What we collect
We collect only what the membership needs to work:
- Identity and contact — your name, email address and phone number, so we can create your account, email you before charges, and let the courier reach you.
- Delivery address — street, landmark, city and state. The landmark field exists because many Nigerian addresses are not routable without one.
- Preferences — ring and watch size, fragrance profile, skin type, beard length and allergies. This is what makes your box yours. Allergy information is health data and we treat it accordingly: it is used to decide what to put in your box and for nothing else.
- Payment token — a Paystack reference to your card. We never receive, store or see your card number, expiry or CVV.
- Usage — which pages you visited before joining, and which step of checkout you reached. We use this to find where the signup process is losing people.
Why we are allowed to hold it
Under the Nigeria Data Protection Act 2023, our bases are:
- Performance of a contract — your name, address, preferences and payment token. Without these there is no box.
- Legal obligation — transaction records we are required to keep for tax and anti-fraud purposes.
- Legitimate interest — funnel analytics and fraud prevention, balanced against your privacy and limited to what is necessary.
- Consent — marketing email beyond your own membership, and your allergy information. You may withdraw either at any time.
Who else sees it
We do not sell your data, and we do not share it for anyone else's advertising. We use these processors, each for one job:
- Paystack (Nigeria) — payment processing and card tokenisation.
- Supabase — database and authentication hosting.
- Cloudinary — hosting product and testimonial images.
- Google Analytics — counting visits and which pages and products are viewed, added to the bag and bought, only if you accept the cookie banner. IP addresses are not stored by Google Analytics 4, and we do not use it for advertising.
- Meta (Facebook and Instagram) — measuring and improving our adverts: which ads lead to visits, products viewed, items added to the bag, purchases and requests. Only if you accept the cookie banner. For purchases and requests we also send Meta your email, phone, name and city in hashed (scrambled) form so it can match them to an ad, never in readable form.
- Couriers — your name, address and phone, only for a delivery in progress.
Some of these store data outside Nigeria. Where they do, transfers are made under the safeguards required by the NDPA.
How long we keep it
- Active membership — for as long as it is active.
- After cancellation — account and preference data for 24 months, in case you rejoin, then deleted.
- Transaction records — 6 years, because tax law requires it.
- Abandoned checkouts — 90 days, then deleted.
Your rights
Under the NDPA you can ask us to:
- give you a copy of everything we hold about you;
- correct anything wrong;
- delete your data, subject to records we must keep by law;
- stop using it for marketing, which you can also do from any email we send;
- export it in a portable format.
Two of these are self-serve and immediate. You can download a copy of everything we hold from your account, and you can delete your account yourself — that page tells you exactly what is erased and what we are required to keep before you confirm anything.
For anything else, email getorbitx@gmail.com and we will respond within 30 days. If you are not satisfied you can complain to the Nigeria Data Protection Commission.
Cookies
We set one cookie, ox_session, which holds an anonymous checkout token so that closing the tab part-way through signup does not lose what you typed. It lasts 7 days.
With your agreement, Google Analytics sets its own cookies (_ga and _ga_…, lasting up to two years) so we can see which pages and products people look at, and the Meta Pixel sets _fbp (and _fbc when you arrive from an advert), lasting up to 90 days, so we can measure our adverts on Facebook and Instagram. We ask the first time you visit; until you accept, none are set, Meta receives nothing, and Google receives only anonymous, cookieless signals. To change your mind, clear this site's data in your browser and you will be asked again.
Security
Traffic is encrypted in transit. Card data never reaches our systems. Access to member data is restricted to staff who need it, and every administrative action on an account is recorded in an audit log. No system is perfect; if we ever suffer a breach affecting your data we will tell you and the NDPC as the law requires.
Children
Orbit X is for adults. We do not knowingly collect data from anyone under 18. If you believe we have, tell us and we will delete it.