Privacy Policy

We use the information we collect to operate and improve our services, specifically to:

• Process and fulfil your orders, including notifying vendors and arranging delivery
• Send order confirmations, delivery updates, and support replies via email and SMS
• Verify your identity and prevent fraud or unauthorised account access
• Personalise your shopping experience — product recommendations, saved searches, and wishlists
• Send promotional emails and offers where you have opted in (you may unsubscribe at any time)
• Analyse usage patterns to improve site performance, design, and product catalogues
• Comply with legal obligations under Nigerian law, including NDPR requirements
• Resolve disputes and enforce our Terms of Service

We do not sell your personal data to third parties for their own marketing purposes.

We share your information only as necessary to deliver our services:

• Vendors — your name, delivery address, and order details are shared with the relevant vendor to fulfil your order
• Logistics partners — name, phone, and delivery address are shared with our courier partners
• Payment processors — Paystack and Stripe receive transaction data to process payments securely
• Cloud & infrastructure providers — we use AWS and Cloudinary to store data and images
• Analytics services — anonymised, aggregated data may be shared with analytics tools
• Law enforcement — we may disclose information when required by Nigerian law or court order

We use cookies and similar technologies to provide a better experience. Types of cookies we use:

You can control cookies through your browser settings. Disabling essential cookies will affect site functionality. Marketing cookies can be opted out of at any time via your account preferences.

We implement industry-standard technical and organisational measures to protect your data:

• All data in transit is encrypted using TLS 1.2 or higher (HTTPS)
• Passwords are hashed using bcrypt — we never store plain-text passwords
• Payment card data is tokenised by Paystack and Stripe and never touches our servers
• Access to production databases is restricted to authorised personnel with multi-factor authentication
• Regular security audits and dependency vulnerability scans
• Automated backups with encrypted off-site storage

Under the Nigeria Data Protection Regulation (NDPR) and applicable law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate or incomplete data
• Deletion — request deletion of your personal data, subject to legal obligations
• Portability — receive your data in a machine-readable format
• Objection — object to processing of your data for direct marketing at any time
• Restriction — request that we restrict processing while a dispute is resolved
• Withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, email us at privacy@drinksharbour.com. We will respond within 30 days. We may need to verify your identity before processing your request.

• Account data is retained for as long as your account is active
• Order records are kept for 7 years to comply with Nigerian tax and accounting laws
• Support messages and contact form submissions are retained for 2 years
• Marketing preference data is retained until you unsubscribe or delete your account
• Analytics data is anonymised after 90 days
• Deleted accounts: personal identifiers are purged within 30 days; anonymised transaction records may be retained for legal compliance

Our website may contain links to third-party websites — including vendor social media pages, payment processors, and blog references. These sites have their own privacy policies and we have no responsibility for their content or practices.

We encourage you to review the privacy policy of any third-party site you visit via a link on DrinksHarbour.

DrinksHarbour sells alcoholic beverages and our services are strictly for users aged 18 years and older. We do not knowingly collect personal data from anyone under 18.

If we become aware that a minor has provided us with personal data, we will delete it immediately. If you believe a minor has submitted data to us, please contact us at privacy@drinksharbour.com.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by:

• Posting a prominent notice on our website
• Sending an email to your registered address at least 14 days before the changes take effect
• Updating the "Last updated" date at the top of this page

Continued use of DrinksHarbour after the effective date of any changes constitutes acceptance of the updated policy.

For privacy-related enquiries, data access requests, or to report a concern, please contact our Data Protection Officer:

We aim to respond to all privacy-related requests within 30 days.