Last updated: 25 September 2026
Belleza Detty December
A campaign and service of BELLEZA.WORLD LIMITED
Registration: RC 9291952
Registered office: 5, Stateline Street, Akure, Ondo State, Nigeria
Contact: privacy@bellezaworld.com · +234 703 011 1570
Effective date: 20 May 2026
Version: 1.0
OUR COMMITMENT
BELLEZA.WORLD LIMITED ("Belleza", "we", "us", "our") respects your privacy and is committed to handling your personal information in accordance with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation 2019 (NDPR), and any other applicable data protection laws.
This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, and what rights you have over it. By using the Belleza Detty December platform, you confirm that you have read and understood this Policy.
If you do not agree with how we handle your information as described here, please do not use the Platform.
1.1 This Privacy Policy applies to personal information collected through:
(a) the Belleza Detty December website (including bellezaworld.com);
(b) any related web or mobile applications operated by Belleza;
(c) communications between you and Belleza by SMS, WhatsApp, email, phone, or in-app messaging;
(d) any in-person interactions in connection with fulfilment (Pickup or Delivery).
1.2 This Policy should be read together with our Terms and Conditions, Refund Policy, and Delivery Policy. Capitalised terms used but not defined here have the meanings given in the Terms and Conditions.
1.3 This Policy does not apply to third-party websites, applications, or services that may link to or integrate with the Platform. Their privacy practices are governed by their own policies.
1.4 Application to information collected before the Effective date. This Policy applies to personal information we currently hold about you, including information collected before the Effective date stated at the top of this document. Where information was originally collected under a previous privacy notice (or without a formal published notice), we will, from the Effective date, continue to process, store, and protect that information in accordance with this Policy and the Nigeria Data Protection Act 2023.
1.5 Re-acceptance by existing Members. Members with Accounts existing as at the Effective date will be asked to re-accept this Policy (together with our Terms and Conditions) on their next sign-in. The acceptance will be recorded with timestamp, IP address, and version reference in our consent records. If you do not wish to accept this Policy, you may withdraw your consent and request deletion of your personal information in accordance with Section 9 and Section 10, subject to the legal retention periods set out in Section 8.
1.6 No retroactive reduction of your rights. Nothing in this Section reduces any data protection right that already accrued to you under the NDPR, NDPA, or other Nigerian law in respect of information collected before the Effective date.
2.1 The data controller responsible for your personal information is:
BELLEZA.WORLD LIMITED (RC 9291952)
5, Stateline Street, Akure, Ondo State, Nigeria
Email: privacy@bellezaworld.com
Phone: +234 703 011 1570
2.2 For matters relating to your personal information, including requests to exercise your rights under the NDPA/NDPR, you may contact us at privacy@bellezaworld.com.
When you register, contribute, or otherwise use the Platform, we collect:
(a) Identity and contact data: full name, phone number, email address (optional), state of residence.
(b) Account credentials: password (stored only as a salted, bcrypt-hashed value — we never store or have access to your password in plain text).
(c) Membership and selection data: chosen Package, number of Slots, Cycle year, account status.
(d) Payment data: Contribution amounts, Installment number, Paystack reference codes, payment status, and related transaction metadata. We do not collect, see, or store card numbers, CVV codes, bank account numbers, or any other card or bank credentials — these are handled directly by Paystack.
(e) Delivery data: delivery address, city, state, landmark, contact phone number, and any other information you provide for fulfilment.
(f) User-uploaded content: photographs uploaded for Package Verification.
(g) Communications: the content of messages, queries, or complaints you send to us through any channel.
(h) Consent records: the version of our Terms, Privacy Policy, Refund Policy, and Delivery Policy you accept, the timestamp of acceptance, and the IP address from which acceptance was recorded.
(i) Account standing records: where an Account is placed on hold under Section 7.8 of the Terms, we record the date, the figures the decision was based on (Installments paid, Installments behind, and months without a Contribution), whether it was lifted automatically or by a member of staff, and any reason given. We also record that we notified you.
Account standing notices are service messages, not marketing. Turning off payment reminders in your Account settings does not stop them, because they tell you about a change to your Account rather than promoting anything.
When you use the Platform, we automatically collect:
(a) Device and connection data: IP address, browser type, device type, operating system, and approximate location derived from your IP.
(b) Usage data: pages visited, features used, actions taken, dates and times of access, and similar diagnostic data.
(c) Authentication tokens: session and API tokens used to keep you signed in and authorised.
We may receive limited information about you from:
(a) Paystack — confirmation of successful or failed payments, transaction references, and limited metadata necessary for reconciliation. We never receive your full card or account details.
(b) Termii — delivery status of SMS and WhatsApp notifications we send to you (e.g. delivered, failed, opt-out).
We do not knowingly collect:
(a) card numbers, expiry dates, CVVs, or bank account credentials;
(b) biometric data;
(c) sensitive personal data such as health, religion, or political affiliation, except where you voluntarily provide it (e.g. dietary substitutions noted in a support message).
We use your personal information for the following purposes:
4.1 To provide the Service, including:
(a) creating and managing your Account;
(b) processing Contributions through Paystack;
(c) tracking Installments and Cycle progress;
(d) coordinating Package fulfilment by Pickup or Delivery;
(e) verifying receipt of Packages.
4.2 To communicate with you, including:
(a) sending payment reminders (where you have opted in), Installment confirmations, and fulfilment updates by SMS, WhatsApp, email, or in-app notification;
(b) responding to your support enquiries and complaints;
(c) sending operational announcements (e.g. delivery window opening, scheduling changes).
4.3 To improve and protect the Platform, including:
(a) diagnosing technical issues;
(b) detecting and preventing fraud, abuse, and unauthorised access;
(c) reconciling failed or disputed payments;
(d) producing aggregate, anonymised analytics about Platform usage.
4.4 To meet legal and regulatory obligations, including:
(a) maintaining records required by Nigerian tax, accounting, anti-money-laundering, and consumer protection law;
(b) responding to lawful requests from regulators, courts, or law enforcement;
(c) demonstrating compliance with the NDPA, NDPR, and other applicable law.
4.5 To enforce our Terms and protect the rights, property, and safety of Belleza, our Members, and the public.
Under the NDPA and NDPR, we process your personal information on one or more of the following lawful bases:
5.1 Contract performance — to deliver the Service you signed up for and to fulfil your Package.
5.2 Legitimate interests — for fraud prevention, security, reconciliation, customer support, and the proper administration of our business, where these interests are not overridden by your rights.
5.3 Consent — where you have explicitly opted in (e.g. payment reminders, marketing communications). You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
5.4 Legal obligation — to meet our compliance obligations under Nigerian law (tax records, NDPC reporting, lawful disclosure requests).
5.5 Vital interests — in rare cases, to protect a life (e.g. emergency contact through a delivery address).
We do not sell your personal information. We share it only as described in this section.
We share information with the following providers strictly for the purposes of operating the Platform:
(a) Paystack Payments Limited (Nigeria) — to process payments. Paystack receives your name, phone, email, transaction amount, and reference. Paystack handles your card or bank details directly under its own privacy policy and PCI-DSS compliance.
(b) Termii Limited (Nigeria) — to send SMS and WhatsApp notifications. Termii receives your phone number and the content of the message.
(c) Laravel Cloud (operated by Laravel Holdings, Inc., on Amazon Web Services infrastructure) — to host our backend application and database. Laravel Cloud stores all Account, Contribution, Delivery, and verification data. See Section 7 on cross-border transfer.
(d) Cloudflare R2 (object storage provided through Laravel Cloud) — to store uploaded files including Package Verification photos.
(e) Vercel Inc. (United States) — to host and deliver the frontend of our website and any content delivery network (CDN) caching.
We may disclose your personal information where we are required by law, including to:
(a) regulators including the Nigeria Data Protection Commission (NDPC), the Federal Competition and Consumer Protection Commission (FCCPC), the Federal Inland Revenue Service (FIRS), and the Central Bank of Nigeria;
(b) law enforcement and judicial authorities responding to a lawful request, court order, or subpoena;
(c) professional advisers such as our lawyers, accountants, and auditors under duties of confidentiality.
If Belleza undergoes a merger, acquisition, reorganisation, sale of assets, or insolvency, your personal information may be transferred as part of that transaction. We will notify you of any such transfer and your rights regarding it.
We share information in other ways only where you have given us specific consent to do so.
7.1 Some of our service providers store and process personal information outside Nigeria:
(a) Laravel Cloud — currently hosted in the United States (US East region) on Amazon Web Services infrastructure.
(b) Vercel Inc. — hosted on a global content delivery network, with primary infrastructure in the United States.
(c) Cloudflare R2 — object storage, with global edge locations.
7.2 Where we transfer your personal information outside Nigeria, we ensure that:
(a) the recipient country provides adequate protection, or
(b) we rely on contractual safeguards (such as standard data protection clauses) imposing obligations equivalent to those required under the NDPA and NDPR, or
(c) we have your explicit informed consent to the transfer.
7.3 By using the Platform, you acknowledge and consent to the cross-border transfer of your personal information to the providers listed above for the purposes described in this Policy.
7.4 If you have questions about the safeguards we apply to international transfers, contact us at privacy@bellezaworld.com.
8.1 We retain personal information only for as long as necessary for the purposes for which it was collected, subject to the following minimum retention periods:
(a) Account data — for as long as your Account remains active, and for up to two (2) years after closure (to handle disputes, refunds, and rejoining).
(b) Transaction records — for at least seven (7) years after the relevant Cycle ends, to comply with Nigerian tax and accounting record-keeping obligations.
(c) Delivery data — for at least two (2) years after fulfilment, to handle disputes and statutory consumer protection claims.
(d) Package Verification photos — for at least two (2) years after the relevant Cycle, then archived or deleted.
(e) Consent records — for the lifetime of your Account plus seven (7) years, as evidence of agreement to the version of our Terms and policies you accepted.
(f) Communications and support records — for at least three (3) years from the last contact.
(g) Server logs and diagnostic data — typically for 90 days, longer where needed for security investigation.
8.2 After the applicable retention period, we either securely delete the information or anonymise it so that it can no longer be associated with you.
8.3 We may retain information for longer where required by law, where ongoing legal proceedings require it, or where it has been anonymised.
Under the NDPA and NDPR, you have the following rights in relation to your personal information:
9.1 Right to be informed — to know what personal information we collect, why, and how we use and share it. This Policy fulfils that obligation.
9.2 Right of access — to request a copy of the personal information we hold about you.
9.3 Right to rectification — to ask us to correct inaccurate or incomplete information. You can update most account details directly through the Platform.
9.4 Right to erasure ("right to be forgotten") — to ask us to delete your personal information where there is no compelling reason for us to continue processing it. Note that we may retain certain information where required by law (see Section 8).
9.5 Right to restrict processing — to ask us to limit the way we use your information in specific circumstances.
9.6 Right to data portability — to receive your personal information in a structured, commonly used, machine-readable format, or to have it transmitted to another controller where technically feasible.
9.7 Right to object — to object to processing based on legitimate interests or for direct marketing purposes.
9.8 Right to withdraw consent — where processing is based on consent (e.g. payment reminders), you may withdraw consent at any time, without affecting the lawfulness of prior processing.
9.9 Right not to be subject to automated decision-making — we do not currently make decisions about you that are based solely on automated processing and that produce legal or similarly significant effects.
9.10 Right to lodge a complaint — see Section 13.
10.1 To exercise any right under Section 9, send a request to privacy@bellezaworld.com including:
(a) your full name and registered phone number;
(b) the right you wish to exercise;
(c) details of your request; and
(d) any information needed for us to verify your identity (so we don't accidentally hand your data to someone else).
10.2 We will respond within thirty (30) calendar days of receiving a valid request. If your request is complex or we receive a large number of requests, we may extend this period by up to a further thirty (30) days and will notify you of the extension.
10.3 We may refuse or charge a reasonable fee for requests that are manifestly unfounded, excessive, or repetitive. We will explain our reasons if we do so.
10.4 You will not be discriminated against for exercising your rights.
11.1 We apply reasonable technical and organisational measures to protect your personal information, including:
(a) Transport encryption — all communication with the Platform is encrypted using HTTPS/TLS.
(b) Password hashing — passwords are stored only as salted bcrypt hashes; even Belleza staff cannot see your password.
(c) Token-based authentication — sessions use signed bearer tokens that can be revoked.
(d) Webhook signature verification — incoming Paystack webhooks are cryptographically verified before being trusted.
(e) Access controls — only authorised personnel can access Member data, and access is logged.
(f) No card data on our servers — card and bank details are handled exclusively by Paystack.
(g) Backups — regular database backups, encrypted in transit and at rest.
11.2 Important reminder for you: you are responsible for keeping your login credentials confidential. Use a strong, unique password and notify us immediately at privacy@bellezaworld.com or support@bellezaworld.com if you suspect unauthorised access.
11.3 No system is 100% secure. While we apply industry-standard safeguards, we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours and inform affected Members where required by law.
12.1 We and our service providers use cookies, local storage, and similar technologies to:
(a) keep you signed in;
(b) remember your preferences (e.g. reminder settings);
(c) maintain security (e.g. detecting unusual sign-in activity);
(d) understand and improve how the Platform is used (aggregate, non-identifying analytics).
12.2 You can control cookies through your browser settings. Disabling essential cookies may prevent you from using parts of the Platform (e.g. you may not be able to stay signed in).
12.3 We do not currently use third-party advertising or behavioural-tracking cookies. If this changes, we will update this Policy and seek any required consents.
13.1 If you believe we have not handled your personal information in accordance with the NDPA, NDPR, or this Policy, we encourage you to contact us first at privacy@bellezaworld.com so we can address your concern.
13.2 You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC):
Website: https://ndpc.gov.ng
Email: info@ndpc.gov.ng
13.3 Lodging a complaint with the NDPC does not affect any other remedy available to you under Nigerian law.
14.1 The Platform is intended for use by individuals aged eighteen (18) years and above. We do not knowingly collect personal information from children under 18.
14.2 If you believe a child has provided personal information to us, contact us at privacy@bellezaworld.com and we will take steps to delete the information.
15.1 The Platform may contain links to or integrations with third-party websites and services (e.g. Paystack checkout pages). This Privacy Policy does not apply to those third-party properties, and we are not responsible for their privacy practices.
15.2 We encourage you to review the privacy policies of any third-party service you interact with through the Platform.
16.1 We may update this Privacy Policy from time to time. When we do, we will:
(a) post the revised Policy on the Platform with a new "Effective date";
(b) record the revised version in our consent records;
(c) where the changes are material (e.g. new categories of data or new categories of recipient), notify you through the Platform and via SMS or email, and where required by law, seek fresh consent before further relevant processing.
16.2 Your continued use of the Platform after the Effective date of a revised Policy constitutes acceptance of the revised Policy.
16.3 We maintain previous versions of this Policy and can provide them on request.
For any privacy-related question, request, or complaint:
BELLEZA.WORLD LIMITED
RC 9291952
5, Stateline Street, Akure, Ondo State, Nigeria
Privacy contact: privacy@bellezaworld.com
General support: support@bellezaworld.com
Legal notices: legal@bellezaworld.com
Phone: +234 703 011 1570
Website: https://bellezaworld.com
By using Belleza Detty December, you confirm that you have read and understood this Privacy Policy.
Document version: 1.0
Effective date: 20 May 2026
Last reviewed: 20 May 2026
Related