Luxsal logo

NDPA 2023 Compliant

Privacy Policy

Section 4 explains how LUXSAL collects, uses, protects, shares, and retains Personal Data under the Nigeria Data Protection Act 2023.

Covered in this policy

4.1Data Controller/4.2Categories of Personal Data Collected/4.3Lawful Basis for Processing/4.4Data Subject Rights/4.5Data Sharing & Cross-Border Transfers/4.6Data Security & Retention/4.7Data Protection Compliance/

4.1

Data Controller

LUXSAL Limited is the Data Controller responsible for determining the purposes and means of processing Personal Data collected through the Platform. Our appointed Data Protection Officer "DPO" can be reached at dpo@luxsal.com for all data protection matters.

4.2

Categories of Personal Data Collected

We collect only data that is adequate, relevant, and limited to what is necessary. Categories include:

  1. 1.Identity Data: name, photo, NIN/BVN for KYC.
  2. 2.Contact Data: email, phone, address.
  3. 3.Transactional Data: purchase history, payment details.
  4. 4.Technical Data: IP address, device ID, cookies.
  5. 5.KYC/AML Data.
  6. 6.Dispute Data: evidence, chat logs.

4.3

Lawful Basis for Processing

All processing is carried out in strict compliance with NDPA 2023 Section 25 principles: lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and accountability. We rely on contract performance, legal obligation, legitimate interest, and explicit consent as lawful bases.

4.4

Data Subject Rights

Under NDPA Sections 33-39, you have the right to: access your data, request rectification of inaccuracies, request erasure where no longer necessary, restrict processing, data portability, and object to processing including direct marketing. Submit requests to support@shopluxsal.com with proof of identity. We will respond without undue delay and within 30 days as mandated by NDPA.

4.5

Data Sharing & Cross-Border Transfers

We do not sell Personal Data. Disclosure is limited to: licensed payment processors, logistics partners, KYC vendors, and regulatory authorities under valid legal compulsion. Any cross-border transfer will only occur to jurisdictions deemed adequate by NDPB or under approved Standard Contractual Clauses per NDPA Section 41.

4.6

Data Security & Retention

We implement technical and organizational measures including encryption, role-based access, and annual audits. Personal Data is retained only for as long as necessary for the purpose collected or as required by CBN, FIRS, or AML laws, after which it is securely deleted or anonymized.

4.7

Data Protection Compliance

Our DPO oversees compliance and is your contact for rights requests, breach notifications, or complaints to NDPB. Contact: support@shopluxsal.com