Privacy & KYC Policy

Last updated: 28 July 2026

The short version: We collect only what customs, the carrier, and delivery genuinely require. We store it securely. We delete it 180 days after your order delivers, unless the law says we must keep it longer. We never sell your data. You can request deletion any time.

1. What we collect and why

Data	Why we need it	Legal basis
Full name	To match your order, address the parcel, and customs declaration	Contract performance
WhatsApp number	Primary communication channel for quotes, status updates, delivery	Contract performance + consent
Email	Payment receipts, policy updates, order confirmations	Contract performance
Lagos delivery address	To deliver your order	Contract performance
Payment details	Processed by Paystack; we receive confirmation + reference, never your full card number	Contract performance
Order history & preferences	To provide your named concierge with context, and improve service	Legitimate interest
ID number / document (only when triggered)	Enhanced KYC for high-value first orders (over ₦300k) or certain HS codes required by Nigerian customs	Legal obligation (customs)
Photos you send	To source/identify items, and as proof-of-condition (receipt, repack, delivery)	Consent + contract

2. Know Your Customer (KYC) — when and why

Nigerian customs and anti-money-laundering rules require us to verify identity in certain cases. We apply KYC proportionately:

Standard orders (under ₦300k): your name, address, and contact details are sufficient. No ID document needed.
First order over ₦300k: we may request a government-issued ID number (NIN, driver's licence, or international passport) to comply with customs for high-value imports. We'll tell you before requesting.
Concierge/sea-freight orders (vehicles, high-value goods): customs may require full importer KYC. We'll guide you through what's needed.
Suspicious activity: if our fraud checks flag an order (velocity, mismatch, unusual pattern), we may pause and request verification before proceeding.

We do not run credit checks. We do not share your ID with third parties except where customs or law enforcement lawfully requires it.

3. How we store your data

Encrypted in transit (HTTPS) and encrypted at rest in our systems.
Access on a need-to-know basis — your named concierge and the specific ops team handling your order. No company-wide access to personal data.
Access logged — we record who accessed what and when.
Payment data is held by our PCI-compliant payment gateway (Paystack) — we never store full card details.

4. Who we share with

Our payment gateway (Paystack) — to process your payment.
UK retailers — only the delivery address of our London warehouse; we do not share your Lagos details with UK retailers.
Our freight forwarder and clearing agent — name, goods description, and value for customs declarations and delivery.
Nigerian customs authorities — where legally required for import clearance.
Our last-mile delivery partner — name, address, and phone for delivery only.
Insurer — only if you make a claim on insured goods.

We never sell your data. We never share it for marketing. We do not use it to train external AI models.

5. How long we keep it

Standard order data: deleted 180 days after delivery, unless you have an open complaint or claim.
KYC documents: retained for the period Nigerian law requires (typically 5 years for AML records), then deleted.
Customs and export records: retained 6 years per UK HMRC export/VAT-reclaim rules.
Aggregate/anonymised data (e.g. "we delivered 150 orders in August") may be kept indefinitely for business analytics — it contains nothing identifying you.

6. Your rights

Under the Nigeria Data Protection Act (NDPA) 2023 and UK GDPR (where applicable to the UK purchase), you have the right to:

Access the data we hold about you — request a copy any time.
Correct inaccurate data.
Delete your data (subject to legal retention above — e.g. we can't delete customs records within their retention window).
Object to specific processing.
Withdraw consent for marketing or non-essential processing (this won't affect orders already placed).
Data portability — receive your data in a structured format.

To exercise any right, WhatsApp your concierge or email privacy@london2lagos.app. We respond within 30 days.

7. Marketing

If you opt in, we may send you our weekly "UK Finds" email with curated products and landed prices. You can unsubscribe with one click in any email, or by WhatsApp. We do not send marketing WhatsApp messages without your consent.

8. Security and breaches

We maintain technical and organisational measures to protect your data. If a breach occurs that risks your rights, we notify the relevant data protection authority and affected customers within 72 hours, per NDPA/GDPR requirements.

9. International transfers

Your data moves between Nigeria, the UK, and our cloud providers (which may process data outside these regions). We only use providers that offer equivalent data-protection safeguards (Standard Contractual Clauses or equivalent).

10. Children

Our service is for adults (18+). We do not knowingly collect data from minors. If you believe a minor has used our service, contact us and we'll delete the data.

11. Contact and complaints

Questions or requests: privacy@london2lagos.app.

If you're unhappy with our response, you can complain to the Nigeria Data Protection Commission (NDPC) or, for UK-purchase aspects, the Information Commissioner's Office (ICO).