Privacy policy

NOT JOLLOF is a cloud kitchen in Lekki, Lagos, Nigeria. We decide how your personal data is used, which makes us its “data controller” under the NDPA.

For anything about your data, email [email protected].

• When you order: your name, mobile number, email address and delivery address, plus any landmark or instructions for the rider. If you let us use your phone’s location to find your address, we keep its map position. We also record what you ordered, any coupon code you used, what you paid and how the delivery went. We never see or store your card details, because Paystack handles the payment.
• When you join our launch list: your email address, and whether you also asked for news and offers.
• When you rate an order: your ratings, any problems you tick and your comment.
• When you contact us: what you tell us, and notes our team adds to your record so we can help, for example about a late delivery. If you use the contact form on our website, that's your name, email address and message.
• When we email you: whether each email was delivered, whether it was opened (an estimate, using a tiny image in the email) and which links you clicked.
• When you browse the site: the pages you view, the website, post or ad that brought you here, your type of device, and your approximate location (country and city, worked out from your IP address). We don’t use cookies for this. We count visitors with a code made from your IP address and browser that changes every day, so we can’t recognise you from one day to the next, and we don’t store your IP address with these statistics.

The NDPA asks us to say why we use your data and on what basis. In brief:

• To make and deliver your order and keep you updated on it. We need this to do what you asked us to (contract).
• To email you about your order: a confirmation, and one message after delivery asking how it went (contract and legitimate interests).
• To send news and offers, only if you ticked the box (consent). If you joined the launch list without ticking it, you’ll get one email when we launch and nothing else. Every marketing email has a one-click unsubscribe link.
• To improve what we do (legitimate interests). We look at which dishes, areas and delivery times work best and which posts and ads bring people to us, and we use this to plan stock. We group customers by how recently and how often they order (for example “new” or “regular”) to decide which offers to send. This never changes your prices or whether you can order.
• To keep records and prevent misuse (legal obligation and legitimate interests). This covers tax and accounting records, and stopping abuse of the site such as repeated fake sign-ups.

We don’t sell your personal data. We share only what each partner needs:

• Paystack, to take your payment: your email address, the amount and the order reference.
• Chowdeck, to deliver your order: your name, phone number, delivery address and instructions for the rider.
• Companies that run our services for us, which may use your data only on our instructions: Vercel (website hosting), Neon (database) and Amazon Web Services (sending our emails).
• Cloudflare Turnstile, when you use our contact form: it checks that the form is sent by a person rather than a bot, using technical details from your browser and connection. It doesn't receive your message.
• Advertising and analytics partners, only if you accept cookies. These may include Google (Analytics and Ads), Meta (Facebook and Instagram), TikTok, X and Snapchat.
  • If you accepted cookies before ordering, we also tell Meta and TikTok about your purchase directly from our servers, so they can match it to the ad you saw.
  • We send your email address and phone number scrambled (“hashed”), so these partners don’t receive them in readable form. We also send your IP address, browser details and any ad click codes.
  • As soon as that’s sent, and within three days at most, we delete those advertising details from your order.
• When the law requires it, for example a valid request from a court or regulator.

Our database and website servers are in London, United Kingdom, and our email service runs in Stockholm, Sweden. Advertising partners may process data in the United States and other countries.

When your data leaves Nigeria, we use providers whose terms protect it to the standard the NDPA requires.

• Orders and payments: for as long as tax and accounting law requires, generally six years. After that we remove your name, contact details and address, and keep only anonymous order details (what was ordered, amounts and dates) for our sales history.
• An address you typed at checkout but didn't order to: two days.
• Messages sent through our contact form: two years, unless they become part of your customer record.
• Your customer record (contact details, notes, ratings and the emails we’ve sent you): while you’re a customer, or until you ask us to erase it.
• Launch list and email preferences: until you unsubscribe or ask us to delete them. We keep a record of what you agreed to and when, as proof of your permission.
• Website statistics: the detailed visit records are deleted automatically after about 13 months. We keep only daily totals (for example, how many people visited each page), which can’t identify anyone.
• Advertising details on orders (IP address, browser and ad click codes): deleted once they’re sent to Meta or TikTok, and within three days at most.

Under the NDPA you can:

• ask for a copy of the personal data we hold about you;
• ask us to correct it;
• ask us to delete it;
• object to how we use it, or ask us to limit it;
• ask for your data in a common format, to take it elsewhere;
• withdraw your consent at any time. Use the unsubscribe link in any marketing email, or Cookie settings at the bottom of the page for cookies.

To make a request, email [email protected]. We may ask you to confirm it’s you, for example using the phone number or email address on your orders.

If you ask us to delete your data and an order is still on its way, we deliver it first. We then remove your name, contact details, address, notes and comments. We keep only anonymous order details (what was ordered, amounts and dates) that we need for our accounts.

If you’re unhappy with how we’ve handled your data, tell us so we can put it right. You can also complain to the Nigeria Data Protection Commission at ndpc.gov.ng.

Cookies are small files a website saves in your browser.

Always on, because the site needs them:

• nj_checkout keeps your delivery price attached to your checkout (1 day).
• nj_consent remembers your cookie choice (6 months).
• nj_entered remembers that you went past our launch page, until you close your browser.
• nj_staff keeps our team signed in to the dashboard (12 hours; staff only).
• Your cart and your latest order are also saved in your browser, on your device only.

Only if you accept:

• nj_attr remembers how you first found us for 30 days, so we know which post or ad brought you.
• Cookies from the advertising and analytics partners above, such as Google’s _ga and Meta’s _fbp, which let them measure our ads.

Nothing in the second group loads until you accept. You can change your mind with Cookie settings at the bottom of the page. If you decline, we remove those cookies.

Everything on notjollof.ng travels over an encrypted connection. Only staff who need your details can see them, with access set by their role, and links in our emails are signed so they can’t be altered. We never handle your card details.

NOT JOLLOF isn’t aimed at children under 18, and we don’t knowingly collect their data. If you think a child has given us their details, email [email protected] and we’ll delete them.

If anything changes, we’ll update this page and the date at the top. If it’s a significant change, we’ll also let you know by email or on the site.