Loading…
Last Updated: September 2026
Your privacy matters to us
This Privacy Policy explains how Tare Wellness Enterprise Ltd collects, uses, and protects your personal data in accordance with the Nigeria Data Protection Act (NDPA) 2023.
Privacy at a Glance
NDPA 2023 Compliant
Secure Payments
Responsible Communication
Confidential Wellness Info
Transparent Practices
PRIVACY POLICY
Summary
Tare Wellness Enterprise Ltd (“Tare Wellness,” “we,” “us,” or “our”) is the data controller responsible for your personal data under the Nigeria Data Protection Act (NDPA) 2023. This Privacy Policy describes how we collect, use, share, and protect your personal data when you use our website and services.
By using Tare Wellness, you consent to the practices described in this policy. If you do not agree with these practices, please do not use our services.
Data Controller
Tare Wellness Enterprise Ltd
Privacy Team: privacy@tarewellness.com
General inquiries: hello@tarewellness.com
Response time: Within 30 days for data subject requests (per NDPA Section 34)
Information We Collect
We only collect personal data necessary for providing our service. For each category, we cite the lawful basis as required by NDPA Section 27.
Personal Identity
Name, email address, and hashed password collected when you create an account. Used for authentication and account management.
Lawful basis: Contract performance (NDPA Section 27(1)(b)) — necessary to provide the service you requested.
Gift Card Details
Recipient names, emails, personal notes, and occasion markers when you purchase a gift card. Used to deliver the gift and personalize the recipient's experience.
Lawful basis: Contract performance — necessary to fulfill your gift card order.
Booking Data
Session type, date, time, therapist name, and redemption code (if applicable). Used to schedule and confirm wellness sessions.
Lawful basis: Contract performance — necessary to provide the booking service.
Payment Information
Buyer name, email, and Paystack transaction reference. We do NOT store full card numbers, CVVs, or bank details — those are handled by Paystack.
Lawful basis: Contract performance — necessary to process your payment.
Usage Analytics
Aggregated, anonymized data about how you use our site (pages visited, time on site, etc.). We do not link this data to your identity.
Lawful basis: Legitimate interest (NDPA Section 27(1)(f)) — to improve our service. You can opt out via your browser's Do Not Track setting.
How We Use Your Information
Service Delivery
Processing gift card orders, delivering digital gift cards via email, and ensuring your provider has the necessary context to help.
Appointments
Managing calendars, sending session reminders, and coordinating between users and wellness professionals.
Secure Payments
Payments processed by Paystack (PCI-DSS compliant). We never store full credit card numbers, CVVs, or bank account details on our servers.
Service Improvement
Aggregated, anonymous data helps us understand how the platform is used so we can improve our digital sanctuary.
Communications
Sending welcome emails, gift card delivery emails, booking confirmations, and occasional service updates. You can opt out of marketing emails anytime.
Data Security
TLS EncryptionAll data in transit
Encrypted StorageAt-rest encryption
Password Hashingbcrypt (12 rounds)
Audit LoggingAdmin access tracked
In the event of a personal data breach, we will notify the Nigeria Data Protection Commission (NDPC) and affected data subjects within 72 hours of becoming aware of the breach, as required by NDPA Section 17.
Data Retention
We retain personal data only as long as necessary for the purposes described in this policy, or as required by Nigerian law (e.g., financial record retention under the Companies and Allied Matters Act 2020).
| Data Type | Retention Period |
|---|---|
| User accounts | Indefinite until you request deletion |
| Order records | 7 years |
| Booking records | 7 years |
| Redemption codes | Until redeemed + 7 years |
| Email delivery logs | 30 days |
| Session cookies | 30 days (sliding) |
| Server logs (Vercel) | 30 days |
| Consent records | 1 year |
When retention periods expire, we securely delete or anonymize the data. You can request early deletion of your data subject to legal retention requirements — see Your Rights below.
Your Data Protection Rights (NDPA 2023)
Under the Nigeria Data Protection Act 2023, you have the following rights regarding your personal data. To exercise any of these rights, use the buttons in your account settings or email privacy@tarewellness.com.
You can request a copy of all personal data we hold about you. We will provide this in a portable, machine-readable format (JSON) within 30 days. Use the "Download My Data" button in your account settings, or email privacy@tarewellness.com.
Questions about your privacy?
Contact our privacy team — we respond within 30 days, usually much faster.
To lodge a complaint with the Nigeria Data Protection Commission: complaint@ndpc.gov.ng · https://ndpc.gov.ng