ONYC® HAIR NIGERIA ONLINE PRIVACY POLICY

Updated: July 29, 2026

This Online Privacy Policy explains how ONYC® Hair Nigeria (“ONYC Nigeria,” “ONYC®,” “we,” “us,” or “our”), the operator of ONYCHair.ng, collects, receives, uses, stores, protects, shares, transfers, retains, and otherwise processes personal data when you visit our Website, create an account, place an order, make a payment, request delivery, communicate with us, subscribe to marketing, participate in a promotion, submit a review, send us a photo or video, or otherwise interact with our Nigerian business.

This Policy is intended to comply with the Nigeria Data Protection Act 2023, the Nigeria Data Protection Act – General Application and Implementation Directive 2025, and other applicable Nigerian laws, regulations, directives, and recognised data-protection requirements. It should be read together with our Terms & Conditions, Return Policy, Shipping Policy, and any additional privacy notice presented when we collect particular information.

By using the Website or voluntarily providing personal data to us, you acknowledge that you have read this Policy. Where consent is the lawful basis for a particular activity, we will request consent separately and you may withdraw it as explained below. Using the Website does not automatically mean that you consent to every type of processing described in this Policy.

Who Is Responsible for Your Personal Data?

ONYC® Hair Nigeria is the data controller for the personal data covered by this Policy because we determine why and how that data is processed. In some situations, another organisation—such as a payment provider, delivery company, social-media platform, or advertising platform—may act as an independent data controller under its own privacy policy. In other situations, a service provider processes personal data only on our instructions and acts as our data processor.

Questions, privacy requests, complaints, and data-deletion requests may be submitted through our Contact Us page or by emailing info@onychair.com with the subject line “Nigeria Privacy Request.”

Our Data-Protection Principles

We aim to process personal data lawfully, fairly, transparently, and responsibly. We collect personal data for specific and legitimate purposes, limit collection to information that is reasonably necessary, take reasonable steps to keep data accurate, retain it only for as long as necessary or legally required, and use appropriate safeguards to protect its confidentiality, integrity, and availability.

We do not sell personal data for money. We do not permit service providers acting on our behalf to use customer personal data for their own unrelated marketing. We may use advertising and analytics providers as described in this Policy, subject to applicable consent requirements, cookie controls, contractual safeguards, and your privacy choices.

Personal Data We Collect

The personal data we collect depends on how you use ONYCHair.ng and the services you request. It may include the following categories:

Identity and account data: Your name, username, account identifier, password or encrypted authentication credentials, and account preferences.
Contact data: Your email address, telephone number, WhatsApp number, billing address, delivery address, and other contact details you provide.
Order and transaction data: Products selected or purchased, quantity, texture, length, colour, order value, discount or coupon information, order history, invoices, receipts, return or exchange records, store-credit records, and transaction status.
Payment-related data: Payment method, bank-transfer reference, payment confirmation, partial or masked payment details, payment-provider response, and fraud-verification results. Card payments are ordinarily processed by authorised payment gateways, and we do not intentionally store complete card numbers or card security codes on ONYCHair.ng.
Delivery and fulfilment data: Recipient name, delivery address, telephone number, delivery instructions, carrier details, tracking number, proof of delivery, failed-delivery records, and information needed to investigate missing or delayed parcels.
Customer-service data: Emails, contact forms, support tickets, telephone enquiries, WhatsApp conversations, social-media messages, complaint details, product concerns, refund requests, return requests, photos, videos, voice notes, and other information you choose to provide.
Product-preference data: Hair texture, length, colour, installation preferences, product interests, saved items, cart contents, purchase preferences, and responses to surveys or consultations.
Marketing and consent data: Email, SMS, WhatsApp, cookie, and advertising preferences; subscription source; opt-in date and time; consent records; campaign engagement; and unsubscribe or opt-out records.
Review and user-content data: Ratings, reviews, comments, photographs, videos, social-media handles, testimonials, and any other content you submit for publication or customer support.
Technical and usage data: IP address, browser type, device type, operating system, language, time zone, approximate location derived from IP address, referring page, pages viewed, links clicked, search terms, session activity, cart activity, cookie identifiers, advertising identifiers, and Website performance information.
Security and fraud-prevention data: Login history, account activity, device or network signals, order-risk indicators, address-verification results, chargeback information, return-fraud indicators, and records of suspected unauthorised activity.
Privacy-request data: Information required to verify and respond to requests for access, correction, deletion, restriction, portability, objection, consent withdrawal, or complaints.

Where we offer a birthday reward or similar programme, we may request a date of birth or only the month and day of birth. Providing birthday information is voluntary unless we clearly state that it is required for a particular service.

Sensitive Personal Data

ONYC® Hair Nigeria does not normally need or request sensitive personal data such as biometric identifiers used for unique identification, genetic information, medical records, religious or philosophical beliefs, political opinions, trade-union membership, or information about a person’s sex life.

A customer may voluntarily send a photograph, video, or limited information about a scalp concern, allergy, hair loss, or other condition when requesting product guidance or customer support. Such information may reveal health, physical, racial, or ethnic characteristics. We will use it only for the purpose for which it was provided, on an appropriate lawful basis, and with additional care. We do not use customer photographs for facial recognition or biometric identification. Please do not send medical records or sensitive information that is not necessary for us to address your request.

How We Collect Personal Data

We collect personal data directly from you when you create an account, complete checkout, make a payment, contact us, submit a form, communicate through WhatsApp or social media, request a return, join a mailing list, enter a promotion, submit a review, or otherwise provide information.

We also collect data automatically through cookies and similar technologies when you use the Website. In addition, we may receive limited information from payment gateways, banks, delivery companies, ecommerce providers, fraud-prevention tools, marketing platforms, analytics providers, social-media platforms, customer-support tools, ONYC® service providers, or another person who places an order for delivery to you.

Where we receive personal data from another source, we will use it only for legitimate purposes connected with our services and will provide appropriate information where required by law.

Information Collected Automatically

When you browse or interact with ONYCHair.ng, our Website and service providers may automatically collect technical, device, and activity information. This information helps us operate checkout and account functions, maintain security, prevent fraud, understand product interest, diagnose technical problems, improve Website performance, remember preferences, measure campaigns, and provide advertising where permitted.

Approximate location may be inferred from an IP address, but we do not use the Website to collect precise GPS location unless a specific feature clearly requests it and you choose to permit it.

Social Login and Social-Media Information

Where ONYCHair.ng offers social login or account connection through Google, Facebook, Instagram, Apple, X, or another platform, that platform may provide information in accordance with your settings and the permissions shown to you. This may include your name, email address, profile image, social account identifier, and other information you have authorised the platform to share.

When you contact us, comment on our page, tag ONYC®, participate in a campaign, or interact with ONYC® content on a social platform, we may receive your public profile information, message, comment, reaction, or other information made available through that platform. Social platforms process information under their own privacy policies, and we encourage you to review your privacy settings directly with them.

Cookies and Similar Technologies

ONYCHair.ng may use cookies, pixels, tags, web beacons, scripts, software development kits, local storage, and similar technologies. Some are placed by us and others are placed by service providers or third parties.

The technologies used on our Website may include:

Strictly necessary cookies: Required for security, account access, fraud prevention, shopping-cart functions, checkout, payment routing, and core Website operation.
Functional cookies: Remember language, region, login status, saved preferences, and other choices that improve Website functionality.
Analytics and performance cookies: Help us understand visits, page performance, customer journeys, errors, product interest, and how the Website is used.
Advertising and retargeting cookies: Help measure advertising, build audiences, limit repeated advertisements, and display ONYC® promotions that may be more relevant to your interests.
Social-media cookies: Support embedded content, social-sharing tools, campaign measurement, and interactions with social platforms.

Where required, we will ask for consent before placing or activating non-essential cookies. You may manage available preferences through our cookie banner or privacy settings and through your browser or device settings. Blocking some cookies may affect Website functionality, including saved carts, login, checkout, and personalised features.

Your cookie choices apply to the particular browser or device on which they were made. You may need to repeat your choices if you clear cookies, use another browser, or use another device.

How and Why We Use Personal Data

We use personal data only where we have a lawful basis and for purposes reasonably connected with ONYC® Hair Nigeria’s ecommerce, customer-service, marketing, security, and legal operations. These purposes may include:

Creating, authenticating, securing, and managing customer accounts.
Displaying products, maintaining carts, processing checkout, and confirming orders.
Processing or verifying payments, bank transfers, refunds, and store credit.
Validating orders and investigating suspected fraud, unauthorised payments, chargebacks, or account misuse.
Preparing, packaging, dispatching, tracking, and delivering orders.
Communicating about order confirmation, payment status, shipping, delivery, returns, exchanges, product concerns, and customer support.
Reviewing product-defect claims and processing refunds, replacements, returns, exchanges, or store credit.
Responding to questions about products, textures, colour, maintenance, availability, and services.
Operating promotions, reward programmes, surveys, competitions, referrals, and customer-review programmes where offered.
Sending promotional email, SMS, WhatsApp, or other direct marketing where you have consented or where another lawful basis permits it.
Personalising Website content, recommendations, product displays, and promotions.
Measuring advertising, marketing, Website performance, customer engagement, and campaign effectiveness.
Improving products, customer experience, Website design, inventory planning, internal processes, and business operations.
Protecting our Website, systems, staff, customers, service providers, intellectual property, and legal rights.
Maintaining records, performing audits, and complying with tax, accounting, consumer-protection, data-protection, payment, regulatory, court, law-enforcement, and other legal obligations.
Establishing, exercising, or defending legal claims and resolving complaints or disputes.

Lawful Bases for Processing

Depending on the activity, we may rely on one or more of the following lawful bases:

Consent: You have freely given a specific, informed, and unambiguous indication that you agree to a particular use, such as certain marketing messages, optional cookies, publication of a testimonial, or processing of voluntarily supplied sensitive information.
Performance of a contract: Processing is necessary to take requested steps before an order or to process payment, fulfil an order, arrange delivery, manage a return, provide customer support, or perform another agreement with you.
Compliance with a legal obligation: Processing is necessary to meet applicable Nigerian tax, accounting, consumer-protection, data-protection, court, regulatory, law-enforcement, or other legal requirements.
Legitimate interests: Processing is reasonably necessary for purposes such as fraud prevention, Website security, customer service, business administration, recordkeeping, service improvement, analytics, brand protection, and appropriate marketing, after considering your rights and interests.
Protection of vital interests: Processing is necessary to protect a person’s life, health, or safety in an appropriate situation.
Public interest or exercise of legal authority: Processing is necessary for a task in the public interest or under an applicable legal authority, where relevant.

Where consent is required, refusing or withdrawing consent will not affect unrelated services. Withdrawing consent does not make earlier lawful processing unlawful. We may continue processing where another lawful basis applies, including keeping an opt-out record so that we can honour your preference.

Accounts and Order Processing

We use account, contact, order, payment, and delivery data to receive and validate orders, collect payment, prevent fraud, provide order updates, arrange delivery, maintain order history, and administer returns or customer support. Certain information is required to complete a purchase. If you do not provide it, we may be unable to create an account, accept payment, deliver an order, or process a return.

Payment providers, banks, and fraud-prevention services may make independent decisions about payment authorisation, security checks, or transaction monitoring. Their processing is governed by their own legal obligations and privacy notices.

Email, SMS, WhatsApp, and Other Communications

Transactional communications: We may send messages necessary to manage your account, order, payment, delivery, return, support request, security, or important policy changes. These service messages are not promotional merely because they identify ONYC® or include information connected to your transaction.

Promotional email: Where you subscribe or where otherwise permitted by law, we may send product news, offers, promotions, surveys, rewards information, cart reminders, review requests, and brand updates. You may unsubscribe through the link in a promotional email or by contacting us. Unsubscribing from marketing will not prevent necessary order or account messages.

SMS and mobile messaging: If you opt in, we may use your mobile number, consent record, preferences, delivery status, and message-interaction information to send promotional, transactional, or informational SMS or similar mobile messages. Message frequency may vary and normal mobile-network charges may apply. You may opt out by replying STOP, END, CANCEL, UNSUBSCRIBE, QUIT, or another clear opt-out instruction supported by the programme.

WhatsApp: Where you contact us through WhatsApp, request WhatsApp updates, or consent to marketing through WhatsApp, we may use your telephone number, profile information made available to us, message content, attachments, and communication history to respond and provide the requested service. You may ask us to stop promotional WhatsApp messages at any time. WhatsApp and Meta may process information under their own privacy policies.

We may use providers such as ActiveCampaign or another communication platform to manage email, SMS, segmentation, consent records, campaign delivery, unsubscribe requests, and reporting. These providers may change as our systems develop. They are permitted to process information only for authorised services and subject to applicable safeguards.

No Sale or Independent Marketing Use of Mobile Data

We do not sell, rent, trade, or transfer mobile telephone numbers, SMS opt-in records, WhatsApp opt-in records, or mobile-message consent data to third parties for their own independent marketing. We may share such information with messaging platforms, telecommunications providers, mobile carriers, customer-support tools, analytics providers, and other processors only as reasonably necessary to deliver, secure, manage, measure, or document ONYC® communications.

Advertising, Analytics, and Personalisation

We may use analytics and advertising services to understand Website usage, measure marketing, improve customer experience, create audience groups, and display advertisements. Depending on the tools in use, providers may include Google, Meta/Facebook, Instagram, TikTok, Pinterest, Microsoft/Bing, email or SMS platforms, ecommerce analytics tools, and similar services.

These providers may process cookie identifiers, device information, IP address, Website activity, cart activity, product views, purchase events, and campaign interactions. Non-essential advertising and analytics tools will be used subject to applicable consent requirements and available privacy choices.

You may manage advertising preferences through our cookie controls, browser settings, device settings, and the privacy or advertising settings offered by the relevant platform. Disabling personalised advertising does not necessarily stop all advertising; it may cause advertisements to be less tailored to your interests.

How We Share Personal Data

We may disclose personal data only where reasonably necessary for the purposes described in this Policy. Recipients may include:

Website hosting, domain, security, content-delivery, and ecommerce platform providers.
Payment gateways, banks, financial institutions, and fraud-prevention or identity-verification providers.
Delivery companies, couriers, fulfilment providers, warehouses, and logistics partners.
Email, SMS, WhatsApp, customer-relationship-management, and customer-support providers.
Analytics, advertising, social-media, and campaign-measurement providers, subject to applicable choices and consent.
Review, survey, rewards, referral, or promotion providers where such services are offered.
IT consultants, cybersecurity providers, data-storage providers, and professional advisers such as lawyers, accountants, auditors, insurers, and compliance organisations.
ONYC® staff, contractors, affiliates, or service teams that require access for authorised business purposes.
Regulators, law-enforcement authorities, courts, governmental bodies, or other persons where disclosure is legally required or reasonably necessary to protect rights, safety, security, or property.
A buyer, investor, lender, adviser, or successor in connection with a proposed or completed merger, restructuring, financing, acquisition, sale of assets, or transfer of business, subject to appropriate confidentiality and legal safeguards.

We seek to give service providers access only to the information reasonably required for their functions. Where required, we use written agreements and other measures intended to ensure confidentiality, security, lawful processing, assistance with data-subject rights, and deletion or return of information when services end.

Legal Disclosures, Security, and Fraud Prevention

We may use or disclose information to comply with law, respond to a court order or lawful regulatory request, investigate suspected criminal or fraudulent activity, enforce our policies, protect customers and staff, secure accounts and systems, recover debts, address chargebacks, prevent return fraud, defend legal claims, or protect the rights, property, safety, and operations of ONYC® Hair Nigeria or another person.

Fraud and security controls may involve manual review and automated risk indicators. We do not intend to make a decision based solely on automated processing that produces a legal or similarly significant effect without providing safeguards required by applicable law.

International and Cross-Border Data Transfers

Some of our Website, cloud, ecommerce, payment, communication, analytics, advertising, support, security, or administrative providers may be located outside Nigeria or may store information in other countries. Personal data may therefore be transferred to or accessed from countries including the United States, the United Kingdom, countries in the European Economic Area, or other locations where our authorised providers operate.

We will make cross-border transfers only on a lawful basis. Depending on the circumstances, safeguards may include an adequacy determination, applicable law, binding corporate rules, contractual clauses, a code of conduct, a certification mechanism, your informed consent, necessity for performance of a contract, necessity for legal claims, or another basis permitted under Nigerian law.

We take reasonable steps to record the basis for relevant transfers and to require appropriate protection from recipients. However, privacy laws and governmental access rules in another country may differ from those in Nigeria.

Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, to provide services, maintain security, resolve disputes, enforce agreements, and satisfy legal, regulatory, accounting, tax, fraud-prevention, and recordkeeping requirements.

Retention periods may vary according to the nature and sensitivity of the data, the amount and context of processing, the risk of harm from unauthorised use or disclosure, whether you maintain an account, whether an order or dispute remains open, and the period required or permitted by applicable law. For example:

Account information may be retained while the account remains active and for a reasonable period afterwards.
Order, payment, delivery, refund, and accounting records may be retained for applicable tax, accounting, consumer-protection, audit, fraud-prevention, and dispute periods.
Customer-support and complaint records may be retained while a matter is active and afterwards where needed for quality control, defence of claims, or recurring product concerns.
Marketing information may be retained until you unsubscribe, withdraw consent, or object, after which we may retain a limited suppression record to ensure that your preference is respected.
Cookie and analytics data may be retained according to the settings and periods applied by the relevant tool.
Security logs and fraud records may be retained for risk management, investigation, and legal purposes.
Published reviews or approved customer content may remain available until removed by us or following a valid request, subject to our legal rights and obligations.

When personal data is no longer required, we may securely delete it, anonymise it, de-identify it, aggregate it, or isolate it from ordinary use where retention remains legally necessary.

Data Security

We use reasonable administrative, organisational, physical, and technical safeguards designed to protect personal data from accidental or unlawful destruction, loss, misuse, alteration, unauthorised disclosure, or unauthorised access. Depending on the risk and systems involved, safeguards may include SSL/TLS encryption, access controls, password controls, multi-factor authentication, role-based access, secure payment gateways, staff confidentiality, service-provider review, backups, monitoring, fraud controls, vulnerability management, and incident-response procedures.

No Website, internet transmission, mobile message, or electronic storage system can be guaranteed to be completely secure. You are responsible for protecting your password, limiting access to your device, using a unique password, and informing us promptly if you suspect unauthorised account activity.

Personal Data Breaches

If we become aware of a personal data breach, we will investigate, take reasonable containment and remediation measures, maintain appropriate records, and make notifications required by Nigerian law.

Where a breach is likely to result in a risk to individuals’ rights and freedoms, we will notify the Nigeria Data Protection Commission within the period required by law, which may be within 72 hours of becoming aware of the breach. Where a breach is likely to result in a high risk to an affected person, we will communicate relevant information to that person in plain and clear language as required, including appropriate protective steps where available.

Your Data-Protection Rights

Subject to applicable law and any permitted limitations, you may have the right to:

Be informed about how and why your personal data is processed.
Request confirmation and access to personal data we hold about you and receive information about its use, recipients, source, and retention.
Request a copy of eligible personal data in a commonly used electronic format.
Request correction of inaccurate, outdated, incomplete, or misleading personal data.
Request deletion or erasure where the data is no longer needed, consent has been withdrawn and no other lawful basis applies, processing is unlawful, or another legal condition is satisfied.
Request restriction of processing in appropriate circumstances.
Withdraw consent at any time where processing is based on consent. It should be as easy to withdraw consent as it was to give it.
Object to processing based on legitimate interests or another applicable ground.
Object to direct marketing at any time. Once a valid objection applies, we will stop using the relevant personal data for that direct-marketing purpose.
Request data portability where the right applies and the required technical conditions are met.
Object to certain solely automated decisions that produce legal or similarly significant effects and request appropriate safeguards, including human review where applicable.
Complain to us or to the Nigeria Data Protection Commission.

These rights are not absolute. We may decline or limit a request where permitted or required by law, including where identity cannot be reasonably verified, the request would adversely affect another person’s rights, information must be retained for legal obligations or claims, or a lawful exception applies. We will explain the applicable reason where required.

How to Exercise Your Rights

Submit a request through our Contact Us page or email info@onychair.com with the subject “Nigeria Privacy Request” or “Data Deletion Request.” Please state the right you wish to exercise and provide enough information for us to identify the relevant account, order, or communication.

To protect personal data, we may request reasonable proof of identity or authority before acting. An authorised representative may submit a request where legally permitted, but we may verify the representative’s authority and the identity of the person concerned.

We aim to acknowledge and respond without undue delay and ordinarily within 30 days after receiving a complete and verifiable request, or within another period required by applicable law. Complex requests may require additional time where legally permitted. We will inform you if an extension or additional information is reasonably required.

We do not ordinarily charge a fee for a genuine privacy-rights request. A reasonable fee may apply, or a request may be refused, only where permitted by law—for example, where a request is manifestly unfounded, repetitive, or excessive.

Data Deletion and Account Closure

You may request deletion of your account and eligible personal data by using the contact methods above. Deleting an account does not always require immediate deletion of every record. We may retain limited information where reasonably necessary for completed orders, payment reconciliation, tax or accounting obligations, fraud prevention, enforcement of rights, disputes, legal claims, security, or maintenance of an unsubscribe record.

Where personal data was received through Facebook, Google, or another social login, you may request deletion from ONYC® Hair Nigeria and may also need to remove the app connection through the relevant platform’s account settings.

Direct-Marketing Choices

You may object to direct marketing at any time. Use the unsubscribe link in an email, reply with a supported opt-out instruction to an SMS, ask us to stop promotional WhatsApp messages, update available account or cookie settings, or contact us directly.

After you opt out, it may take a short period to process the request across our systems. You may still receive communications already in progress and necessary transactional, security, customer-service, order, delivery, or policy messages. We may retain a suppression record containing limited contact information to prevent future marketing to that address or number.

Children’s Privacy

ONYCHair.ng is intended for adults and is not designed to knowingly collect personal data directly from children under 18 without appropriate authorisation. A person under 18 should use the Website, create an account, or make a purchase only with the involvement and permission of a parent or legal guardian.

Where processing relates to a child, we will seek consent or another lawful basis and take age-verification, parental-authorisation, transparency, and protective measures required by the Nigeria Data Protection Act and the Child Rights Act. If you believe that a child has provided personal data without appropriate permission, contact us so that we can investigate and take appropriate action.

Customer Reviews, Photographs, and Other Submissions

If you submit a review, testimonial, photograph, video, comment, or social-media content for publication, we may display the content together with your chosen name, initials, social-media handle, or other information you have approved. Published material may be visible to the public and may be copied, shared, indexed by search engines, or retained by third parties outside our control.

We will seek appropriate permission where required before using customer content in marketing. Do not submit another person’s image or personal data unless you have authority to do so. You may contact us to request removal of content, although removal from our Website may not remove copies already shared or indexed elsewhere.

Third-Party Websites, Platforms, and Embedded Services

The Website may link to or embed services operated by payment providers, delivery companies, social platforms, video providers, review services, or other third parties. We do not control the privacy, security, availability, or content practices of independent third parties. Their privacy policies apply to information they collect directly, and you should review those policies before providing personal data.

Browser Privacy Signals

Some browsers or extensions send “Do Not Track,” Global Privacy Control, or similar signals. Because these signals are not implemented uniformly across all services and jurisdictions, our response may depend on the technology, the signal, applicable Nigerian law, and other laws that may apply. Where we are legally required and technically able to recognise a valid privacy-preference signal, we will treat it in accordance with the applicable requirement.

Complaints to the Nigeria Data Protection Commission

We encourage you to contact ONYC® Hair Nigeria first so that we can try to resolve your concern. You also have the right to lodge a complaint with the Nigeria Data Protection Commission. Information about the Commission and its complaint processes is available through the official NDPC Website at ndpc.gov.ng.

A privacy complaint may also involve consumer-protection rights. Nothing in this Policy limits any right or remedy available under the Federal Competition and Consumer Protection Act or another applicable law.

Changes to This Privacy Policy

We may update this Policy to reflect changes in our Website, operations, products, payment methods, delivery arrangements, service providers, technologies, marketing practices, legal duties, or regulatory guidance. The updated version will be posted on this page with a revised date.

Where a change is material or where consent is required for a new purpose, we may provide additional notice through the Website, your account, email, SMS, WhatsApp, or another appropriate method. We will not use previously collected personal data for a materially incompatible purpose without an appropriate lawful basis and notice.