Privacy Policy

Last updated: January 1, 2025

GYC Naturals ("we", "our", "us") operates https://gyc-naturals.vercel.app and provides hair salon services and natural hair products. This Privacy Policy explains how we collect, use, and safeguard your personal information. By using our website or services, you agree to this policy.

1. Information We Collect

We collect information you provide directly and data generated automatically:

  • Personal identifiers: Name, email address, phone number
  • Appointment data: Preferred style, requested date/time, service notes
  • Order & payment data: Billing address, order history. Payment card details are processed securely by Paystack and are never stored on our servers.
  • Account data: Password (hashed and salted — never stored in plain text), profile photo (optional)
  • Technical data: IP address, browser type, operating system, pages visited, referring URLs
  • Cookies: Session identifiers, preference tokens (see Section 4)
  • Communications: Messages sent via our contact form or WhatsApp

2. How We Use Your Information

  • To process and fulfil product orders and send delivery updates
  • To book, confirm, and manage salon appointments
  • To process payments via Paystack and send receipts
  • To respond to enquiries and provide customer support
  • To send transactional emails (order confirmations, appointment reminders)
  • To send marketing communications — only with your consent and with an easy opt-out in every email
  • To improve our website, services, and product range through analytics
  • To prevent fraud, detect misuse, and enforce our Terms of Service
  • To comply with applicable Nigerian law and regulations

3. Data Sharing

We do not sell or rent your personal data. We share data only in these circumstances:

  • Paystack: Payment processing. See Paystack's Privacy Policy.
  • Delivery partners: Name and address shared with couriers for order fulfilment.
  • Email providers: We use Resend/PHPMailer to send transactional emails; your email address is transmitted to send each message.
  • Analytics: Anonymised, aggregated data with analytics services.
  • Legal obligations: If required by Nigerian law, a court order, or to protect our rights.
  • Business transfers: If GYC Naturals is acquired or merges, your data may transfer to the new entity.

4. Cookies & Tracking

We use cookies and similar technologies:

  • Essential cookies: Session cookie for login state and shopping cart. Cannot be disabled.
  • Preference cookies: Remember your settings (e.g., currency display).
  • Analytics cookies: Anonymised traffic data. You can opt out via your browser settings.
  • localStorage: Moodboard data stored locally on your device — never transmitted to our servers unless you share a link.

You can delete cookies via your browser settings. Disabling essential cookies will affect cart and login functionality.

5. Data Security

  • All data in transit is encrypted using TLS (HTTPS).
  • Passwords are hashed using bcrypt with a cost factor of 12 — we cannot recover your password.
  • Payment data is handled entirely by Paystack's PCI-DSS compliant infrastructure.
  • We restrict employee access to personal data on a need-to-know basis.
  • Despite these measures, no internet transmission is 100% secure. Please use a strong, unique password.

6. Your Rights

Under the Nigeria Data Protection Regulation (NDPR) and applicable law, you have the right to:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Ask us to correct inaccurate or incomplete data.
  • Deletion: Request that we delete your personal data (subject to legal retention requirements).
  • Withdraw consent: Opt out of marketing emails at any time via the unsubscribe link or by emailing us.
  • Portability: Receive your data in a machine-readable format.
  • Restriction: Ask us to restrict processing of your data in certain circumstances.

To exercise any right, email hello@gycnaturals.com. We will respond within 30 days.

7. Children's Privacy

Our website and services are not directed at children under 13. We do not knowingly collect personal data from children under 13. If we learn that we have inadvertently collected such data, we will promptly delete it. If you believe we hold data about a child, please contact us immediately.

8. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be notified via email or a prominent notice on our website. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of our services after a change constitutes acceptance.

9. Contact Us

Questions about this Privacy Policy or how we handle your data?