Privacy

Last updated: 8 November 2026.

Your privacy matters to us. This page explains what personal information EnnyCrochet collects when you use ennycrochet.store, why we collect it, who we share it with and what rights you have. We follow the Nigeria Data Protection Act 2023 and, for visitors in the European Economic Area and the United Kingdom, the principles of the GDPR and UK GDPR.

Who is responsible for your information

EnnyCrochet, a handmade crochet atelier based in Nigeria, decides how and why your information is used (the "controller"). You can reach us through the Contact page or on WhatsApp.

What we collect and why

• Your orders: your name, email address, phone number, delivery address and country, what you ordered, your size, colour choices and notes. We use this to make, deliver and support your order.
• Your body measurements, if you order made-to-measure. We use them only to make and adjust your piece, and to remake or reorder it for you.
• Your account, if you create one: name, email address and a password (we store only a scrambled version, so we cannot read it), plus your order history and wishlist.
• Your payments: card and online bank payments are handled by Paystack. We receive only the result, the reference, the amount and the currency. We never see or store your full card number. For bank transfers we record the reference and the details you give us.
• Your messages: what you send through the contact form, bespoke requests, reviews, WhatsApp or email, and your requests to be told when a piece is available.
• Your subscription: your email address, if you join our newsletter or drop list.
• Discount codes you use, so a code can be applied correctly.
• Technical information: your IP address and browser details, used to keep the site secure, to limit abuse, and to show the right language and currency for your country. We also keep a log of the emails we send you so we can help if one goes missing.

How we use it, and our legal reasons

• To carry out your order and our contract with you: taking payment, making and delivering your piece, and customer service.
• To meet our legal duties, such as keeping tax and accounting records.
• For our legitimate interests in running a secure, reliable shop and preventing fraud and abuse.
• With your consent, to send the newsletter, back-in-stock notices, and to show your review. You can withdraw consent at any time.

We send order emails (confirmation, payment, shipping, delivery) because they are part of your order. We send marketing only if you subscribed, and every email lets you unsubscribe. We do not make decisions about you by automated means, and we do not sell your personal information.

Who we share it with

We share only what is needed, with:

• Payment provider: Paystack, to take payment.
• Couriers and postal services, to deliver your parcel and clear customs: your name, address, phone number and email address.
• Our website hosting and email provider, who store our systems and send our email for us.
• Authorities, courts or advisers, if the law requires it or to protect our rights.

Our pages load fonts from Google Fonts, so Google receives your IP address when a page loads. We do not use advertising trackers or third-party analytics. Links to Instagram, TikTok, Facebook, YouTube and WhatsApp lead to services with their own privacy policies.

Moving information between countries

We are based in Nigeria, and we serve customers worldwide. When you order, your information is sent to us in Nigeria and may be handled by payment, hosting, email and delivery providers in other countries. We only use providers that protect personal information under contract or the law, and we share only what they need.

Cookies

We use only the cookies the shop needs to work: they keep your bag, your language and currency choice, your sign-in, the recent order you can track, and a security token that protects forms. They last for your visit or for up to 14 days. We do not use advertising or analytics cookies, so there is no cookie banner. Paystack and Stripe may set their own cookies on their payment pages.

How long we keep it

• Orders, invoices and payment records: for as long as tax and accounting law requires, which in Nigeria is generally at least six years.
• Your account, measurements and wishlist: while you have an account, or until you ask us to delete them.
• Newsletter and drop list: until you unsubscribe.
• Messages and enquiries: for as long as needed to help you, and usually up to two years after.

After that, we delete or anonymise the information.

Your rights

You can ask us to give you a copy of your information, to correct it, to delete it, to limit or stop how we use it, to give it to you in a portable format, and to withdraw your consent. Deleting some records, such as tax records, is not possible until the legal retention period ends, and we will tell you if that applies. To use your rights, contact us. We may need to confirm who you are, and we reply within one month. It is free of charge.

If you are unhappy with how we handle your information, please tell us first. You also have the right to complain to the Nigeria Data Protection Commission or, if you live in the EEA or the UK, to your local data protection authority.

Keeping it safe

Our site uses HTTPS encryption, passwords are stored in scrambled form, staff access is limited by role, and we keep backups. No system is perfect. If a breach puts your rights at risk, we will tell the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and we will tell you where the law requires.

Children

Our shop is for adults. We do not knowingly collect information from anyone under 18. If you think a child has given us information, please contact us and we will delete it.

Changes to this page

We may update this page. The date at the top shows the latest version, and we will tell you about important changes.