1. Summary
We collect the information needed to sell you products, deliver them, run your account, and operate the member programme. This draft explains what that information is, why we hold it, who else processes it on our behalf, and the choices you have. It is a draft and has not been legally reviewed.
2. What we collect
- Account details — your name, email address and phone number, and a password that is stored in hashed form. We never store your password in readable form.
- Delivery details — the delivery address and any collection preference you give at checkout, so an order can be delivered or made ready for pickup.
- Order history — what you ordered, the prices and totals at the time, the delivery fee snapshot and the order status, kept so we can fulfil, support and (where relevant) refund an order.
- Reward and ledger records — if you take part in the member programme, we keep records of your registration, your position in the reward structure, rewards credited to you, and any withdrawals, so the reward account can be audited and disputes resolved. These records are financial records and are kept even if you later close your account.
- Bank details, for withdrawals only — if you request a withdrawal, the bank account details needed to pay it are stored encrypted at rest and are not written into audit records.
- Technical and operational data — limited logs and error reports used to keep the service working and secure.
3. Why we hold it
- To create and secure your account and let you sign in.
- To take payment, deliver or prepare orders, and handle cancellations and refunds.
- To record and administer programme participation, rewards and withdrawals.
- To answer support requests and resolve disputes.
- To detect and prevent fraud, abuse and security problems.
The lawful basis on which we rely for each purpose, and any consent wording required by applicable Nigerian law, is [to be confirmed by GChem Industries].
4. Who else processes it
We use third-party providers to run parts of the service. They process your information on our instructions, not for their own marketing:
- Paystack — card, transfer and USSD payments. We do not store card details; payment data is handled by Paystack.
- Supabase — database, authentication and file storage, including the encrypted storage of bank details.
- Resend — transactional email such as order and account notices.
- Hosting and monitoring — the platform is hosted on Vercel and errors are reported to Sentry.
The full, current list of processors and their locations is [to be confirmed by GChem Industries] as part of the legal review.
5. Security
Access to member and staff data is checked on the server and enforced in the database, so a request that bypasses the interface is still refused. Payment and database secrets are kept server-side and never reach the browser. Bank account numbers are encrypted at rest and are kept out of audit snapshots. We do not log passwords, access tokens or full bank details. No system is perfectly secure, and this section describes our measures rather than guaranteeing an outcome.
6. How long we keep it
Order, payment and reward records are financial records and are retained so the account can be audited and obligations met. The specific retention periods — and how long other data is kept before deletion — are [to be confirmed by GChem Industries] and will be set with legal advice rather than estimated here.
7. Your choices
Depending on applicable law, you may be able to request access to the personal data we hold about you, ask us to correct it, or ask us to delete data we are not required to keep. Financial and reward records may have to be retained even where other data is deleted. How to make a request, and the exceptions that apply, are [to be confirmed by GChem Industries] once the approved contact channel is in place. Until then this draft offers no route for a request, because inventing one that reaches nobody would be worse than saying so.
8. Changes and effective date
This document is a draft dated 15/10/2026. It has no effective date yet, because it cannot take effect before legal review. When the reviewed version is approved, it will carry an effective date and the changes will be summarised here.