1. Who we are
XTailor(“we”, “us”, “our”) is a made-to-order tailoring service based in Lagos, Nigeria. This Privacy Policy explains what personal data we collect when you use our website and ordering service, why we collect it, how we protect it, and the rights you have over it under the Nigeria Data Protection Act 2023 (NDPA) and generally recognised international privacy practices.
2. What we collect
We collect only what is needed to design, produce, and deliver your order:
- Identity & contact details: full name, phone number, email address.
- Delivery details: delivery address, city, state, and — for “Existing Garment” orders — the pickup/drop-off address for your garment.
- Measurements: either the standard size you select, the custom body measurements and construction preferences you enter (e.g. collar style, sleeve finish), or nothing at all if you choose to send us an existing garment that fits.
- Order history: the designs, fabrics, add-ons, and delivery timelines you choose, and your order status.
- Payment confirmation only: a payment reference and status (paid/pending/failed). We do not collect or see your card number, expiry date, or CVV — see Section 4.
3. How we use your data
- To create, produce, and fulfil your tailoring order.
- To contact you about your order status, delivery, or an issue with your measurements.
- To respond to customer support enquiries you raise via WhatsApp, email, or phone.
- To detect and prevent fraud or abuse of our ordering and coupon systems.
- To meet legal and tax record-keeping obligations.
We do not sell your personal data, and we do not use your measurements or order history for advertising.
4. Payments — what we never see
All payments are processed by Paystack, a licensed payment service provider. When you pay, your card or bank details are entered directly on Paystack’s secure payment page — XTailor’s servers never receive, process, or store your card number, expiry date, CVV, or bank login details. We only ever receive a payment reference and a paid/failed status back from Paystack, which we use to confirm your order.
5. Storage, retention, and international transfer
Your data is stored in a securely hosted PostgreSQL database, accessed only over encrypted connections and protected behind authenticated admin access. We retain order and payment records (including measurements) for up to 6 years after your order is completed, to handle warranty/quality claims and meet standard tax and accounting record-keeping practice in Nigeria, after which they are archived or deleted. You may request earlier deletion under Section 8, subject to that legal obligation to retain order/financial records.
Some of our infrastructure providers (our database host and image-storage provider) operate servers outside Nigeria, including in the European Union. Where your data is processed or stored outside Nigeria, we rely on those providers’ own security and data-protection safeguards, and only use providers who are contractually bound to protect your data to a standard consistent with the NDPA.
6. Who we share data with
- Paystack — to process your payment (Section 4).
- Cloudinary — our image hosting provider, used for catalogue design/fabric photos and, if you place an “Existing Garment” order and choose to upload one, a photo of your garment.
- Delivery/courier partners — your name, phone number, and delivery address, solely to deliver your order or collect an existing garment.
- Our email provider — to send order confirmations, status updates, and account emails (password reset, email verification) on our behalf.
- We do not share your data with advertisers or data brokers, and we only share it with the parties above for the operational purposes described in this policy.
7. Cookies and local storage
We keep this simple and disclose it accurately — see our full Cookie Policy for details on the one session cookie and the browser storage we use to remember your cart while you shop.
8. Your rights under the NDPA
As a data subject under the Nigeria Data Protection Act, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or outdated information (e.g. an old delivery address).
- Request erasure of your data, subject to our legal obligation to retain financial/order records for tax purposes.
- Data portability — request a copy of your data in a structured, commonly used format to transfer elsewhere.
- Object to certain uses of your data.
- Withdraw consent where processing is based on consent.
To exercise any of these rights, contact us at xpresstailorventures@gmail.com or +234 707 670 7604— this inbox is our privacy contact point for data protection queries. We will respond within a reasonable time and in line with NDPA requirements. If you’re unsatisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC).
9. Security and breach notification
We use HMAC-signed, httpOnly session cookies, hashed (never plaintext) passwords, role-based access controls, rate limiting on sign-in and account-recovery attempts, and encrypted connections (HTTPS) in production. We do not expose secret keys or payment credentials in any client-facing code.
In the event of a personal data breach that poses a risk to your rights, we will assess it without undue delay and, where required under the NDPA, notify the Nigeria Data Protection Commission and affected customers.
10. Children
Our service is intended for adults placing tailoring orders and is not directed at children.
11. Changes to this policy
We may update this Privacy Policy as our service evolves. Material changes will be reflected by updating the “Last updated” date above.
12. Contact us
XTailor
31/33 Town Planning Way, Ilupeju, Lagos 100252, Nigeria
Email: xpresstailorventures@gmail.com
Phone: +234 707 670 7604