Privacy policy
1. Who we are
This Privacy Policy explains how Labalaba ("we", "us", "our") collects, uses, shares and protects your personal information when you visit labalaba.shop, shop with us online or in store, contact customer service, or follow us on social media.
Labalaba is operated by Labalaba Lifestyle Ltd, a company registered in Lagos, Nigeria. For the purposes of data protection law, we are the data controller of your personal information.
This policy applies to customers and visitors worldwide. Section 11 sets out additional rights that apply if you live in the United Kingdom, Nigeria or certain US states. Where local law gives you stronger protection, that law applies.
Last updated: 26 Oct 2026.
2. Information we collect
We collect personal information you give us, information collected automatically when you use our website, and information from third parties.
|
Category |
Examples |
Source |
|---|---|---|
|
Identity and contact |
Name, email, phone number, billing and delivery address |
You |
|
Account |
Username, password (stored encrypted), wishlist, saved sizes, preferences |
You |
|
Orders and payments |
Items bought, order history, returns, payment confirmation (card details are handled by our payment providers, not stored by us) |
You, payment providers |
|
Fit and style |
Size, fit preferences, measurements you choose to share, product reviews and photos |
You |
|
Communications |
Customer service messages, survey responses, competition entries |
You |
|
Marketing preferences |
Whether you have opted in or out of email, SMS or WhatsApp marketing |
You |
|
Device and usage |
IP address, browser and device type, pages viewed, items added to cart, referring site, approximate location |
Automatically, via cookies and similar tools |
|
Social media |
Your public handle, content you tag us in, messages you send us |
Social platforms, you |
|
Third-party data |
Fraud-check results, delivery updates, demographic or interest data from advertising partners |
Payment, logistics and ad partners |
We do not intentionally collect sensitive information (such as health, religious or biometric data). Please do not send it to us. If you share measurements or body-shape information for fit advice, we use it only to give you that advice.
3. How we use your information
We use your information only for the purposes below. UK and Nigerian law require us to have a lawful basis for each use; we list it alongside.
|
Purpose |
Lawful basis |
|---|---|
|
Process orders, take payment, deliver, handle returns and refunds |
Performance of a contract |
|
Create and manage your account |
Performance of a contract |
|
Respond to enquiries and provide customer service |
Contract; legitimate interests |
|
Send order and delivery updates |
Performance of a contract |
|
Send marketing by email, SMS or WhatsApp |
Consent (or, for UK existing customers, the "soft opt-in" where permitted) |
|
Show personalised ads and recommendations |
Consent (where cookies are required); legitimate interests |
|
Improve our website, products and size guides; run analytics |
Legitimate interests; consent for non-essential cookies |
|
Run competitions, promotions and loyalty programmes |
Contract; consent |
|
Detect and prevent fraud and keep our systems secure |
Legitimate interests; legal obligation |
|
Keep tax and accounting records; comply with law and regulator requests |
Legal obligation |
|
Establish or defend legal claims |
Legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details. Where we rely on consent, you can withdraw it at any time; this does not affect processing already carried out.
We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. Automated fraud screening may flag an order for manual review.
4. Cookies and tracking
We use cookies, pixels and similar technologies to run our website, remember your cart, understand how the site is used and show you relevant ads.
|
Type |
What it does |
Your choice |
|---|---|---|
|
Strictly necessary |
Keeps the site secure, remembers your cart and checkout |
Always on |
|
Functional |
Remembers preferences such as currency, region and saved sizes |
Can be switched off |
|
Analytics |
Measures traffic and how pages perform (e.g. Shopify Analytics, Google Analytics) |
Consent where required |
|
Advertising |
Shows relevant ads on other sites and measures campaigns (e.g. Meta Pixel, TikTok Pixel, Google Ads, Pinterest) |
Consent where required; opt-out in US |
You can change your choices at any time through the Cookie Settings link in our website footer, or through your browser settings. Where UK law allows low-risk analytics cookies without consent, we will still let you switch them off.
We honour the Global Privacy Control (GPC) browser signal as a request to opt out of the sale or sharing of personal information and targeted advertising, where US state law requires.
5. Marketing communications
We send marketing about new collections, sales and events only where you have agreed, or where the law otherwise allows.
You can unsubscribe at any time by:
- clicking "unsubscribe" in any email;
- replying STOP to any SMS or WhatsApp message;
- updating preferences in your account; or
- emailing info@labalaba.shop
We will still send service messages about your orders after you unsubscribe. Our US emails comply with the CAN-SPAM Act, and our text messages comply with the Telephone Consumer Protection Act. Message and data rates may apply.
6. How we share your information
We do not sell your personal information for money, and never will. We share it only with the parties below, under contracts that require them to protect it.
|
Recipient |
Why |
|---|---|
|
E-commerce platform (e.g. Shopify) |
Hosts our store and processes orders |
|
Payment providers (e.g. Shopify Payments, Stripe, PayPal, Paystack, Flutterwave) |
Take payment and check for fraud |
|
Delivery and logistics partners (e.g. DHL, Royal Mail, UPS, GIG Logistics) |
Deliver orders and returns |
|
Email, SMS and customer service tools (e.g. WhatsApp Business) |
Send messages and handle enquiries |
|
Analytics and advertising partners (e.g. Google, Meta, TikTok, Pinterest) |
Measure and personalise advertising (see Section 4) |
|
Professional advisers, auditors and insurers |
Run our business and meet legal duties |
|
regulators, courts and tax authorities |
Where required by law or to protect rights and safety |
7. International transfers
We operate across Nigeria, the UK and the US, and our service providers may process data in other countries. Your information may therefore be transferred outside the country where you live.
When we transfer personal information out of Nigeria or the US, we make sure it is protected by an approved safeguard, such as:
- a country the Nigeria Data Protection Commission recognises as providing adequate protection;
- the UK International Data Transfer Agreement or Addendum, or standard contractual clauses approved under the Nigeria Data Protection Act 2023; or
- another lawful basis, such as where the transfer is needed to perform your contract with us.
You can ask for a copy of the safeguards we use by contacting [PRIVACY EMAIL].
8. How long we keep your information
We keep personal information only as long as we need it for the purposes in this policy, then delete or anonymise it.
|
Information |
Typical retention |
|---|---|
|
Order, payment and tax records |
6 years after the order (UK); as required by Nigerian and US tax law |
|
Account data |
While your account is active, then 2 years of inactivity |
|
Marketing preferences |
Until you unsubscribe, plus a suppression record so we don't contact you again |
|
Customer service records |
3 years after the enquiry is closed |
|
Cookie and analytics data |
Up to 26 months, or as set out in our cookie settings |
|
Fraud-prevention records |
Up to 6 years |
[Adjust these periods to match your actual practices.]
9. Security
We protect your information with technical and organisational measures, including encrypted (HTTPS) connections, PCI-DSS compliant payment processing, access controls and staff training. No online system is completely secure, so please keep your password private.
If a data breach is likely to put your rights at risk, we will notify you and the relevant regulator as the law requires: within 72 hours to the ICO or the Nigeria Data Protection Commission, and under applicable US state breach-notification laws.
10. Your rights
Depending on where you live, you may have the right to:
- Access a copy of the personal information we hold about you;
- Correct information that is inaccurate or incomplete;
- Delete your information;
- Restrict or object to how we use it, including for direct marketing (always available);
- Data portability: receive your information in a machine-readable format;
- Withdraw consent at any time;
- Not be subject to decisions based solely on automated processing with significant effects;
- Opt out of targeted advertising and the sale or sharing of personal information.
To exercise any right, email info@labalaba.shop We may need to verify your identity before acting. You can use an authorised agent where the law allows. We will not charge you or treat you differently for exercising your rights.
We respond within one month (UK and Nigeria) or 45 days (US), and may extend this where the law allows. If we refuse a request, we will explain why and how you can appeal.
11. Additional information by region
Nigeria
We process your information under the Nigeria Data Protection Act 2023 and the NDPA General Application and Implementation Directive 2025. You have all the rights in Section 10, including the right to withdraw consent and to object to processing.
If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
United Kingdom
We process your information under the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations.
United States
Residents of California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with consumer privacy laws may have the right to:
- know what personal information we collect, use, disclose, sell or share, and to access it;
- correct and delete it;
- limit use of sensitive personal information (we do not use it beyond what is allowed);
12. Children, changes and contact
Children. Our website is not directed at children. We do not knowingly collect personal information from children under 13 (US) or under 18 without parental consent where required (Nigeria and UK online services). If you believe a child has given us information, contact us and we will delete it.
Third-party links. Our website and social channels may link to other sites. Their privacy practices are their own; please read their policies.
Changes to this policy. We may update this policy from time to time. We will post the new version here with a new "Last updated" date and, for significant changes, notify you by email or on our website.
Contact us. For any privacy question, request or complaint:
- Email: info@labalaba.shop