Privacy Policy

What we collect

When you place an order, we ask for and store:

• your full name, email address and phone number
• your delivery address (street, city or town, state or county, postcode and country) and any delivery notes
• the order itself: the items, prices, total, order reference, payment status and delivery status

We never see or store your card details or bank login. You enter those in Paystack's secure payment window, not on our site. Paystack only tells us whether the payment succeeded, the amount and currency, and the payment reference.

When you just browse, we don't ask for anything. Our hosting provider keeps standard technical logs (such as IP address, browser type and the pages requested) to run and secure the site, and gives us visit statistics in aggregate (pages viewed, country, referring site and device type). These statistics don't use cookies and don't identify you.

How we use it

• to take payment for your order and confirm it with Paystack
• to contact you by email, phone or WhatsApp about your order, including your delivery quote
• to deliver your artwork, which means passing your name, phone and address to the courier
• to handle cancellations, refunds and returns
• to keep accounting and tax records, and to prevent fraud

The legal basis is that we need this information to carry out your purchase (our contract with you), and to meet our legal obligations, such as keeping financial records.

Who we share it with

• Paystack processes your payment. We send Paystack your email address, the amount, the order reference, the number of items and the country you're shipping to. Paystack collects your payment details directly and emails your payment receipt. Its use of your data is covered by Paystack's privacy policy.
• Cloudflare hosts this website and the database where orders are stored. At checkout, Cloudflare Turnstile checks that your browser isn't an automated script, using technical signals from your browser rather than a puzzle.
• Cloudinary stores and serves the artwork images, and Google Fonts serves the site's fonts. Your browser fetches these directly, so they receive your IP address and browser details, as any website does.
• Delivery couriers, in Nigeria or internationally, receive the name, phone number and address needed to deliver your order.
• Authorities, where the law requires it, for example for tax or fraud investigations.

These providers may process data outside Nigeria, and orders to the UK or the US go to couriers there. Where they do, they're bound by their own data protection commitments.

Cookies and browser storage

We don't use advertising or analytics cookies. Your cart is saved in your browser's own storage, on your device, so it's still there when you come back. While a payment is in progress, we also keep its reference in your browser for that session, so closing and reopening the payment window doesn't start a new order. Paystack's payment window may set its own cookies to process the payment and prevent fraud.

Your order page

Anyone with your order link (ioche.art/order/ioc_…) can see that order's status and items, and the delivery name, address and phone number. The link contains a long random code that can't be guessed, but treat it like a receipt and only share it with people you trust.

How long we keep it

We keep order records for as long as we need them for accounting, tax and legal purposes. If you started checkout but never paid, we keep your details on that unpaid order for 30 days, so that a late payment can still be matched to it and refunded. After that we erase your name, contact details and address from it.

Your rights

Under the Nigeria Data Protection Act 2023 you can ask us to tell you what personal information we hold about you, correct it, delete it, or stop using it. We may need to keep some order records where the law requires it. You can also complain to the Nigeria Data Protection Commission. If you live in the UK, you have the same rights under UK data protection law and can complain to the Information Commissioner's Office. To make a request, email hello@ioche.art from the address you used to order. We'll reply within 30 days.

Security

The site is served only over HTTPS. Order records are only accessible to the studio's admins, who sign in with a one-time code. No system is perfectly secure, but we limit what we collect and who can see it.

Changes

If we change this policy, we'll update the date at the top of this page. See also our Terms of Service.