Privacy

Who is responsible

Vhee’s Adornment is a handmade jewellery studio in Nigeria, selling through this website. We decide what personal information this site collects and why, which under the Nigeria Data Protection Act 2023 makes us the data controller for it.

If you are writing from the UK or the EU, we handle your information to the standard the UK GDPR and the EU GDPR require, and the rights described below apply to you in full.

What we collect, and why

We ask for the least we can and still get a parcel to you. Nothing here is bought from anyone, and nothing is collected without you typing it in.

• To send an order: your name, email address, phone number and delivery address, plus any note you add for the courier. We keep the order itself — what you bought and what it cost — as our record of the sale.
• If you create an account: the same details, plus any addresses you choose to save so you need not retype them. Your password is stored only as a bcrypt hash; we cannot read it, and neither can anyone who obtained a copy of our database.
• If you send a custom request: your contact details and whatever you tell us about the piece — colours, size, occasion, budget range, deadline, description — along with any reference photographs you upload.
• If you subscribe to our list: your email address and the date you gave it, which is our record that you asked to hear from us.
• If you write to us through the contact form: your name, email address and message.

Payment details never reach us

Card and bank details are entered on Flutterwave’s own payment page, not on ours. We never see, receive or store a card number, and there is no field anywhere in our system that could hold one. What comes back to us is a reference and a yes or no.

Flutterwave handles that information as its own controller, under its own privacy policy.

Cookies

This site sets two cookies, and only once you sign in. One keeps you signed in for thirty days; the other is a security token that stops another website from acting on your behalf while you are signed in. Both are strictly necessary for the account area to work, which is why there is no cookie banner asking you to accept them — you cannot refuse them and still have a working sign-in.

We run no advertising cookies, no tracking pixels, and no third-party analytics. Nobody is following you around the internet on our account.

Who else sees it

Only the services that make the shop work, and only the part each one needs:

• Amazon Web Services stores our data and sends our email. Everything sits in AWS’s US East region.
• Flutterwave takes the payment, as described above.
• The courier that delivers your parcel gets your name, address and phone number, because otherwise it cannot arrive.

How long we keep it

Orders and custom requests are kept as business records — we need them for accounts, for tax, and to answer you if you come back about a piece months later. Account details stay until you ask us to close the account. Email verification links expire after 48 hours and password reset links after one hour, whether used or not.

If you ask us to delete something and we are required to keep part of it, we will tell you which part and why rather than quietly keeping it all.

Your rights

You can ask us to show you what we hold about you, correct anything wrong, delete it, or send it to you in a portable form. You can withdraw consent to marketing at any time without affecting anything you have already bought.

Write to the address at the bottom of this page and we will respond within 30 days. If you are not satisfied, you can complain to the Nigeria Data Protection Commission, or to your own supervisory authority if you are in the UK or EU.

Keeping it safe

The whole site is served over HTTPS. Passwords are hashed, never stored as text. Session tokens are hashed before they are written down, so a copy of our database would not let anyone sign in as you. Access to the studio admin requires a second factor beyond a password.

No system is beyond reach. If information of yours is ever exposed in a way that puts you at risk, we will tell you and the regulator rather than hope you do not notice.

Children

This shop is not aimed at children, and we do not knowingly collect information from anyone under 18. If you believe a child has given us their details, write to us and we will remove them.

Changes

If we change what we collect or what we do with it, we will change this page and move the date at the top. Material changes affecting people already on our list will be sent by email rather than left here to be discovered.