Privacy Policy

REKA BENTUK AFRICA (RC [RC NUMBER — TO BE CONFIRMED]) is a company registered in Nigeria, with its studio at 26 Ogunlana Dr, Surulere, Lagos 101241, Nigeria. We are the data controller for the information described here — meaning we decide why it is held and what happens to it.

For anything in this policy, including a request to see or delete your data, write to management@rekacompany.com.

We only ever collect what a particular action requires. Nothing here is gathered speculatively.

When you open an account: your email address, and your name if you give one. If you sign in with Google instead of a password, we never see or store a password at all.

When you place an order: your name, email address, phone number and delivery address — street, apartment, nearest landmark, city, state, postcode and country — along with what you ordered. The phone number is passed to the courier, who cannot deliver without a reachable number.

When you book a bespoke consultation: your name, email address, phone number, the date and time you chose, and any notes you write for the atelier.

Automatically: your IP address is held in memory for sixty seconds to limit how often a single visitor can hit our sign-in and checkout endpoints. It is used to stop abuse, is never written to our database, and is never linked to your account.

We never see your card. Card details are entered on Paystack's or Stripe's own pages and never reach our servers.

To perform our contract: taking payment, making and delivering your order, handling returns, and arranging a consultation you asked for. Without this information we cannot complete the order.

Legitimate interests: keeping accounts secure, preventing fraud and rate-limiting abuse.

Legal obligation: keeping transaction records for tax and accounting.

Consent: anything you explicitly agree to, including optional cookies. You can withdraw consent at any time through cookie preferences, as easily as you gave it.

We do not profile you, and we do not advertise to you. This site runs no analytics, no advertising pixels and no tracking scripts of any kind. There is no Meta Pixel, no Google Analytics tag and no third-party measurement code on any page.

We never sell your personal data, and we never share it so that someone else can market to you. No automated decision-making is applied to you.

If that changes, this section and our cookie notice will be updated first, and nothing non-essential will load until you have agreed to it.

We are based in Lagos, but several of the providers above host their services outside Nigeria — Supabase, Stripe and Resend operate from data centres in the European Union and the United States. Your information is therefore transferred abroad.

We only use providers that commit contractually to protecting it, including through standard contractual clauses where those apply.

Orders and invoices are kept for seven years, because Nigerian tax law requires it.

Account details are kept until you ask us to close the account, after which they are deleted except for what must remain attached to past orders.

Consultation notes, including measurements, are kept for twenty-four months so a repeat commission does not start from nothing. Ask and we will delete them sooner.

Under the Nigeria Data Protection Act 2023 — and, if you are in the United Kingdom or the European Economic Area, under the UK GDPR and the GDPR — you may ask us to:

• give you a copy of the personal data we hold about you;
• correct anything inaccurate or incomplete;
• delete it, where we have no continuing legal reason to keep it;
• restrict or object to how we are using it;
• send it to you, or to another provider, in a portable format; and
• withdraw consent you previously gave, at any time.

Write to management@rekacompany.com and we will respond within 30 days. Exercising any of these rights is free, and we will not treat you differently for it.

If you are not satisfied with our response you may complain to the Nigeria Data Protection Commission, or, if you are in the UK or the EEA, to your national data protection authority.

The whole site is served over HTTPS and enforces it. Session cookies are set so that JavaScript cannot read them, and are restricted to this site so they are not sent to anyone else. Access to the studio console is restricted, and database rules keep one customer's records out of another's reach.

No system is perfect. If a breach ever affects your data, we will tell you and the regulator as the law requires.

This shop is not intended for children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us information, write to us and we will delete it.