your bank account details.
4.3 In addition to the information above, we may collect information on your nationality, tax identity number, location, IP address, MAC address, IMEI number, IMSI number.

5.    What are the principles for processing personal data?
5.1    When we process your personal data, we are guided by the principles set out in the relevant data protection laws that apply to us, such as the Nigerian Data Protection Regulation (NDPR). 

5.2    When we process personal data, it will be:
5.2.1    processed lawfully, fairly, in a transparent manner, in relation to individuals;
5.2.2    collected for specified, explicit and legitimate purposes;
5.2.3    not further processed in a manner that is incompatible with the initial purposes;
5.2.4    adequate, relevant, and limited to what is necessary to fulfil the purposes for processing it.
5.2.5    accurate, and where necessary kept up to date.
5.2.6    stored for no longer than is necessary to fulfil the purposes for processing it;
5.2.7    processed to ensure its security, using appropriate technical and organisational measures.

6.    How do we collect personal data?

On submission of an enquiry or registration

6.1    When you submit an enquiry or if you register on our website, you will no longer be anonymous to us. This personal data may include:
6.1.1    your name and surname;
6.1.2    your email address;
6.1.3    your telephone number;
6.1.4    your postal address or street address; and
6.1.5    your username and password.
6.2    We will use this personal data to fulfil your account, provide additional services and information to you as we reasonably think appropriate, and for any other purposes set out in this policy.

On order or request
6.3    When you order our goods or request our services from us, you will be asked to provide us with additional information on a voluntary basis.

From browser
6.4    We automatically receive and record Internet usage information on our server logs from your browser, such as your Internet Protocol address (IP address), browsing habits, click patterns, version of software installed, system type, screen resolutions, colour capabilities, plug-ins, language settings, cookie preferences, search engine keywords, JavaScript enablement, the content and pages that you access on the website, and the dates and times that you visit the website, paths taken, and time spent on sites and pages within the website (usage information). Please note that other websites visited before entering our website might place personal data within your URL during a visit to it, and we have no control over such websites. Accordingly, a subsequent website that collects URL information may log some personal data.

Web beacons
6.5    Our website may contain electronic image requests (called a single-pixel gif or web beacon request) that allow us to count page views and to access cookies. Any electronic image viewed as part of a web page (including an ad banner) can act as a web beacon. Our web beacons do not collect, gather, monitor, or share any of your personal data. We merely use them to compile anonymous information about our website.

Optional details
6.6    You may also provide additional information to us on a voluntary basis (optional information). This includes information you may provide when order certain additional goods or services, or otherwise use the optional features and functionality of our website.

7.    Who are our data subjects?

7.1    Data subjects are the identifiable individuals whose personal data we process. 

7.2    We process the personal data of the following categories of people:
7.2.1    potential and existing customers,
7.2.2    website users,
7.2.3    contractors, vendors, or suppliers, and
7.2.4    employees.

8.    What are your rights as a data subject?

8.1    As a data subject, you have the right to:

a.    know which personal data of yours that we process;
b.    access your personal data, and request a copy of the personal data we hold on you;
c.    object to our processing of your personal data in specific circumstances;
d.    withdraw your consent to the processing of your personal data;
e.    ask us to rectify inaccurate information of yours or to complete any incomplete information of yours;
f.    request that we restrict our processing of your personal data in specific circumstances e.g. where there is a valid complaint about accuracy of the data; and
g.    to make a complaint to a relevant regulatory body such as National Information Technology Development Agency (NITDA) or the Nigerian Data Protection Bureau (NDPB).

8.2    We may need to request additional information from you to verify your identity for you to access these rights. This is to ensure that your personal data is not disclosed to an unauthorized person. 

8.3    To exercise your rights, please send a request to our Data Protection Officer at nigeria.manager@myistore.com 

9.    Why do we process your personal data?

9.1    We may process your personal data for one of the following reasons:
9.1.1    you as the data subject have given us your consent to process your personal data for a specific purpose described below;
9.1.2    it is necessary to fulfil a contract with you or prior to entering a contract with you; or 
9.1.3    it is necessary to comply with a legal obligation we are subject to.

10.    How do we manage consent?

10.1    Consent is the freely given, specific, informed, and unambiguous indication of your wish and agreement to allow us to process your personal data.

10.2    When we rely on consent to process your personal data, we will:
10.2.1    ask for your consent either in writing or any other manner,
10.2.2    describe the specific purpose for which we require your consent,
10.2.3    inform you that you can withdraw your consent at any time, 
before processing your personal data.
 
10.3    We will ask for your consent if we need to process your personal data for a further purpose.

10.4    If you wish to withdraw your consent, you can contact our data protection officer (DPO) at nigeria.manager@myistore.com to handle your request. We will honour your request promptly once we have received it.

11.    What are our purposes for processing your personal data?

11.1    We may use or process any information you provide to us for the purposes that you indicated when you agreed to provide it to us. Processing includes using your personal data, gathering or collect it, disclosing it, and combining it with other personal data. 

11.2    We generally collect and process your personal data for various purposes, including:

11.2.1    goods or services purposes – such as: 
a.    collecting orders or requests for and providing our goods or services,
b.    managing our contracts with various data subjects,
c.    managing customer credit in general,
d.     processing customer requests or complaints,
e.    keeping our records and information up to date, 
f.    better understanding our customer’s needs, and
g.    providing support to our customers.

11.2.2    marketing purposes – such as: 
a.    marketing to existing or potential customers, and
b.    running promotional competitions for business.

11.2.3    business purposes – such as:
a.    internal audit, 
b.    accounting, and 
c.    business planning and due diligence, or other proposed and actual transactions.

11.2.4    legal purposes – such as:
a.    handling claims and enforcing debts, and
b.    complying with regulations or pursuing good governance.

11.3    We may use your usage information for the purposes described above and to:
a.    remember your information so that you will not have to re-enter it during your visit or the next time you access the website;
b.    monitor website usage metrics such as total number of visitors and pages accessed; and
c.    track your entries or other activities in connection with your usage of the website.

12.    How do we use your personal data?

12.1    We may use your personal data to fulfil our obligations to you, such as providing you with products and services.

12.2    We may send administrative messages and email updates to you about the website. We may wish to provide you with information about new goods or services in which we think you may be interested. This means that in some cases, we may also send you primarily promotional messages. 

12.3    If you are an existing customer, you can choose to opt-out of promotional of those messages. 

12.4    If you are a potential customer, we will not send you promotional messages unless you have chosen to opt-into them. But we may send you one message asking you to opt-into promotional messages.

13.    When do we share your personal data?

13.1    We may share your personal data with:

13.1.1    other divisions or companies within the group of companies to which we belong so as to provide joint content and services like registration, for transactions and customer support, to help detect and prevent potentially illegal acts and violations of our policies, and to guide decisions about our products, services, and communications (they will only use this information to send you marketing communications if you have requested their goods or services);
13.1.2    an affiliate, in which case we will seek to require the affiliates to honour this privacy policy;
13.1.3    our goods or services providers under contract who help provide certain goods or services or help with parts of our business operations, including fraud prevention, bill collection, marketing, technology services (our contracts dictate that these goods or services providers only use your information in connection with the goods or services they supply or services they perform for us and not for their own benefit);
13.1.4    credit bureaus to report account information, as permitted by law; and
13.1.5    other third parties who provide us with relevant services where appropriate.

Regulators
13.2    We may disclose your personal data as required by law or governmental audit.

Law enforcement
13.3    We may disclose personal data if required:
13.3.1    by a subpoena or court order;
13.3.2    to comply with any law;
13.3.3    to protect the safety of any individual or the general public; and
13.3.4    to prevent violation of our terms.

No selling
13.4    We will not sell personal data. No personal data will be disclosed to anyone except as provided in this privacy policy.

Marketing purposes
13.5    We may disclose aggregate statistics (information about the customer population in general terms) about the personal data to advertisers or business partners.

Employees
13.6    We may need to disclose personal data to our employees that require it to do their jobs. These include our responsible management, human resources, accounting, audit, compliance, information technology, or other staff.

Change of ownership
13.7    If we undergo a change in ownership, or a merger with, acquisition by, or sale of assets to, another entity, we may assign our rights to the personal data we process to a successor, purchaser, or separate entity. We will disclose the transfer on the website. If you are concerned about your personal data migrating to a new owner, you may request us to delete your personal data.

14.    How do we protect your personal data?

14.1    We take the security of personal data very seriously and always do our best to comply with applicable data protection laws by maintaining reasonable measures to protect personal data from loss, misuse, and unauthorised access, disclosure, alteration, and destruction. 

14.2    We take steps to comply with procedures and technologies we put in place to maintain the security of all Personal Data from the point of collection to the point of destruction.

14.3    We implement safeguards such as encryption and pseudonymisation where appropriate. We will regularly evaluate and test the effectiveness of those safeguards to ensure the security of our processing.

14.4    PA76 also implements measures for protecting the Personal Data that you process in the course of your duties. We authorise access to personal data only for those employees who require it to fulfil their job responsibilities. They will handle personal data in a way that guards against accidental loss or disclosure or other unintended or unlawful processing, and maintains its confidentiality. 

14.5    The third parties whose systems we link to are responsible for the security of information while it is collected by, stored on, or passing through the systems under their control.

14.6    We will use all reasonable endeavours to ensure that our website and your information is not compromised. However, we cannot guarantee that no harmful code will enter our website (for example viruses, bugs, trojan horses, spyware, or adware). You should be aware of the risks associated with using websites (addressed below).

14.7    If you experience a problem or loss that is caused by information you provided to us, your computer being compromised in some way or by something beyond our control, we cannot take responsibility for causing the problem. We will, however, do our best to help you if we can.

14.8    You must only log in to your account from a page that begins with https://www.istore.com.ng 

15.    How long do we retain your data?

15.1    We will only retain your personal data for as long as it is necessary to fulfil the purposes explicitly set out in this policy, unless:
15.1.1    retention of the record is required or authorised by law; or
15.1.2    you have consented to the retention of the personal data.

15.2    During the period of retention, we will continue to abide by our confidentiality obligations and will not share or sell your personal data.

15.3    We may retain your personal data in physical or electronic records at our discretion.

16.    When do we transfer personal data?

16.1    We may send personal data outside of the country to various countries. 

16.2    We will only transfer data to other countries who have similar privacy laws which provide an adequate level of protection, or to recipients who can guarantee the protection of personal data to the same standard we must protect it.

17.    How do we deal with personal data breaches?

17.1    A personal data breach occurs when there is a breach of security we’ve put in place, leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to the personal data we process.

17.2    We will use our best efforts to notify the relevant regulatory authority within 72 hours of becoming aware of it.

17.3     Where the personal data breach will likely result in a high risk to data subjects, we will use our best efforts to immediately notify affected data subjects, so that they themselves can take any remedial action.

18.    Changes to this policy

18.1    We reserve our right to change the policy from time to time. All amendments will be readily available on our website. https://www.istore.com.ng 

18.2    If you continue to use the website or our goods or services following a change to the terms, the changed terms will apply to you, and you will be deemed to have accepted those updated terms.

19.    Limitation

19.1    We are not responsible for, give no warranties, nor make any representations in respect of the privacy policies or practices of linked or any third party websites.

20.    Enquiries

20.1    If you have any questions or concerns arising from this privacy policy or the way in which we handle personal data, please contact our Data Protection Officer at nigeria.manager@myistore.com 

List of cookies we collect

The table below lists the cookies we collect and what information they store.

COOKIE name   COOKIE Description
CART    The association with your shopping cart.
CATEGORY_INFO    Stores the category info on the page, that allows to display pages more quickly.
COMPARE   The items that you have in the Compare Products list.
CURRENCY   Your preferred currency
CUSTOMER   An encrypted version of your customer id with the store.
CUSTOMER_AUTH    An indicator if you are currently logged into the store.
CUSTOMER_INFO   An encrypted version of the customer group you belong to.
CUSTOMER_SEGMENT_IDS   Stores the Customer Segment ID
EXTERNAL_NO_CACHE   A flag, which indicates whether caching is disabled or not.
FRONTEND   You session ID on the server.
GUEST-VIEW    Allows guests to edit their orders.
LAST_CATEGORY   The last category you visited.
LAST_PRODUCT   The most recent product you have viewed.
NEWMESSAGE   Indicates whether a new message has been received.
NO_CACHE    Indicates whether it is allowed to use cache.
PERSISTENT_SHOPPING_CART   A link to information about your cart and viewing history if you have asked the site.
POLL   The ID of any polls you have recently voted in.
POLLN    Information on what polls you have voted on.
RECENTLYCOMPARED   The items that you have recently compared.
STF   Information on products you have emailed to friends.
STORE   The store view or language you have selected.
USER_ALLOWED_SAVE_COOKIE   Indicates whether a customer allowed to use cookies.
VIEWED_PRODUCT_IDS   The products that you have recently viewed.
WISHLIST   An encrypted list of products added to your Wishlist.
WISHLIST_CNT    The number of items in your Wishlist.