Last Reviewed: 1 March 2025

Version: 1.0

1. Purpose

This Data Retention Policy outlines Dang Lifestyle’s approach to collecting, storing, retaining, and disposing of personal data in compliance with the Nigeria Data Protection Regulation (NDPR) 2019. This ensures that personal data is retained only for as long as necessary and disposed of securely.

2. Scope

This policy applies to all employees, contractors, third-party service providers, and business partners who collect, process, or store personal data on behalf of Dang Lifestyle.

3. Principles of Data Retention

Dang Lifestyle follows these key principles in data retention:

•Lawfulness & Transparency – Data is processed and retained in line with legal and regulatory requirements.

•Purpose Limitation – Personal data is retained only for the purpose it was collected.

•Storage Limitation – Data is kept only for as long as necessary.

•Security & Confidentiality – Personal data is protected from unauthorized access, alteration, or destruction.

• Lawful purposes

a. All data processed by Dang Lifestyle Limited must be done on one of the following lawful bases: consent, contract, legal obligation, vital interests, public task or legitimate interests.

b. Where consent is relied upon as a lawful basis for processing data, evidence of opt-in consent shall be kept with the personal data.

c. Where communications are sent to individuals based on their consent, the option for the individual to revoke their consent should be clearly available and systems should be in place to ensure such revocation is reflected accurately in Dang Lifestyle Limited systems.

• Data minimisation

Dang Lifestyle Limited shall ensure that personal data are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

• Accuracy

Dang Lifestyle Limited shall take reasonable steps to ensure personal data is accurate.

Where necessary for the lawful basis on which data is processed, steps shall be put in place to ensure that personal data is kept up to date.

4. Data Retention Periods

Dang Lifestyle retains different categories of personal data based on legal, business, and operational needs:

Data Category	Retention Period	Reason for Retention
Employee Records	5 years post-employment	Compliance with labor laws & future reference
Customer Purchase Data	7 years	Business operations & fraud prevention
Marketing & Promotional Data	7 years (unless opted out)	Customer engagement & marketing analytics
Financial & Transactional Data	12 years	Regulatory & tax compliance
CCTV Footage	120 – 365 days	Security & incident investigation
Vendor & Supplier Contracts	6 years post-contract	Legal obligations & audit requirements
Website & Digital Platform Logs	48 months	Cybersecurity & compliance monitoring
Customer Complaints & Inquiries	5 years	Dispute resolution & service improvement

How and why we use personal data?

Your personal data is used to support a range of different activities. These are listed in the table below together with the types of data used and legal bases that we rely on when processing them, including where appropriate, our legitimate interests. Please be aware that we may process your personal data using more than one lawful basis, depending on the specific activity involved. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below:

Purpose/Activity	Type of Data	Lawful basis for processing
To create an account and register you as a new customer (either directly or via social media).	Identity Contact	Performance of a contract with you
To process and deliver your order including: recording your order details; process payments and refunds, collect money owed to us;	Identity Contact	Performance of a contract with you
and assist fraud prevention and detection.	Financial Transaction	Necessary for our legitimate interests (e.g. to recover debts due to us)
To manage our relationship with you, including: providing you with any information, products and services that you request from us; notifying you about changes to our services, terms and conditions or privacy notice.	Identity Contact Profile Marketing and Communications	Performance of a contract with you Necessary for our legitimate interests (to keep our records updated)
To enable you to take part in a competition, event, survey, or receive a reward for shopping with us.	Identity Contact Profile Usage Marketing and Communications	Necessary for our legitimate interests (to study how customers use our products and services, to develop them and grow our business) Where you have decided to enter into a competition or event, for the performance of a contract with you
To administer, protect and improve our business and our website/app, including: troubleshooting, data analysis, testing, system maintenance, support, data analysis, reporting and hosting of data; setting default options for you, such as language and currency.	Identity Contact, Profile Usage, Marketing and Communications	Necessary for our legitimate interests (to study how customers use our products and services, to develop them and grow our business) Where you have decided to enter into a competition or event, for the performance of a contract with you
To deliver relevant website content, online advertisements and information for you; and measure the effectiveness of the advertising provided.	Identity Contact Profile Technical Transaction Marketing and Communications	Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, and to detect and prevent fraud) Necessary to comply with a legal obligation
To use data analytics to: improve our website, products, services, marketing, customer relationships and experiences; and for market research, statistical and survey purposes.	Technical Usage	Necessary for our legitimate interests (to study how customers use our products and services, to develop them, to grow our business and to inform our marketing strategy)
To recommend products, services discounts and offers that may be of interest to you, including to send you such information by email.	Identity Contact Technical Usage Profile Marketing and Communications	Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)
To inform or remind you by email of any task carried out via our website which remains uncompleted, such as incomplete orders or abandoned baskets.	Identity Contact Usage	Necessary for our legitimate interests (to improve the shopping experience of our customers)

5. Data Disposal & Deletion

At the end of the retention period, personal data will be securely disposed of using one or more of the following methods:

• Electronic Data: Permanent deletion from servers, backup systems, and cloud storage.

•Paper Records: Shredding or secure disposal via authorized data destruction services.

•Archived Data: If data must be retained beyond the retention period for legal reasons, access will be restricted to authorized personnel only.

6. Data Subject Rights

Individuals have the right to:

• Request deletion of their personal data if retention is no longer justified.

• Access information on how long their data will be retained.

• Object to unnecessary data retention, as per NDPR guidelines.

7. Exceptions & Legal Hold

In certain cases, data may be retained beyond the standard retention period if:

• Required by law enforcement or regulatory authorities.

• Subject to ongoing legal proceedings.

• Necessary for business continuity in exceptional circumstances.

8. Third-Party Services

In general, the third-party providers used by us will only collect, use and disclose your information to the extent necessary to allow them to perform the services they provide to us.

However, certain third-party service providers, such as payment gateways and other payment transaction processors, have their own privacy policies in respect to the information we are required to provide to them for your purchase-related transactions.

For these providers, we recommend that you read their privacy policies so you can understand the manner in which your personal information will be handled by these providers.

Once you leave our store’s website or are redirected to a third-party website or application, you are no longer governed by this Privacy Policy or our website’s Terms of Service.

9. Responsibilities

•Data Protection Officer (DPO): Ensures compliance with NDPR and oversees data retention practices.

•HR & Legal Teams: Manage employee and contract-related data retention.

•IT Department: Ensures secure storage, deletion, and backup of electronic records.

•All Employees: Adhere to this policy in handling and storing personal data.

•Breach: In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, Dang Lifestyle Limited shall promptly assess the risk to people’s rights and freedoms and if appropriate report this breach to the National Information Technology Development Agency (NITDA) via dp*@*******ov.ng

10. Review & Updates

This policy will be reviewed annually or updated as required by changes in NDPR regulations.

Any amendments will be communicated to all relevant stakeholders.

11. Contact Information

For questions regarding this policy, please contact:

jo**@***********le.co

08020728741