Legal

Privacy Policy

Last updated: September 2026

Faaji & Brew AfroMart ("we", "us") is the data controller for the personal data described below. This policy explains what we collect, why, and the rights you have over it under the General Data Protection Regulation (GDPR).

1. What we collect

Account details — username, email address, and a securely hashed password when you register.
Order & delivery details — full name, delivery address, and country, so we can fulfil and ship your order.
Order history — the products, quantities, and totals for orders you've placed, so you can view them again in your account.
Wishlist & reviews — products you've saved, and any review text or star rating you choose to submit.
Newsletter email — only if you sign up, and only after you confirm via the link we send you (double opt-in). You can unsubscribe at any time.

2. What we don't collect

We never see or store your card number, expiry date, or CVC. Card payments are handled entirely by Stripe, our PCI-DSS-certified payment processor — we only ever receive a payment reference from them, never the card details themselves.

3. Why we process your data

To perform our contract with you — taking and fulfilling orders, sending order confirmation emails, handling returns.
With your consent — sending newsletter emails, which you opt into and can withdraw consent for at any time.
Legitimate interest — keeping the Site secure and working properly (for example, keeping you logged in between pages).

4. Cookies

The Site currently uses only strictly necessary cookies: one to keep you logged in, one to remember your basket, and one that protects forms from cross-site request forgery. None of these are used for advertising or tracking, and under GDPR/ePrivacy rules, strictly necessary cookies don't require consent. We still show a cookie notice on your first visit for transparency, and if the Site ever adds optional cookies (analytics or advertising), that banner is where you'd be asked to opt in first — nothing optional will load before you say yes. You can change your choice at any time using "Manage Cookie Preferences" in the footer.

5. Who we share data with

Stripe — to process payments.
Neon & Heroku — our database and hosting providers, who store data on our behalf under their own data processing terms.
Cloudinary — hosts our product photography only; it does not receive or store your personal data.

We don't sell your data to anyone.

6. How long we keep it

Account and order data is kept for as long as your account is active, so your order history stays available to you. If you delete your account, we remove your personal details, keeping only what we're legally required to retain (for example, transaction records for tax purposes).

7. Your rights

Under GDPR you have the right to access, correct, or delete your personal data, restrict or object to how we use it, and receive a copy of it in a portable format. To exercise any of these, email emmy4toz2010@gmail.com. If you're not satisfied with our response, you can complain to Ireland's Data Protection Commission at dataprotection.ie.

8. Contact

Questions about this policy or your data? Email emmy4toz2010@gmail.com.