This Privacy Policy explains how Penchant Signature (“Penchant Signature”, “we”, “us”, or “our”) collects, uses, shares, and protects personal information when you visit our website, buy a piece, submit an enquiry or brief, or use our partner portal. We are a leather and Aso-Oke atelier based in Lagos, Nigeria.
We are committed to handling your information in line with the Nigeria Data Protection Act 2023 (NDPA) and the regulations of the Nigeria Data Protection Commission (NDPC).
1. Who we are
Penchant Signature is a leather goods and Aso-Oke house established in 2015, selling directly to customers online and through our atelier, and working with partner stockists on an invite-only basis. For the purposes of applicable data protection law, Penchant Signature is the data controller of the personal information described in this policy. You can reach us using the details in the Contact section below.
2. Scope
This policy applies to personal information we process about visitors to our website, customers who buy or commission pieces from us, prospective and current partners, the individuals who represent those businesses, and anyone who contacts us. It does not apply to third-party websites or services we link to, which have their own privacy policies.
3. Information we collect
Information you give us
Depending on how you interact with us, this may include:
- Your name and, where applicable, the business or organisation you represent.
- Contact details such as email address and phone number.
- Delivery address information you provide at checkout - street address, city, state, country, and postal code - so we can ship your order.
- Payment information handled by our payment provider (Paystack) - we receive a confirmation of payment and a transaction reference, but we do not see or store your full card details.
- The details of any custom commission, customisation, or enquiry you submit, including the pieces, materials, colours, personalisation, reference images, and notes you share.
- Business information you provide in a partner application - for example your location, website, social handles, customer profile, order expectations, volumes, timelines, and budget.
- The content of messages you send us through the contact form or email.
- If you become a partner or return customer, the account details associated with your sign-in.
Information we collect automatically
When you use the website, limited technical information may be processed by our hosting and infrastructure providers, such as your IP address and basic request data, for security, fraud and spam prevention, and to keep the service running. Your enquiry list is stored temporarily in your browser’s session storage on your own device and is not sent to us unless you choose to submit it.
4. How we use your information
We use personal information to:
- Take and fulfil your orders, including processing payment through our payment provider and dispatching your piece to the address you provide.
- Respond to your enquiries, messages, and requests.
- Prepare quotes, sample plans, and proposals for custom and customisation work.
- Review and assess partner applications where the programme is open.
- Provide and administer accounts, including customer sign-in for order history and partner access to line sheets where applicable.
- Send transactional and service communications, such as order confirmations, status updates, and quote emails.
- Operate, secure, and improve our website and services, including preventing spam and abuse.
- Comply with our legal and regulatory obligations.
5. Legal bases for processing
We rely on one or more of the following legal bases under the NDPA:
- Consent - for example, when you subscribe to updates; you can withdraw consent at any time.
- Contract - to take steps at your request before entering into, or to perform, an agreement with your business.
- Legitimate interests - to run and protect our business, assess applications, and communicate with partners, provided these do not override your rights.
- Legal obligation - where processing is required to comply with the law.
6. How we share information
We do not sell your personal information. We share it only as needed to operate our business, including with:
- Service providers who process information on our behalf - including our website hosting, database, authentication, file storage, and email delivery providers, and, where applicable, payment providers. These providers are bound to use the information only to provide their services to us.
- Professional advisers such as accountants or legal counsel, where necessary.
- Authorities or third parties where we are required to do so by law, or to establish, exercise, or defend our legal rights.
7. International transfers
Some of our service providers store or process information on servers located outside Nigeria. Where personal information is transferred internationally, we take steps to ensure an adequate level of protection consistent with the NDPA, including relying on providers that offer appropriate safeguards and contractual protections.
8. How long we keep information
We keep personal information for as long as necessary to fulfil the purposes set out in this policy - for example, for the duration of a partner relationship and for a reasonable period afterwards - and to meet legal, accounting, or reporting requirements. When information is no longer needed, we delete or anonymise it.
9. Security
We use technical and organisational measures appropriate to the sensitivity of the information, including access controls, encryption in transit, restricted internal access, and private storage for partner documents. No method of transmission or storage is completely secure, but we work to protect your information and to address any incidents responsibly.
10. Your rights
Subject to applicable law, you may have the right to:
- Access the personal information we hold about you.
- Request correction of inaccurate or incomplete information.
- Request deletion of your information in certain circumstances.
- Object to or request restriction of certain processing.
- Withdraw consent where we rely on it, without affecting prior processing.
- Request a copy of certain information in a portable format.
- Lodge a complaint with the Nigeria Data Protection Commission.
To exercise any of these rights, contact us using the details below. We may need to verify your identity before responding, and we will reply within the timeframes required by law.
11. Cookies and tracking
Our website uses only the storage strictly necessary to function - for example, your browser’s session storage to remember the enquiry list you build, and cookies needed for customer and partner sign-in. We use Vercel’s privacy-friendly first-party analytics to understand how many people visit and where errors occur, which does not use cookies and does not identify individuals. We do not use third-party advertising or cross-site tracking. If this changes, we will update this policy and, where required, ask for your consent.
12. Children
Our website and services are intended for businesses and the adults who represent them. They are not directed to children, and we do not knowingly collect personal information from anyone under 18.
13. Third-party links
Our website and communications may link to third-party services such as social media platforms or our payment provider’s hosted checkout. We are not responsible for the privacy practices of those services, and we encourage you to review their policies.
14. Changes to this policy
We may update this policy from time to time. When we make material changes, we will revise the “Last updated” date above and, where appropriate, notify you directly.
15. Contact us
If you have questions about this policy or how we handle your information, please reach us via our contact page, or by email at hello@penchantsignature.com.ng.