Effective Date: 05 April 2026 ·
These terms apply to all users of the Convy Living platform.
1. Who We Are
Convy Living is a furniture manufacturing company incorporated in Nigeria. We operate the website and digital platform at convyliving.com and related subdomains. For the purposes of the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act (NDPA) 2023, Convy Living is the Data Controller of your personal information.
Our registered address and full company details are available on our Contact page. Our Company Registration Number (RC) is published in our footer and legal notices.
2. What Data We Collect
We collect and process the following categories of personal data:
| Category | Data Collected |
|---|
| Account & Identity | Full name, email address, phone number, delivery address, password (hashed — never stored in plain text) |
| Orders & Transactions | Product selections, customisation choices, delivery address, payment status, invoice data |
| Production | Serial number and batch number assignments, QR code scan history |
| Device & Usage | IP address, browser type and version, device fingerprint, pages visited, session duration, referral source |
| Communications | Support ticket content, email and SMS interaction history, live chat transcripts |
| Partner Data | Company name, CAC/RC number, business type, annual spend, tier status, contact person details |
| Enquiry Data | Contact form submissions, project type, budget estimates, message content |
We do not intentionally collect sensitive personal data (such as health, biometric, or financial account data beyond payment status) unless required to deliver a specific service.
3. How We Collect Data
We collect personal data through the following means:
- Account registration and login forms — when you create or update your account.
- Order and checkout forms — when you place an order or request a quote.
- Contact and enquiry forms — when you submit a message or partner application.
- Cookies and tracking technologies — automatically collected during your visit. See our Cookies Policy for details.
- Third-party payment processors — we receive transaction confirmation (not full card data) from Flutterwave and Paystack.
- Support interactions — content you submit through tickets, emails, or SMS.
- QR code scans — device and timestamp data when a product serial QR code is scanned.
4. Why We Use Your Data
We process your personal data on the following legal bases under the NDPR and NDPA 2023:
- Contract performance — to process orders, manage production, coordinate delivery, and handle invoicing.
- Legitimate interests — to operate and improve the platform, prevent fraud, manage customer and partner relationships, and send operational communications.
- Consent — for marketing emails, newsletters, and non-essential cookies. You may withdraw consent at any time.
- Legal obligation — to comply with applicable Nigerian law, tax obligations, and regulatory requirements.
5. How Long We Retain Data
We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law:
- Account data: Retained for the duration of your account plus 3 years after closure, unless a longer period is required by law.
- Order and financial data: Retained for 7 years in compliance with Nigerian tax and financial regulations.
- Support ticket data: Retained for 2 years after ticket closure.
- Device and usage data: Retained for up to 12 months.
- Enquiry and contact form data: Retained for 2 years from the date of submission.
After the applicable retention period, data is securely deleted or anonymised.
6. Who We Share Data With
We do not sell your personal data. We share data only where necessary with trusted service providers operating under strict data protection obligations:
- Payment Processors — Flutterwave and Paystack process payment transactions. They operate under their own privacy and PCI-DSS compliance frameworks.
- SMS Gateway — Our configured SMS provider processes phone numbers to send transactional notifications.
- Email Service — Our SMTP provider sends transactional emails (order confirmations, production updates, account notifications).
- Logistics Partners — Delivery address and contact information is shared with our logistics providers to coordinate delivery.
- Legal & Regulatory Bodies — We may disclose data in response to lawful requests from Nigerian courts or regulatory authorities.
All third-party processors are required to implement adequate data protection measures consistent with the NDPR.
7. International Data Transfers
Some of our service providers may be located outside Nigeria. In such cases, we ensure that adequate safeguards are in place, including contractual clauses consistent with NDPR requirements, before any transfer takes place. We do not transfer data to jurisdictions without an adequate level of data protection without appropriate safeguards.
8. Your Rights
Under the NDPR and NDPA 2023, you have the following rights regarding your personal data:
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — request correction of inaccurate or incomplete data.
- Right to erasure ("right to be forgotten") — request deletion of your data, subject to legal retention requirements.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interests or for direct marketing purposes.
- Right to restriction — request that we limit processing of your data in certain circumstances.
- Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
To exercise any of these rights, contact our Data Protection Officer using the details in Section 12. We will respond within 30 days.
9. Cookies & Tracking Technologies
We use cookies and similar technologies to operate the platform, remember your preferences, and (with your consent) analyse usage. Full details of the cookies we use and how to manage them are in our Cookies Policy.
10. Children's Privacy
The Convy Living platform is not intended for use by persons under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us immediately at the address below and we will take steps to delete it promptly.
11. Data Security Measures
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include:
- Encrypted data transmission (TLS/HTTPS) across all platform pages.
- Password hashing using industry-standard algorithms (bcrypt).
- Role-based access controls limiting staff access to data they need for their function.
- Regular security reviews and activity audit logging.
- Two-factor authentication available for user and partner accounts.
No method of transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach, we will notify affected individuals and the Nigeria Data Protection Commission (NDPC) as required by law.
12. Data Protection Officer
For any questions, requests, or concerns regarding your personal data and our privacy practices, please contact our Data Protection Officer:
- Email: privacy@convyliving.com
- Post: Data Protection Officer, Convy Living, [Address as published on contact page]
- Online: convyliving.com/contact
13. Complaints
If you are not satisfied with our response to a data protection request or concern, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC):
- Website: ndpc.gov.ng
- Email: info@ndpc.gov.ng
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. When we do, we will revise the "Last Updated" date and notify registered users via in-app notification. We encourage you to review this page periodically.