Privacy Policy
Table of Contents
Table of Contents
1. Introduction
AURELIA’S BASKET (trading as Aurelia’s Basket “we”, “us” or “the Business”) creates and delivers luxury food trays, hampers and gifting experiences to clients in Nigeria and internationally.
AURELIA’S BASKET is a business enterprise registered in Nigeria under Part B of the Companies and Allied Matters Act 2020, with registration number BN 2555604, and having its principal place of business at Milverton Court, Osapa London, Lekki, Lagos Nigeria.
We understand that trust is central to gifting; our clients share personal information about themselves and about the people they are celebrating, and we take the protection of that information seriously.
This Privacy Policy (“Policy”) explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the rights available to you. It applies to our website: www.aureliasbasket.com, our social media and messaging channels, our physical showroom/atelier (if any), and any order placed by phone, WhatsApp, email or in person.
Applicability of Foreign Data Protection Laws
This Privacy Notice is principally governed by the Nigeria Data Protection Act 2023. Where our activities or the processing of personal data fall within the territorial or other applicable scope of data protection laws in another jurisdiction, we will comply with the requirements of such laws to the extent applicable.
Accordingly, the provisions below concerning the EU General Data Protection Regulation (EU GDPR), the UK General Data Protection Regulation (UK GDPR) and applicable US state privacy laws apply only where the relevant law applies to Aurelia’s Basket and to the particular processing activity or request.
2. Who this policy covers
This Policy applies to:
- Clients / purchasers who order gifts, trays or hampers from us for themselves or on behalf of others;
- Gift recipients whose name, address and contact details are provided to us by a purchaser for the purpose of delivery (see Section 8, “Information About Gift Recipients”);
- Corporate and B2B clients, including staff of client organisations who place or manage bulk/corporate gifting orders;
- Website and social media visitors, including prospective clients browsing our catalogue; and
- Newsletter and marketing subscribers.
This Policy does not apply to information you provide to third-party platforms (such as Instagram, WhatsApp Business, or payment processors) that is governed by those platforms’ own privacy policies.
3. Information we collect
3.1 Information You Provide to Us Directly
| S/N | Category | Examples | Source |
|---|---|---|---|
| 1 | Identity & contact data | Full name, email address, phone number, billing address | Provided by you at checkout, by phone, WhatsApp or email |
| 2 | Delivery data | Delivery address, landmark/access notes, alternate contact person | Provided by you or the recipient |
| 3 | Order & preference data | Selected tray/hamper package, customisation notes, occasion (e.g. birthday, wedding, corporate event) | Provided by you at time of order |
| 4 | Dietary or allergen information | Where you select package options indicating dietary preferences (e.g. nut-free, halal, vegetarian) or note an allergy in special instructions | Provided voluntarily by you |
| 5 | Payment data | Card details or bank information processed via our payment processor; we receive only confirmation of payment, masked card details, and transaction reference, we do not store full card numbers | Collected by our payment processor |
| 6 | Corporate/B2B data | Company name, business address, procurement contact name, role, and order/delivery schedules | Provided by the corporate client or its representative |
| 7 | Communications | Records of calls, emails, WhatsApp messages and chat correspondence with our team | Generated when you contact us |
3.2 Information About Gift Recipients
Because our service involves sending gifts to third parties, we routinely collect the name, phone number and delivery address of a gift recipient from the purchaser rather than from the recipient directly. We process this information solely to fulfil delivery of the gift and to communicate with the recipient about the delivery (e.g. to confirm availability or arrange access). See Section 8 for more on how we handle this.
3.3 Information Collected Automatically
- Device and usage data: IP address, browser type, device identifiers, pages viewed, and time spent on our website, collected via cookies and similar technologies (see Section 12);
- Location data: approximate location inferred from your IP address, used for delivery-zone estimation and fraud prevention.
- Analytics and advertising identifiers from tools such as Google Analytics, META Pixel, and other relevant technology
3.4 Information From Third Parties
- Payment confirmation and fraud-check data from our payment processor;
- Delivery status updates from our logistics and courier partners;
- Publicly available information (e.g. a corporate client’s publicly listed business address) used to fulfil bulk orders.
3.5 Sensitive / Special Category Data
Dietary, health-related or allergen information you or a recipient voluntarily provide may constitute sensitive personal data under the NDPA and “special category data” under the GDPR. We only use this information to prepare and fulfil your order safely (e.g. to avoid known allergens) and we do not use it for any other purpose, including marketing or profiling.
We collect it only where you or the recipient choose to provide it, and by providing it you consent to our limited use of it for this purpose.
4. How we use your information
We use personal data for the following purposes:
| Purpose | Categories of data used |
|---|---|
| Processing and fulfilling your order, including preparing, packaging and delivering trays/hampers | Identity, contact, delivery, order, dietary, payment data |
| Communicating with you about your order (confirmations, delivery updates, issues) | Contact, order data |
| Processing payments and preventing fraud | Payment data, device/usage data |
| Managing corporate/B2B accounts and recurring gifting programmes | Corporate data, contact data |
| Sending marketing communications, offers and occasion reminders (e.g. birthday/anniversary prompts), where you have opted in | Contact, preference data |
| Improving our website, catalogue and services | Usage, analytics data |
| Complying with legal, tax and regulatory obligations | Identity, payment, transaction data |
| Establishing, exercising or defending legal claims | Any relevant category |
5. Legal basis for processing
5.1 Under the Nigeria Data Protection Act 2023
We rely on one or more of the following lawful bases recognised under the NDPA:
- Consent — e.g. for marketing communications and for optional dietary/preference information.
- Performance of a contract — to process and deliver an order you have placed.
- Legal obligation — e.g. tax, accounting and consumer protection record-keeping.
- Legitimate interest — e.g. fraud prevention and service improvement, balanced against your rights and reasonable expectations.
5.2 Under the GDPR / UK GDPR (Where Applicable)
Where the GDPR/UK GDPR GDPR applies to our processing of your personal data, you may have additional rights under the GDPR/UK GDPR, including the rights of access, rectification, erasure, restriction of processing, data portability and objection, subject to the conditions and limitations prescribed by applicable law.
5.3 Under United States State Privacy Laws (Where Applicable)
Where applicable state law (such as the CCPA/CPRA) applies to you, we process personal information for the business and commercial purposes described in this Policy and do not “sell” or “share” personal information for cross-context behavioural advertising as those terms are defined under such laws, except as described in Section 12 (Cookies) below.
6. How we share your information
We do not sell your personal data. We share personal data only with the following categories of recipients, and only as necessary:
| Recipient | Purpose |
|---|---|
| Payment processors | To process payment for your order securely |
| Delivery/logistics and courier partners | To deliver your gift to the recipient's address |
| Email/SMS/WhatsApp marketing and communication platforms | To send order updates and, where consented, marketing messages |
| Cloud hosting and IT service providers | To store and secure our systems and data |
| Analytics providers such as Google Analytics | To understand website usage and improve our service |
| Professional advisers (auditors, lawyers, accountants) | To obtain professional advice and meet compliance obligations |
| Regulators and law enforcement | Where required by Nigerian law or the law of another applicable jurisdiction |
| A buyer or successor, in the event of a merger, acquisition or sale of business assets | To continue business operations, subject to equivalent protections |
Each third party is permitted to use personal data only for the purpose for which it was shared and is required, by contract or applicable data protection law, to apply appropriate safeguards.
7. International transfers of data
Some of our service providers, including hosting, email, payment, analytics and other technology providers, may store or process personal data outside Nigeria.
Where personal data is transferred outside Nigeria, we will take appropriate steps to ensure that the transfer is carried out in accordance with the Nigeria Data Protection Act 2023 and applicable requirements of the Nigeria Data Protection Commission concerning cross-border transfers. Depending on the circumstances, this may include:
- transferring personal data to a country or organisation recognised as providing an adequate level of protection;
- relying on appropriate safeguards or other legally recognised transfer mechanisms; or
- relying on a lawful derogation or other basis permitted under applicable data protection law, including where the transfer is necessary for the performance of a contract or to take steps at your request before entering into a contract.
Where the GDPR or UK GDPR applies to our processing and a transfer of your personal data constitutes a restricted international transfer under the applicable law, we will use an appropriate transfer mechanism or safeguard as required by that law.
We may therefore process or transfer personal data through service providers located in, or operating from, jurisdictions outside Nigeria, including the European Union, United Kingdom or United States, where applicable.
8. Information about gift recipients: special notice
Because gifting inherently involves sharing information about someone other than the purchaser, we draw particular attention to the following:
- When you place an order for someone else, you confirm that you have the recipient’s permission (or another lawful basis, such as an existing relationship where disclosure of a delivery address would reasonably be expected) to share their name, phone number and address with us for delivery purposes.
- We use recipient information solely to prepare, arrange and complete delivery of the gift, including contacting the recipient to confirm delivery details, and we do not use it for marketing unless the recipient separately opts in (for example, by placing their own order with us).
- We retain recipient data only for as long as necessary to complete the delivery and for the limited period described in Section 10 (Data Retention).
- A gift recipient may contact us at aureliasbasket@gmail.com to ask what information we hold about them and we can provide them with access to this policy.
9. Corporate and bulk gifting clients
Where we work with corporate clients on bulk or recurring gifting programmes (e.g. staff hampers, client appreciation gifts), we process the business contact details of the client’s representatives, and the name/address details of each individual recipient supplied to us by the corporate client.
Corporate clients are responsible for ensuring they have a lawful basis to share the personal data of their staff, customers or contacts with us (for example, appropriate notice or consent under their own privacy policies), and we process such data strictly as instructed by the corporate client and for the purpose of fulfilling the relevant order. Where the volume or nature of processing warrants it, we may enter into a separate data processing agreement with corporate clients.
10. Data retention
We keep personal data only for as long as reasonably necessary for the purposes described in this Policy, taking into account the nature of our business as a bespoke gifting service. As general guidance:
| S/N | Data category | Typical retention period |
|---|---|---|
| 1 | Order, delivery and payment records | Retained for as long as reasonably necessary for legitimate business purposes, including maintaining transaction records, accounting and tax compliance, customer service and for such other obligations under Nigerian and applicable law |
| 2 | Recipient contact/delivery details | Until delivery is completed, plus a short period thereafter to resolve any delivery issues, then deleted or anonymised unless the recipient becomes a client in their own right |
| 3 | Marketing/newsletter data | Until you unsubscribe or withdraw consent, or after 12 months of inactivity |
| 4 | Dietary/allergen notes | For the duration of the relevant order only, then deleted unless retained as part of your standing account preferences at your request |
| 5 | Website analytics data | As set by the relevant analytics provider. |
| 6 | Correspondence and complaint records | Sufficient time to allow us to handle any follow-up or disputes. |
We will retain and use personal data for longer where necessary to comply with a legal obligation, resolve a dispute, or enforce our agreements. These are indicative periods that Aurelia’s Basket may refine based on its operational needs; they are intended to be proportionate and not unnecessarily long, reflecting the nature of a bespoke gifting business rather than a high-risk data processing operation.
11. Your rights
11.1 Rights Under the Nigeria Data Protection Act 2023
Subject to the conditions and limitations prescribed by applicable law, you have rights in relation to your personal data, including:
- Be informed of how your data is collected and processed (as set out in this Policy);
- Access the personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Request deletion or restriction of your data, subject to our legal, regulatory, and contractual obligations.
- Object to processing carried out on the basis of legitimate interest and processing for direct marketing.
- Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
- Receive or request portability of your personal data, where technically feasible and applicable legal requirements are met; and
- Lodge a complaint with the Nigeria Data Protection Commission (NDPC) where you believe your rights have been infringed.
11.2 Rights Under the GDPR / UK GDPR (EU/UK Residents)
Where the processing of your personal data is subject to the EU GDPR or UK GDPR, you may have additional or different rights under the applicable legislation. These may include rights relating to access, rectification, erasure, restriction of processing, data portability, objection and, where applicable, automated decision-making.
Where applicable, you may also have the right to lodge a complaint with the relevant supervisory authority, such as the Information Commissioner’s Office (ICO) in the UK or the competent data protection authority in an EU Member State.
11.3 Rights Under US State Privacy Laws (Where Applicable)
Where the processing of your personal information is subject to applicable US state privacy legislation, you may have additional rights under that legislation, which may include rights to access or know, correct, delete, opt out of certain forms of processing, and to receive equal treatment for exercising applicable privacy rights.
Where applicable, we will provide any additional rights and protections required by the relevant US state privacy law.
We do not sell personal information.
11.4 How to Exercise Your Rights
You may exercise your applicable rights by contacting us at aureliasbasket@gmail.com. We will respond within the time period required by applicable law. We may request information reasonably necessary to verify your identity and protect against unauthorised access to personal data.
Where a request cannot be fulfilled, we will, where required by law, explain the reason and inform you of any applicable right to challenge or complain about the decision.
12. Cookies and similar technologies
Our website uses cookies and similar tracking technologies to operate effectively, remember your preferences, and understand how visitors use our site.
| S/N | Cookie type | Purpose |
|---|---|---|
| 1 | Strictly necessary | Enable core functionality such as your shopping cart and checkout |
| 2 | Functional | Remember preferences such as language or previously viewed items |
| 3 | Analytics | Help us understand site traffic and usage patterns |
| 4 | Marketing/advertising | Used to show you relevant offers on other platforms, where you consent |
Where required (including for EU/UK visitors), we will request your consent to non-essential cookies through a cookie banner before they are set, and you can change your preferences at any time via the Cookie settings link.
13. Marketing communications
Where you have opted in, we may send you offers, seasonal gifting suggestions, and occasion reminders by email, SMS or WhatsApp. You may opt out at any time by using the “unsubscribe” link in our emails, replying “STOP” to SMS/WhatsApp messages, or contacting us directly at aureliasbasket@gmail.com
Opting out of marketing does not affect transactional messages relating to an order you have placed.
14. Data security
We take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful access, processing, loss, destruction, alteration or disclosure, having regard to the nature of the personal data we process, and the risks associated with its processing.
These measures may include appropriate access controls, security measures for the transmission and storage of personal data, and appropriate safeguards applied by our service providers and other persons who process personal data on our behalf.
Where payments are processed through third-party payment service providers, we do not ordinarily store full payment card details.
While we take reasonable steps to protect personal data, no method of transmission or storage can be guaranteed to be completely secure.
Where a personal data breach occurs, we will assess and manage the breach in accordance with the Nigeria Data Protection Act 2023 and applicable regulatory requirements, including making any notifications to the Nigeria Data Protection Commission or affected individuals where required by law.
15. Children's privacy
Our services are intended for adults. We do not knowingly collect personal data directly from children. Where a gift is intended for a child recipient, the relevant information is provided to us by the adult purchaser, not the child, and is used solely for delivery purposes.
16. Changes to this policy
We may update this Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated Policy on our website with a revised “Last Updated” date, and where changes are material, we may provide additional notice (which could be by email).
17. Contact us
If you have questions, concerns, or wish to exercise your rights regarding this Policy, please contact:
AURELIA’S BASKET
Attn: Customer Service – Privacy Enquiries
Address: Milverton Court, Osapa London, Lagos, Nigeria
Email: aureliasbasket@gmail.com
Phone: +234 902 995 1145
REGULATORY CONTACTS
Nigeria: Nigeria Data Protection Commission (NDPC) — www.ndpc.gov.ng
United Kingdom: Information Commissioner’s Office (ICO) — ico.org.uk
European Union: your national Data Protection Authority — see edpb.europa.eu for a full list