Privacy Policy

This Privacy Policy is issued by iFashy Fashion Limited (“iFashy”, “we”, “us”, or “our”), the data controller responsible for personal data collected through the iFashy Academy platform (“Platform”).

We are committed to protecting your privacy in accordance with the Nigeria Data Protection Act 2023 (NDPA) and the regulations issued thereunder by the Nigeria Data Protection Commission (NDPC). This Policy explains what personal data we collect, how we use it, and what rights you have.

Our data protection contact is reachable through our contact page.

We collect personal data in the following categories:

• Identity data: full name, username, profile photo.
• Contact data: email address, phone number (where provided).
• Account data: password (stored as a secure hash — never in plain text), account creation date, role.
• Transaction data: course enrolments, payment amounts, payment references, and coupon codes used. We do not store card numbers or bank account details — these are handled exclusively by our payment processors.
• Usage data: pages visited, course progress, lesson completion, assessment submissions, time spent, device type, browser, and IP address.
• Communications data: messages sent through contact forms, discussion posts, and support correspondence.
• Technical data: cookies, session tokens, and similar identifiers as described in Section 7.
• Mobile app data: if you use our iOS or Android app, device identifiers, app version, push-notification tokens (to deliver notifications via Apple Push Notification service and Firebase Cloud Messaging), and in-app purchase references provided by the Apple App Store or Google Play. We do not receive your card details from the app stores.

• Directly from you when you register, enrol in a course, make a payment, or contact us.
• Automatically as you navigate the Platform, via cookies, server logs, and analytics tools.
• From third parties such as Google (if you use Google Sign-In) and payment processors (transaction status and references).

Under the NDPA 2023, we process your data on the following legal bases:

We do not sell your personal data. We may share it with the following categories of recipients, only to the extent necessary:

• Payment processors (e.g. Paystack, Flutterwave, Korapay) to process transactions. They act as independent data controllers for payment data under their own privacy policies.
• App stores (Apple App Store, Google Play) where you purchase through our mobile apps. They process in-app purchases and act as independent controllers for that payment data under their own privacy policies.
• Push-notification providers (Apple Push Notification service and Google Firebase Cloud Messaging) to deliver mobile notifications you have enabled.
• Cloud and infrastructure providers who host the Platform and store data on our behalf under data processing agreements.
• Email service providers used to deliver transactional and marketing communications.
• Analytics providers who help us understand Platform usage (data is pseudonymised where possible).
• Legal authorities where we are required to disclose data by Nigerian law, court order, or regulatory demand.

Where third parties process data on our behalf, we require them to maintain appropriate security standards and to use the data only for the specified purpose.

We retain your personal data for as long as necessary to fulfil the purposes described in this Policy:

• Account data: for the lifetime of your account, plus 12 months after deletion (for fraud prevention).
• Transaction records: 7 years, in compliance with Nigerian financial record-keeping requirements.
• Course progress data: for the lifetime of your account.
• Marketing preferences: until you withdraw consent or request deletion.
• Support correspondence: 2 years from the date of resolution.

After the applicable retention period, data is securely deleted or anonymised.

We use cookies and similar technologies to operate the Platform, maintain your session, and understand how users interact with content. Categories of cookies we use:

• Strictly necessary: session authentication tokens required for the Platform to function. These cannot be disabled.
• Analytics: used to measure page views and course engagement (anonymised). You may opt out via your browser settings.
• Preference: remember your language and display settings.

We do not use third-party advertising or tracking cookies. You may manage cookie preferences through your browser settings; disabling strictly necessary cookies will prevent you from logging in.

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include TLS encryption in transit, hashed password storage (bcrypt), role-based access controls, and regular security reviews. No system is completely secure; in the event of a data breach that poses a risk to your rights, we will notify the NDPC and affected individuals as required by the NDPA 2023.

As a data subject under Nigerian law, you have the following rights with respect to your personal data:

• Right to access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your data where there is no lawful basis for continued processing.
• Right to restriction: request that we limit how we process your data in certain circumstances.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interest, including for direct marketing.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, send us a request through our contact page. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

The Platform is not directed at children under 18. We do not knowingly collect personal data from users under 18 without verifiable parental consent. If you believe a minor has registered without consent, please tell us through our contact page and we will promptly delete the account.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material updates will be communicated by email and a notice on the Platform at least 14 days before they take effect. The “Effective date” at the top of this page will always reflect the current version.

For privacy-related enquiries, contact us at: