Privacy policy

Ancestra Apothecary (“Ancestra”, “we”, “us”) respects your privacy. This policy explains what personal information we collect through ancestraapothecary.com, why we collect it, and the choices and rights you have. We process personal data in line with the Nigeria Data Protection Act 2023 and, for visitors in the European Union and United Kingdom, the GDPR.

Who is responsible for your data

Ancestra Apothecary is the data controller. You can reach us about anything in this policy at hello@ancestraapothecary.com.

What we collect

We only collect what you choose to send us through the forms on this site:

• Messages: your name, email address and message.
• Consultation requests: your name, email address, the area of health you would like help with, and optionally your phone number, a preferred date and further details. Information about your health is sensitive, and we only use it to prepare for and provide your consultation.
• Order requests: your name, email address, shipping address and the products you selected.
• Donation pledges: your name, email address, the amount and currency you indicate (if any), and an optional note.

When you use the site, our hosting provider also processes technical information such as your IP address and browser type to deliver pages, keep the service secure and prevent abuse. We use your IP address briefly to limit repeated form submissions; these counters expire automatically within minutes.

How and why we use it

• To reply to your message, arrange your consultation, confirm and fulfil your order, or follow up on your donation pledge.
• To send you a confirmation email when you submit a form, and to continue the conversation by email.
• To keep accurate records and meet our legal and accounting obligations.
• To protect the site, our customers and ourselves from fraud and misuse.

We rely on your consent (including your explicit consent for health information), on the steps needed to respond to your request or perform our agreement with you, on our legal obligations, and on our legitimate interest in operating a secure service. We do not sell your personal information, use it for advertising, or make automated decisions about you.

Who we share it with

We share personal information only with service providers who help us run the apothecary, under contract and only for that purpose:

• Cloudflare — website hosting, database storage and security (provided through our hosting platform, Built201).
• Tevenor — sending and receiving our emails.
• Couriers or payment providers, where needed to deliver an order or complete a donation you have asked us to process.

These providers may process data outside Nigeria. Where they do, we rely on appropriate safeguards required by law. We may also disclose information if required by law or to protect our rights.

Cookies

The public shop sets no cookies and uses no analytics or advertising trackers. Your cart is kept only in your browser tab. Our private admin area uses strictly necessary cookies to keep staff signed in securely.

How long we keep it

We keep form submissions for as long as we need them to help you and for up to 24 months after our last contact, unless the law requires us to keep records (such as order and accounting records) for longer. You can ask us to delete your information sooner.

Your rights

You have the right to access the personal information we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive a copy in a portable format, and to withdraw your consent at any time (this does not affect anything we did before you withdrew it). To exercise any of these rights, email hello@ancestraapothecary.com. We will respond within 30 days.

If you are unhappy with how we have handled your information, you can complain to the Nigeria Data Protection Commission or, if you are in the EU or UK, your local data protection authority. We would appreciate the chance to put things right first.

Security

Your information is encrypted in transit, stored with reputable providers, and accessible only to our team through accounts protected by strong passwords and two-step sign-in. No system is perfectly secure, but we work hard to protect what you entrust to us.

Children

This site is not intended for children under 18. Consultations for a child must be requested by a parent or guardian.

Changes to this policy

We will update this page if our practices change and revise the effective date above. Significant changes will be highlighted on the site.