Privacy & cookies.

Who we are

GIFLEX is an online store based in Accra, Ghana. We are the data controller responsible for the personal data described in this policy. For any privacy question or to exercise your rights, contact us at privacy@giflex.shop or via our Contact page.

Information we collect

We collect only what we need to run the store and fulfil your orders:

• Account details — your name, email address, phone number, and password (stored only as a secure hash).
• Order & delivery details — the recipient name, phone number, and shipping address you provide at checkout, plus any order notes.
• Transaction details — what you bought and the amount, in Ghana cedi.
• Usage data — pages viewed, scroll depth, session activity, device/browser information, and (with your consent) session-replay and heatmap data via Microsoft Clarity.

We do notreceive or store your card or mobile-money details — payments are handled entirely on our payment provider's secure pages (see “Payments” below).

How we use your data

• To process, deliver, and support your orders, and to contact you about them.
• To manage your account and keep you signed in.
• To improve the store — understanding which products and pages are popular and where the experience can be better.
• For security and fraud prevention, and to meet our legal obligations.

Our lawful bases are: performing our contract with you (orders and accounts), your consent (analytics, session replay, and marketing), and our legitimate interests and legal obligations (security, fraud prevention, record-keeping).

Cookies & tracking technologies

Cookies and similar technologies (local and session storage) keep the store working and, with your consent, help us understand how it is used. Necessary cookies are always active; analytics only run after you opt in. You can change your choice at any time:

Analytics & session replay (Microsoft Clarity)

With your consent, we use Microsoft Clarityto see how visitors use our website through heatmaps and session replay, alongside our own first-party page analytics. In Microsoft's words:

“We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.”

To protect you, sensitive fields — passwords, contact details, shipping addresses, and order information — are masked so they are never captured in recordings. Clarity does not load and sets no cookies unless you grant analytics consent, and you can withdraw it at any time. Learn more in the Microsoft Clarity privacy notice.

Payments

Payments are processed by Paystackon their own secure, hosted pages. Your card or mobile-money details are entered on Paystack and never pass through or get stored on our systems. Their handling of your data is governed by Paystack's privacy policy.

Who we share data with

We share personal data only with service providers who help us run the store, under appropriate safeguards: our payment provider (Paystack), delivery partners (to fulfil your order), Microsoft (Clarity analytics, with your consent), and our hosting and infrastructure providers. We do not sell your personal data.

Your rights & choices

Under the Ghana Data Protection Act, 2012 (Act 843) and, where applicable, the GDPR, you may request access to your data, correction or deletion, restriction or objection to processing, and a copy of your data. Where we rely on consent, you can withdraw it at any time — this is as easy as giving it:

If you have an account, you can exercise two of these rights yourself from your account settings: download a copy of your data, or delete your account. Deleting your account starts a 30-day grace period, during which you can sign back in to cancel.

To exercise any right, email privacy@giflex.shop. You also have the right to lodge a complaint with the Ghana Data Protection Commission.

Data retention

We keep personal data only as long as needed for the purposes above — order and account records for as long as your account is active and as required for tax, accounting, and legal obligations, and analytics data for a limited period after collection. When data is no longer needed, we delete or anonymise it.

When you delete your account, your profile and personal details — name, contact information, and saved addresses — are permanently erased after the 30-day grace period. Your past orders are retained in anonymised form: we must keep transaction records for the tax and accounting periods the law requires, but they are no longer linked to a personal profile, and the personal details attached to those historical orders are purged once their retention period elapses.

Security

We protect your data with encryption in transit, hashed passwords, restrictive access controls, and a JSON-only API. No method of transmission or storage is perfectly secure, but we work to safeguard your information and respond promptly to any incident.

Children

Our store is not directed to children under 18, and we do not knowingly collect their personal data. If you believe a child has provided us data, please contact us and we will remove it.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above, and — where required — we will ask for your consent again.

Contact us

Questions about this policy or your data? Email privacy@giflex.shop or use our Contact page.