Privacy Policy

DrinksHarbour Technologies Ltd (“DrinksHarbour”, “we”, “us”, “our”) operates the online beverage marketplace at drinksharbour.com and the branded storefronts and business tools hosted on our platform. This Privacy Policy explains how we collect, use, share, and protect personal data when you use our website, mobile experiences, and services (together, the “Services”).

DrinksHarbour is a multi-tenant platform. The central marketplace lists a single catalogue of beverages, but orders are routed to and fulfilled by independent partner businesses (“Merchants” or “Tenants”) that operate their own branded stores on our platform. This affects who controls your data:

• When you browse the main marketplace, create a DrinksHarbour account, or place an order, DrinksHarbour is the data controller.
• When a Merchant fulfils your order or you interact with a Merchant’s own branded storefront, that Merchant acts as an independent data controller for the data it collects and uses through its own store and business tools, and its own privacy notice may also apply.
• We share only the personal data a Merchant needs to fulfil and support your order (see “How We Share Your Information”).

To make this Policy clear, the following terms have specific meanings:

• Personal Data — any information relating to an identified or identifiable person (e.g. name, email, phone, delivery address, device identifiers).
• Processing — any operation performed on personal data, such as collecting, storing, using, sharing, or deleting it.
• Controller — the party that decides why and how personal data is processed.
• Processor / Sub-processor — a third party that processes personal data on a controller’s behalf under contract (e.g. our payment, hosting, and email providers).
• Merchant / Tenant — an independent partner business that subscribes to DrinksHarbour, operates a branded storefront, and fulfils marketplace orders.
• NDPA / NDPR — the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Regulation 2019, the primary laws governing this Policy, overseen by the Nigeria Data Protection Commission (“NDPC”).

We collect information you provide directly, information collected automatically as you use the Services, and information we receive from trusted third parties.

Information you provide to us

• Identity & contact details — name, email address, phone number, and one or more delivery addresses when you register or checkout
• Account credentials — a securely hashed password, and (if enabled) multi-factor authentication settings
• Payment information — processed securely by our payment partners; we receive confirmation and limited transaction metadata but never store your raw card number or CVV
• Order & preference data — cart contents, order history, wishlists, saved searches, and communication preferences
• Loyalty data — your Corks & Points balance, tier, referrals, and reward activity
• Content you submit — product reviews, ratings, messages and attachments sent via our contact form, WhatsApp, or live support
• Merchant onboarding data — for businesses applying to sell: business name, registration/CAC number, contact person, address, and payout bank details
• Age-verification confirmation — because we sell alcohol, confirmation that you are 18 years or older

Information collected automatically

• Device & connection data — IP address, browser type, operating system, and device identifiers
• Usage data — pages visited, time on site, referring URLs, search queries, and click-through activity
• Cookies & local storage — as described in the Cookies & Tracking section
• Approximate location — city or state level, inferred from your IP address (we do not collect precise GPS location without your permission)

Information from third parties

• Authentication data when you choose to sign in with Google
• Payment confirmation and fraud/risk signals from Korapay and Paystack
• Delivery status updates from our logistics and courier partners
• Limited data from Merchants where you have transacted with their storefront

We use the information we collect to operate, secure, and improve the Services, specifically to:

• Process and fulfil your orders, including routing them to the relevant Merchant and arranging delivery
• Manage your account, authenticate logins, and enable multi-factor authentication
• Send transactional messages — order confirmations, delivery updates, receipts, and support replies — by email and SMS
• Operate the Corks & Points loyalty programme, referrals, and reward redemptions
• Verify age (18+) and prevent underage sale of alcohol
• Detect, investigate, and prevent fraud, abuse, and unauthorised account access
• Personalise your experience — recommendations, saved searches, and relevant catalogue results (see AI & Automated Processing)
• Send marketing and offers where you have opted in — you can unsubscribe at any time
• Analyse usage to improve performance, design, search relevance, and the product catalogue
• Comply with Nigerian law, including NDPA/NDPR, tax, and accounting obligations
• Resolve disputes, enforce our Terms of Service, and protect the rights and safety of users, Merchants, and DrinksHarbour

Under the NDPA and NDPR, we only process your personal data where we have a lawful basis. Depending on the activity, we rely on one or more of the following:

Where processing is based on consent, withdrawing it will not affect the lawfulness of processing carried out before withdrawal. To withdraw consent or object to processing based on legitimate interests, contact privacy@drinksharbour.com.

DrinksHarbour uses artificial-intelligence and machine-learning features to improve discovery and quality. We are transparent about how these process your data:

• Semantic search & recommendations — we generate vector embeddings from product data and, where relevant, your search and browsing signals to return more relevant results and suggestions
• Review sentiment analysis — automated models help summarise and moderate product reviews
• Image auto-tagging — uploaded product images are automatically tagged to improve catalogue quality
• Demand forecasting — aggregated, non-identifying sales data helps Merchants plan inventory

We share personal data only as necessary to deliver the Services and as described below:

• Merchants (Tenants) — your name, delivery address, contact number, and order details are shared with the Merchant fulfilling your order so they can prepare and dispatch it.
• Logistics & courier partners — name, phone, and delivery address are shared to complete delivery and provide tracking.
• Payment processors — Korapay (marketplace checkout, in Naira) and Paystack (subscription and recurring billing) receive the data needed to process payments securely.
• Infrastructure & service providers — cloud hosting, database, media (Cloudinary), and email/SMS providers that operate the platform on our behalf under contract.
• Analytics providers — anonymised or aggregated data to help us understand and improve usage.
• Professional & legal — auditors, advisers, or authorities where required by Nigerian law, court order, or to protect our legal rights and user safety.
• Business transfers — if DrinksHarbour is involved in a merger, acquisition, or asset sale, data may transfer under equivalent protections and with notice to you.

We rely on a small number of vetted service providers to run the platform. Key categories and providers include:

This list may change as our providers evolve. A current list is available on request at privacy@drinksharbour.com.

Some of our service providers store or process data outside Nigeria. Where we transfer personal data internationally, we take steps required by the NDPA/NDPR to ensure an adequate level of protection, which may include:

• Transferring only to countries or providers that offer adequate data-protection safeguards
• Putting contractual data-protection clauses in place with the recipient
• Relying on your explicit consent where appropriate for a specific transfer
• Minimising the data transferred to what is strictly necessary

You can ask us for more detail about the safeguards applied to a specific transfer by contacting our Data Protection Officer.

We use cookies and similar technologies to keep the Services working and to improve them. The main categories are:

You can control cookies through your browser settings and manage non-essential cookies via your account preferences. Disabling essential cookies will affect core functionality such as login and checkout. Marketing cookies are set only with your consent and can be withdrawn at any time.

We apply industry-standard technical and organisational measures to protect your data, including:

• All data in transit is encrypted with TLS 1.2 or higher (HTTPS)
• Passwords are hashed with bcrypt — we never store plain-text passwords
• Payment card data is tokenised by Korapay and Paystack and never touches our servers
• Tenant isolation — each Merchant’s data is scoped and access-controlled so businesses cannot see one another’s customer or operational data
• Access to production systems is restricted to authorised personnel and protected by multi-factor authentication
• Privileged actions are recorded in tamper-evident audit logs
• Regular security reviews, dependency vulnerability scanning, and encrypted, off-site backups

We maintain procedures to detect, contain, and investigate personal-data breaches. In the event of a breach likely to result in a risk to your rights and freedoms, we will:

• Notify the Nigeria Data Protection Commission (NDPC) without undue delay and, where feasible, within 72 hours of becoming aware of it
• Inform affected users promptly where the breach is likely to result in a high risk to them
• Describe the nature of the breach, likely consequences, and the steps we are taking to address it
• Document all breaches and our response for accountability

We keep personal data only for as long as necessary for the purposes it was collected, then delete or anonymise it:

Under the NDPA and NDPR, and subject to certain conditions, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — request deletion of your data, subject to our legal obligations
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing for direct marketing at any time, and to other processing based on legitimate interests
• Restriction — ask us to restrict processing while a dispute is resolved
• Withdraw consent — where processing relies on consent, withdraw it at any time
• Lodge a complaint — complain to the Nigeria Data Protection Commission (NDPC) if you believe your rights have been infringed

To exercise any of these rights, email privacy@drinksharbour.com. We will respond within 30 days and may need to verify your identity before acting on your request. Requests routed to a Merchant’s own storefront data may be forwarded to that Merchant as the relevant controller.

DrinksHarbour sells alcoholic beverages. Our Services are strictly for users aged 18 years and older. We apply an age-verification gate on alcohol purchases and may request proof of age at checkout or on delivery.

We do not knowingly collect personal data from anyone under 18. If we learn that a minor has provided us with personal data, we will delete it promptly. If you believe a minor has submitted data to us, contact privacy@drinksharbour.com.

We may send you marketing only where you have opted in or where permitted by law. You are always in control:

• Unsubscribe from marketing emails using the link in any message
• Adjust notification and marketing preferences in your account settings
• Opt out of personalised offers while continuing to receive essential service messages

Transactional messages (order confirmations, delivery updates, security and account notices) are part of the Services and are not marketing — you will continue to receive these while you hold an account.

Because DrinksHarbour is a multi-tenant platform, some data is handled by the independent Merchant you buy from rather than by us:

• When a Merchant fulfils your order, it acts as an independent controller of the order data we pass to it and is responsible for its own lawful handling of that data
• A Merchant’s own branded storefront or in-store systems may collect additional data under its own privacy notice
• We provide Merchants with business tools (inventory, invoicing, POS, CRM) and process the related data as their service provider under contract
• We keep Merchants’ customer and operational data isolated from one another

If you are unsure who controls specific data, contact us and we will help identify the right controller.

Our Services may contain links to third-party websites — including Merchant social pages, payment processors, and blog references. These sites have their own privacy policies, and we are not responsible for their content or practices.

We encourage you to review the privacy policy of any third-party site you visit via a link on DrinksHarbour.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by:

• Posting a prominent notice on our website
• Emailing your registered address at least 14 days before the changes take effect
• Updating the “Last updated” date at the top of this page

Continued use of DrinksHarbour after the effective date of any change constitutes acceptance of the updated Policy. Where a change requires it, we will ask for your fresh consent.

For privacy enquiries, data-access requests, or to report a concern, contact our Data Protection Officer:

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe we have not handled your data lawfully. We aim to respond to all privacy requests within 30 days.