Privacy Policy

1. Who controls your data

KGLUXEE, operated by KG LUXEE LIMITED, is the controller responsible for personal data collected through the KGLUXEE website, online store, customer-support channels, and related services. Our commercial address is No 9 George street, Alakuko , Lagos state.

Privacy requests should be sent to our privacy contact or Data Protection Officer at privacy@kgluxee.com. Customer service requests may be sent to hello@kgluxee.com.

This policy is designed to provide the transparency required by Nigerian data-protection law, including the Nigeria Data Protection Act 2023 and applicable implementation directions. It also addresses the clarity principles in the Nigeria Data Protection Regulation 2019 document supplied for this policy review. Current regulatory information is available from the Nigeria Data Protection Commission. Where a newer law or binding direction applies, that law or direction prevails.

2. Personal data we collect

We do not ask for your full card number, CVV, PIN, or online-banking password. Payment credentials are entered directly into the payment provider's secure environment and are handled under that provider's privacy and security terms.

3. Why we use personal data and our lawful bases

We use only the data reasonably needed for the purpose described. Depending on the activity, our lawful basis is contract performance, steps requested before a contract, compliance with a legal obligation, our legitimate interests in operating and securing the store, or your consent where consent is required.

4. Consent and marketing choices

Where we rely on consent, it must be freely given, specific, informed, and unambiguous. A checkout purchase is not conditional on agreeing to optional marketing. You may withdraw marketing consent at any time by selecting the unsubscribe link in a marketing email or contacting privacy@kgluxee.com. Withdrawal does not affect processing already carried out lawfully before withdrawal.

We will not sell your personal data. We will not use your data for unrelated purposes without a lawful basis and, where required, additional notice or consent.

5. Cookies, local storage, and similar technology

We use essential cookies and browser local storage to keep you signed in, protect sessions, remember preferences, maintain a guest shopping cart, prevent fraud, and operate checkout. For example, the guest cart may be stored on your device until you remove it, complete checkout, or sign in and synchronize it to your account.

If we use non-essential analytics or advertising cookies, we will provide the required notice and choice mechanism before activating them where applicable. You can control cookies through your browser, but disabling essential storage may prevent cart or checkout functions from working.

6. Who receives personal data

We share personal data only where necessary for the purposes in this policy, under a written contract or other lawful arrangement, and subject to confidentiality and security obligations.

We do not authorize service providers to use your personal data for their own unrelated marketing. Update this table if your technical stack changes or if you enable another provider.

7. International processing and transfers

Some providers that support payment, hosting, authentication, security, email, analytics, or delivery may process personal data outside Nigeria. Before making such a transfer, KGLUXEE will use a lawful transfer mechanism required by applicable Nigerian law, which may include an adequacy decision, contractual safeguards, necessity for performing your order, or explicit informed consent where required. We will not transfer more data than necessary for the stated purpose.

By placing an order that requires an overseas payment, hosting, courier, or customs provider, you acknowledge that the data needed for that service may be processed in the provider's country. Contact privacy@kgluxee.com if you need information about the relevant safeguard for a specific transfer.

8. Retention

We keep personal data only for as long as reasonably necessary for the purpose collected, including order fulfilment, customer support, fraud prevention, accounting, tax, legal claims, and regulatory obligations. As a guide, order and payment records are retained for the period required by tax, accounting, payment-network, and legal rules; support and return records are retained for as long as needed to resolve the matter and defend or establish a claim; and account data is deleted or anonymized after account closure unless a lawful retention reason remains.

When retention is no longer required, we securely delete, anonymize, or irreversibly de-identify the data. Backups may retain deleted data for a limited disaster-recovery cycle before secure overwriting.

9. Security and data breaches

We use reasonable technical and organizational measures appropriate to the risk, including access controls, authentication, least privilege, provider security controls, encrypted connections, monitoring, backups, and staff confidentiality obligations. Payment card credentials are handled by the payment provider and are not stored by KGLUXEE in full.

No online system is completely risk-free. If we identify a personal data breach, we will investigate, contain, document, and remedy it, notify the Nigeria Data Protection Commission and other authorities where required, and notify affected individuals where the breach is likely to create a relevant risk. We will communicate practical steps you can take and provide a contact for questions.

10. Your data-protection rights

Subject to applicable legal exceptions and identity verification, you may request access to your personal data; correction of inaccurate or incomplete data; deletion where retention is no longer necessary; restriction or objection to processing; withdrawal of consent; portability of data where applicable; and information about the processing and safeguards used for international transfers. You may object to direct marketing free of charge.

Send a request to privacy@kgluxee.com with the subject “Data Rights Request”, the right you wish to exercise, the email or order identifier connected with your request, and any details needed to locate the data. We may request reasonable information to verify identity. We will respond without undue delay and normally within one month of receiving a complete request. If a request is complex or repetitive, we will explain any lawful extension or refusal and the reason.

11. Children

The Services are not directed to children under 18. We do not knowingly collect children's personal data for an order. If you believe a child has provided personal data, contact privacy@kgluxee.com so we can review and delete it where appropriate.

12. Complaints and remedies

If you believe we have handled your personal data improperly, contact us first at privacy@kgluxee.com. We will review the complaint, provide a written response, and take corrective action where appropriate. If you are not satisfied, you may contact the Nigeria Data Protection Commission or another competent supervisory or judicial authority in accordance with applicable law.

13. Changes to this policy

We may update this policy when our services, providers, technology, or legal obligations change. We will publish the new effective date at the top of the policy. For material changes, we will provide a prominent notice or direct communication where required.