Privacy Policy

1. Introduction

GreyandGrema Carpets ("we," "us," "our") operates this website (the "Website"), through which we sell carpets and rugs to customers. This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and the rights available to you under Nigerian data protection law.

This Policy is written with reference to the Nigeria Data Protection Act, 2023 ("NDPA") and the guidance of the Nigeria Data Protection Commission ("NDPC"), Nigeria's data protection regulator. By using the Website or placing an order, you acknowledge that you have read this Policy.

2. Information We Collect

a. Information you provide directly

• Full name
• Phone number
• Email address
• Delivery address, including state/city
• Order details (products selected, quantities, delivery notes)
• Any additional information you choose to share in order notes or when contacting us

b. Payment-related information

We do not collect or store your card, bank account, or other payment credentials on our own systems. Payments are entered directly on our payment processor's secure platform.

c. Communication records

If you contact us, or we contact you about an order — including by phone, email, or WhatsApp — we may keep a record of that communication.

d. Account information

The Website currently allows orders to be placed without creating a customer account (guest checkout). If customer account registration is introduced in the future, this section will be updated to describe what account information is collected and how it is used.

e. Automatically collected / technical information

We may automatically collect limited technical information such as IP address, browser type, device information, and pages visited through our hosting and backend services (Firebase / Google Cloud). These are used for essential site functionality and security.

f. Newsletter or marketing information

We do not currently offer a newsletter or send marketing emails. If this changes, we will update this Policy accordingly.

3. How We Collect Information

• Directly from you — when you place an order, fill out a form, or contact us.
• Automatically — through essential technical data as described in Section 2e.
• From our payment processor — our payment processor may share limited information confirming that a payment was made (such as a payment reference and status), but not your full card or bank details.

4. How We Use Your Information

• Process and fulfil your orders
• Arrange delivery
• Communicate with you about your order — by phone, email, or WhatsApp
• Process payments through our payment processor
• Keep records required for accounting, tax, and legal compliance
• Maintain and improve the Website
• Detect, investigate, and prevent fraud or misuse

5. Order Processing

When you place an order, the information you provide is used to create an order record, confirm payment, and prepare your items for delivery. Orders are only finalized once payment has been successfully verified.

6. Payment Processing

All payments are processed by our payment processor, Paystack. When you pay, you are directed to Paystack's own secure payment page — your card or bank details are entered there, not on our Website, and are not stored on our systems. Paystack's handling of your payment information is governed by Paystack's own privacy policy.

7. Delivery

We use the delivery address and phone number you provide to arrange delivery of your order. Our delivery process may involve our own team or third-party logistics partners; only the information necessary to complete delivery is shared.

8. Customer Communication

We may contact you about your order by phone, email, or WhatsApp — for example, to confirm your order, provide delivery updates, or answer questions. WhatsApp messages are sent to the number you provide at checkout.

9. Cookies and Similar Technologies

Our Website does not use tracking cookies. Some third-party services we use (such as Firebase) may set browser storage for essential functionality, such as keeping an admin logged in. We do not use this storage for advertising or profiling.

10. Analytics

We do not currently use an analytics service (such as Google Analytics). If one is added in the future, we will update this Policy to describe what is collected and why.

11. Third-Party Service Providers

We work with the following service providers, who process personal information on our behalf solely to help us operate the Website and fulfil orders:

• Paystack — processes payments. Receives the information necessary to complete a transaction (such as your name, email, and payment details).
• Firebase / Google Cloud (provided by Google) — provides the hosting, database, file storage, and backend infrastructure that runs the Website and stores order and product data.
• WhatsApp — used to deliver order-related messages.

We do not sell your personal information to third parties.

12. International Data Transfers

Because we use cloud infrastructure (Firebase/Google Cloud) that may store or process data outside Nigeria, your information may be transferred to, and processed in, other countries as part of routine hosting and service delivery. We take steps to ensure such transfers are consistent with applicable data protection requirements.

13. Data Security

We take reasonable technical and organisational measures to protect your personal information, including restricting access to order and customer data to authorized personnel. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

14. Data Retention

We retain your order and customer information for as long as needed to fulfil the order, meet accounting/tax obligations, and resolve disputes, and no longer. After that period, we securely delete or anonymise the data.

15. Your Rights Under Nigerian Data Protection Law

Under the NDPA, you have the right to:

• Be informed about how your personal information is processed
• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information, subject to legal or legitimate business retention needs
• Object to, or request restriction of, certain processing
• Withdraw consent at any time, where processing is based on consent, without affecting processing already carried out
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC)

To exercise any of these rights, contact us at greyandgremacarpets@gmail.com.

16. Marketing Preferences

We do not currently send marketing communications. If this changes, we will provide an option to opt in or out.

17. Children's Privacy

The Website is not directed at children, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

18. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last Updated" date at the top of this page. We encourage you to review this Policy periodically.

19. Contact Us

If you have questions about this Privacy Policy or how we handle your information, contact us at:

GreyandGrema Carpets
Lala Plaza, Aminu Kano Crescent, Wuse 2, Abuja 904101, Federal Capital Territory, Nigeria
Email: greyandgremacarpets@gmail.com
Phone/WhatsApp: +234 813 479 9225
Instagram: @greyandgremacarpets