Wholeshield Policies

SCOPE OF THIS PRIVACY POLICY

This Privacy Policy explains how we collect, use, store, disclose, and protect personal data when you:

• Use our **mobile application**
• Visit or shop on our **website and online store**
• Interact with us via **email, phone, social media, or digital advertising**
• Engage with our customer support or promotions

This Policy applies to all users within Nigeria and, where applicable, users outside Nigeria.

Personal information we collect

Information You Provide Directly

We may collect the following personal data when you register, place orders, or contact us:

• Full name
• Email address
• Phone number
• Delivery and billing address
• Account login details
• Payment information (processed securely via third-party payment gateways)
• Prescription or health-related information **only when voluntarily provided and required for order fulfilment**

Automatically Collected Information

When you use our App or website, we may automatically collect:

• IP address
• Device type, operating system, and browser
• App usage data and interaction logs
• Date, time, and duration of visits
• Location data (where enabled)

Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Enable core website and App functionality
• Improve user experience and performance
• Analyze traffic and usage trends

You may disable cookies through your browser or device settings, though some features may not function properly.

Purpose of Data Collection

We process personal data for the following lawful purposes:

• Creating and managing user accounts
• Processing orders, payments, and deliveries
• Providing customer support and responding to inquiries
• Sending transactional communications (order updates, receipts)
• Sending marketing or promotional messages with your consent
• Improving our products, services, and digital platforms
• Ensuring security, fraud prevention, and regulatory compliance

Legal Basis for Processing (NDPR Compliance)

In line with NDPR, we process personal data based on:

• **Consent** – where you have freely given permission
• **Contractual necessity** – to fulfil orders and provide services
• **Legal obligation** – compliance with Nigerian laws and regulations
• **Legitimate interest** – service improvement, security, and business operations

Disclosure of Personal Data

We may share personal data with:

Service Providers

Trusted third parties who support our operations, including:

• Payment processors
• Logistics and delivery partners
• IT, hosting, and cloud service providers
• Analytics and marketing service providers

All such parties are contractually required to protect your data.

Legal and Regulatory Authorities

Where disclosure is required by law, regulation, court order, or regulatory authority in Nigeria.

Business Transfers

In the event of a merger, acquisition, or asset sale, personal data may be transferred subject to confidentiality and data protection obligations.

Data Security Measures

We implement appropriate technical and organizational safeguards to protect personal data, including:

• Secure servers and encrypted data transmission
• Restricted access to personal information
• Regular system monitoring and updates

While we take reasonable steps to secure data, no system is completely risk-free.

Data Retention

We retain personal data only for as long as necessary to:

• Fulfil the purposes outlined in this Policy
• Meet legal, accounting, and regulatory requirements

Data that is no longer required is securely deleted or anonymized.

Your Rights Under NDPR

As a data subject under Nigerian law, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion or restriction of processing
• Withdraw consent at any time
• Object to direct marketing communications
• Request data portability where applicable

Requests may be subject to verification and applicable legal limitations.

Children's Data

Our Services are not intended for individuals under the age of 13 years. We do not knowingly collect personal data from children without appropriate parental or legal guardian consent.

International Data Transfers

Where personal data is transferred outside Nigeria, we ensure that such transfers comply with NDPR requirements and that adequate data protection safeguards are in place.

Third-Party Links

Our platforms may contain links to third-party websites or services. We are not responsible for the privacy practices or content of such third parties.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on our website and App with an updated effective date. Continued use of our Services constitutes acceptance of the revised Policy.