Legal

Privacy Policy

This policy explains what personal data Bfits collects when you shop with us, why we collect it, who we share it with, and the choices you have. It applies to bfitsng.com and to any order you place with us.

Last updated: 5 September 2026

Who we are

Bfits is a fashion brand based in Lagos, Nigeria. We sell women's and men's ready to wear, beach wear, shoes and bags to customers in Nigeria and abroad. For the purposes of the Nigeria Data Protection Act 2023, Bfits is the data controller for the personal data described in this policy.

You can reach us about anything in this policy at hello@bfitsng.com.

What we collect and why

We only collect what we need to run the shop. In practice that is the following.

Account and contact details

Your name, email address and phone number. We use these to identify you, to confirm your order, to answer your questions and to reach you if there is a problem with a delivery.

Delivery and billing addresses

We use these to calculate your shipping cost, to get your parcel to you and to match a payment to an order.

Order history

What you bought, when, how much you paid and the status of the shipment. We use this to fulfil orders, to handle returns and exchanges, and to keep the accounting and tax records a business is required to keep.

Newsletter subscriptions

If you sign up, we store your email address so we can send you new arrivals, sales and offers. You can unsubscribe at any time using the link in any email we send, or by writing to us.

Payment information

Card and bank details are entered directly with our payment processor, Paystack. They are never sent to or stored on our own servers. We receive only a confirmation that a payment succeeded or failed, along with a reference for that transaction.

Technical and usage data

Basic information your browser sends, such as your device type and approximate location, plus what you viewed on the site. We use this to keep the site working, to protect against fraud and abuse, and to understand which products people are looking for.

Our legal basis

Under the Nigeria Data Protection Act 2023 we must have a lawful basis for using your data. We rely on the following.

  • Performance of a contract. We need your name, contact details and address to accept your order, take payment and deliver your purchase.
  • Consent. We send marketing email only to people who have asked for it. You can withdraw that consent at any time, and withdrawing it does not affect anything we sent before.
  • Legal obligation. We keep records of sales and payments because tax and accounting law requires it.
  • Legitimate interests. We use limited technical data to keep the site secure, to prevent fraud and to improve what we offer, balanced against your privacy.

Who we share it with

We do not sell your personal data, and we do not rent or trade it. We share it only with the service providers we need to run the shop, and only with the data they need to do their job.

  • Paystack processes card and bank payments. Your payment details go to them directly, not through us.
  • Resend delivers our transactional email, such as order confirmations, and our newsletter. They receive your email address and the contents of the message.
  • Supabase hosts our database. Your account, order and address records are stored there.
  • Delivery couriers. We pass your name, delivery address and phone number to the courier handling your parcel so they can complete the delivery.
  • Authorities and advisers. We may disclose data where the law requires it, or where it is necessary to establish or defend a legal claim.

Some of these providers operate servers outside Nigeria. Where your data is transferred abroad, we rely on providers that offer contractual protections for that data, as contemplated by the Nigeria Data Protection Act 2023.

How long we keep it

We keep your personal data for as long as it is needed for the purposes set out above. In practice that means we keep your account and its order history for as long as your account is open, and we keep transaction records for as long as tax and accounting law requires us to. Newsletter subscribers are kept on the list until they unsubscribe. When data is no longer needed for any of these purposes, we delete it or remove the details that identify you.

Cookies

We use cookies and similar browser storage to keep the site working. That includes remembering what is in your cart, keeping you signed in between pages, and protecting forms and checkout against abuse. These are necessary for the shop to function, and turning them off will stop parts of the site from working.

You can clear or block cookies in your browser settings at any time. Note that our payment processor may set its own cookies on the pages where you enter payment details.

Keeping your data safe

Traffic to and from the site is encrypted. Access to customer records is restricted to the people who need it to fulfil orders and answer support requests, and our database enforces those restrictions at the row level. No system is perfect, but we take reasonable technical and organisational measures to protect your data, and we will notify you and the relevant authority if a breach affecting you occurs.

Your rights

Under the Nigeria Data Protection Act 2023 you have the right to do the following.

  • Ask what personal data we hold about you, and get a copy of it.
  • Ask us to correct data that is wrong or out of date.
  • Ask us to delete your data, where we are not required to keep it for legal or accounting reasons.
  • Ask us to restrict or stop a particular use of your data.
  • Withdraw your consent to marketing at any time.
  • Ask for your data in a portable form so you can move it elsewhere.
  • Object to a use of your data that relies on our legitimate interests.

To exercise any of these, write to hello@bfitsng.com. We will respond within a reasonable period and will not charge you for a normal request. We may ask you to confirm your identity first so we do not hand your data to someone else.

If you are not satisfied with how we have handled your data, you may complain to the Nigeria Data Protection Commission.

Children

Our shop is not intended for children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, contact us and we will remove it.

Changes to this policy

We may update this policy as the shop changes or as the law does. The date at the top of this page shows when it was last revised. If a change materially affects how we use your data, we will make that clear on the site.

Contact us

Questions about this policy, or about the data we hold on you, go to hello@bfitsng.com. You can also reach us through our contact page.