Privacy Policy

Last updated: 25 July 2026

1. Who we are

M&A Rack Limited ("we", "us", "our") is a gift hamper, trunk box and bespoke packaging company registered in Nigeria and based at 44 Shipeolu Street, Shomolu, Lagos. We are the data controller for the personal information described in this policy.

This policy explains what we collect when you use www.ma-racklimited.com, place an order, or contact us — and what we do with it. It is written to meet our obligations under the Nigeria Data Protection Act 2023 (NDPA).

2. What we collect

When you place an order: your full name, phone number, email address, delivery address and city, and anything you write in the order notes box (for example a gift message or recipient name).

When you pay by card: nothing sensitive. Card payments are processed by Paystack, a licensed Nigerian payment processor. Your card number, CVV and PIN are entered directly into Paystack's secure form and are never seen by, sent to, or stored on our website. We only receive a payment reference, the amount, the payment method used, and the email address you gave at checkout.

When you order by WhatsApp: your WhatsApp phone number and the contents of your messages. WhatsApp is operated by Meta and is subject to its own privacy policy.

When you use the site: your shopping cart is stored temporarily in your own browser and is cleared when you close the tab. It never reaches our server until you check out. We do not use advertising cookies or third-party tracking pixels.

Our web host records standard server logs (IP address, browser type, pages requested) for security and troubleshooting.

3. Why we use it, and our lawful basis

• To fulfil your order — packaging, delivery, and keeping you updated. Lawful basis: performance of a contract with you.
• To take and confirm payment — including verifying with Paystack that a payment succeeded and matched your order total. Lawful basis: performance of a contract.
• To answer your enquiries — by email, phone or WhatsApp. Lawful basis: your consent, or our legitimate interest in responding to you.
• To keep business records — order and payment records for accounting and tax. Lawful basis: legal obligation.
• To protect against fraud — checking that the amount paid matches the order placed. Lawful basis: our legitimate interest in preventing fraud.

We do not sell your personal information, and we do not use it for automated decision-making or profiling.

4. Who we share it with

• Paystack — to process and verify card, transfer and USSD payments.
• Delivery partners and dispatch riders — your name, phone number and delivery address, so your order can reach you.
• Our web host — which stores the site and its order logs on our behalf.
• Professional advisers and regulators — where we are legally required to disclose information.

We do not share your details with anyone else for marketing purposes.

5. How long we keep it

Order and payment records are kept for six years, to meet Nigerian tax and accounting requirements. Enquiry messages that don't lead to an order are kept for up to twelve months. Server logs are kept for a short rolling period by our host.

6. Your rights

Under the NDPA you have the right to:

• ask what personal information we hold about you, and get a copy of it;
• have inaccurate information corrected;
• ask us to delete information we no longer need;
• object to, or ask us to restrict, certain uses of your information;
• withdraw consent at any time, where we relied on consent;
• receive your information in a portable format.

To exercise any of these, email sales@ma-racklimited.com. We will respond within 30 days. Note that we may need to keep certain order records even after a deletion request, where the law requires it.

If you are unhappy with how we've handled your information, you can complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

7. Security

Our site is served over HTTPS. Payment credentials are handled entirely by Paystack and never touch our systems. Access to order records is limited to staff who need it to fulfil orders.

No system is perfectly secure. If a breach ever affects your personal information in a way likely to cause you harm, we will notify you and the NDPC as required by law.

8. Children

Our site is not directed at children, and we do not knowingly collect personal information from anyone under 18. Some of our hampers contain alcohol and may only be purchased by adults aged 18 or over.

9. Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. Material changes will be announced on this page.