Your data
Privacy, in plain words.
Last updated 1 November 2026
- We collect what we need to sell and deliver your oils, and to write to you if you asked us to.
- We never sell your data, and we never see your card details: payment happens on Flutterwave’s own page.
- Our own visit statistics are anonymous. We never record your screen or what you type.
- TikTok’s ad cookies load only if you allow them. You can change your mind at any time.
This site is run by Nazia Botanics, Lagos, Nigeria (“we”). We are the data controller under the Nigeria Data Protection Act 2023. For anything here, write to [email protected].
What we collect, and why
| When | What | Why, and our lawful basis |
|---|---|---|
| You order | Name, email, phone, delivery address and any map point you set, what you bought, gift note, payment reference | To fulfil and deliver your order (contract); to keep accounts (legal duty) |
| You start checkout without paying | Email, name, phone and what was in your bag | To save your bag and send up to three reminders (legitimate interest). Every reminder lets you stop them |
| You join the newsletter or waiting list | Email, what you asked to hear about, when you agreed | To send what you asked for (consent). Leave with one tap in any email |
| A rider delivers to you | The rider’s live position while out for delivery, delivery status, photo proof, your rating and any complaint | To deliver your order and put problems right (contract, legitimate interest) |
| You browse | Anonymous statistics: pages, how far you scrolled, time on page, repeated clicks, which checkout box was left last (its name, not its contents), device type, approximate city and country, where you came from, page speed | To improve the shop (legitimate interest). Tied to a random code that ends when you close the tab. Choose “Essentials only” to turn this off |
| You allow ad cookies | TikTok receives pages viewed and shop actions: what you viewed, added and paid for, with amounts. Never your name, email or phone from us | To measure our ads (consent) |
Your internet address is used briefly to stop abuse (rate limits) and is not saved with your orders or statistics.
Who handles data for us
These companies process data only to run the shop:
- Flutterwave: payments.
- Supabase: our database and file storage.
- Vercel: hosting the website.
- Resend: sending emails.
- Upstash: abuse prevention.
- Mapbox: maps at checkout and for delivery tracking.
- Mux: streaming the video on our homepage.
- TikTok: ad measurement, only if you allow it.
Our riders see what they need to deliver your order. Some of these companies hold data outside Nigeria; where they do, we rely on the safeguards the Act requires. We share data with authorities only when the law requires it.
How long we keep it
- Orders and payments: as long as tax and accounting law requires.
- Unfinished bags: marked closed after 7 days.
- Newsletter: until you leave; we keep a record that you left so you are not emailed again.
- Anonymous statistics: 90 days.
Your rights
Under the Act you can ask us for a copy of your data, to correct or delete it, to limit or object to how we use it, to move it, and to withdraw consent. Email [email protected] and we will answer promptly. We may keep what the law requires us to keep. You may also complain to the Nigeria Data Protection Commission.
Cookies and similar storage
- Always on, needed for the shop: your bag, your cookie choice and sign-in for staff and riders.
- Anonymous statistics: a random code stored only for the open tab, not a cookie. “Essentials only” turns it off.
- TikTok ad cookies: only after you tap Allow.
Change your choice any time with “Cookie choices” at the bottom of the page. We also treat a browser’s Global Privacy Control signal as “Essentials only”.
Children
The shop is for adults. Orders must be placed by someone 18 or older. If you believe a child has given us data, write to us and we will delete it.
Security
Everything travels over an encrypted connection, access to customer data is limited to staff who need it, and staff actions are logged. No system is perfect; if a breach is likely to put you at risk, we will tell you and the Commission as the law requires.
Changes
If this policy changes in a way that matters, we will update this page and the date above, and tell you by email where appropriate.