Privacy notice
Last updated: 15 October 2026 · Version 1.0
This notice explains how Hoba Official uses your personal information when you visit our website, chat with us on WhatsApp, order or pay. We've kept it as short and plain as we can. If anything is unclear, ask us using the contact details below.
1. Who we are
Hoba Official is run by Hoba Official Store, of 3 Elshadai Road, Alagbaka, Akure, Ondo State; and 29 Ogundola Street, Bariga, Lagos. We decide how and why your information is used, so we are the "data controller" under the Nigeria Data Protection Act 2023.
Contact us about privacy:
- WhatsApp: +2349061987599
- Email: hobaofficialstore@gmail.com
- Post: 3 Elshadai Road, Alagbaka, Akure, Ondo State; and 29 Ogundola Street, Bariga, Lagos
- Person responsible for privacy: Hoba Official Store privacy contact (via the WhatsApp number above)
We aim to reply within 7 days.
2. What information we collect
- When you chat with us on WhatsApp: your name as it shows on WhatsApp, your phone number, and what you write to us, including your questions, your delivery city and anything else you choose to tell us.
- When you order: your name, phone number, delivery address and landmark, what you ordered, and how you paid. We never ask for your card number, PIN, OTP or BVN. If you send them by mistake, we delete the message.
- When you pay online: Paystack collects your payment details directly. We only receive confirmation of payment, the amount, and the name and contact details you gave Paystack.
- When you visit our website: basic technical information (for example your browser type and the pages you visited) through our hosting provider's security tools and privacy-friendly visitor counts. Only if you click "Accept", Meta's Pixel also collects information about your visit (see section 7).
- Health information: we don't ask about your health. If you tell us about a health condition, medicine, pregnancy or a possible side effect, see section 5.
3. Why we use it, and our legal basis
| What we do | Why | Legal basis (NDPA s.25) |
|---|---|---|
| Answer your questions and take your order on WhatsApp | To give you the information you asked for and to sell and deliver your order | Steps you asked for before a contract, and the contract itself (s.25(1)(b)(i)) |
| Arrange delivery, and pay on delivery where offered | To get your order to you | Contract (s.25(1)(b)(i)) |
| Keep sales and payment records | To meet tax and accounting rules | Legal obligation (s.25(1)(b)(ii)) |
| Send you refill reminders | Only if you said yes when we asked | Your consent (s.25(1)(a)). You can say "stop" at any time |
| Send you a message about Hoba when you haven't contacted us | Only if you've agreed to hear from us | Your consent (s.25(1)(a)) |
| Keep notes from our chats to serve you better and to improve how we describe Hoba | To learn the questions and words customers use, so our answers and product information are clearer | Our legitimate interests (s.25(1)(b)(v)). See "How we use chat notes" below |
| Measure our Facebook and Instagram ads using Meta's Pixel | To see which ads bring visitors | Your consent through the cookie banner (s.25(1)(a)) |
| Pass on a possible side effect for safety reporting | Product safety (see section 5) | Your consent (s.30(1)(a)), or to protect your vital interests in an emergency (s.30(1)(c)) |
| Keep the website secure and working | Security and fixing problems | Our legitimate interests (s.25(1)(b)(v)) |
How we use chat notes (our legitimate interests). We read chats from customers who have received our chat notice. Before we do, we remove names, phone numbers, addresses and any health details. We keep only short phrases and themes that don't identify anyone, and use them to improve our answers and the way we describe Hoba. We never quote you, use your name or share your story without asking you first for that specific use. We've checked that this is fair to you in a written legitimate interest assessment. You can object at any time (section 10), and we'll stop using your chats and delete any notes from them.
We don't use your information to make automatic decisions about you, and we don't build profiles of you.
4. Who we share your information with
We only share what each organisation needs:
| Who | What for | Where |
|---|---|---|
| WhatsApp (Meta): WhatsApp Ireland Ltd / WhatsApp LLC | Our chats with you run on WhatsApp Business | Ireland, USA and other countries |
| Paystack (Paystack Payments Limited) | Processing online payments. Paystack is responsible for the payment details you give it under its own privacy policy | Nigeria; it may transfer data abroad under its own privacy policy |
| AI writing tools we use to draft replies (their providers may process data outside Nigeria) | Helping us draft replies and analyse chat notes. Only text with names, numbers and health details removed is used for chat notes | May be outside Nigeria |
| Cloudflare, Inc. | Website hosting, security, privacy-friendly visitor counts, and forwarding emails to our inbox | USA and global network |
| The delivery company we use for your order | Delivering your order (name, phone, address only) | Nigeria |
| Meta Platforms (only if you accept the cookie banner) | Ad measurement (section 7) | Ireland, USA |
| The product's manufacturer (the NAFDAC registration holder) and NAFDAC | Safety reporting of possible side effects, only with your OK (section 5) | Nigeria |
| Authorities | If the law requires it | Nigeria |
We don't sell your information. We don't give your details to other distributors or to anyone for their own marketing.
5. Health information
Information about your health is "sensitive personal data" under the law (NDPA s.30 and s.65). We don't ask for it. If you mention it:
- we use it only to answer you safely (for example, to suggest you speak to your doctor or pharmacist first);
- we don't record it in our customer notes, and we remove it before any chat is used for improving our service;
- possible side effects: with your OK, we write down what happened and pass it to the product's manufacturer (the NAFDAC registration holder) and NAFDAC for safety reporting. If it's an emergency and we can't ask you, we may pass it on to protect your health.
6. Messages from us
- We'll only message you about Hoba if you contacted us first, you're buying from us, or you've told us you're happy to hear from us.
- Refill reminders only if you said yes.
- Reply "stop" (or tell us in any words) and we'll stop marketing messages straight away. Saying no never affects an order you've already placed.
7. Cookies and Meta's Pixel
- Necessary cookies keep the site secure and remember your cookie choice. They don't need your consent.
- Visitor counts: we use Cloudflare Web Analytics, which doesn't use cookies, doesn't identify you and doesn't track you across other websites. It only gives us total visitor numbers.
- Meta Pixel (only if you click "Accept"): a small piece of code from Meta (Facebook and Instagram) that records your visit (pages viewed on our product and order pages, whether you tapped WhatsApp or "Pay online", and a completed purchase amount), along with your IP address, browser details and Meta cookies (
_fbp,_fbc). It helps us see which ads work and lets Meta show you relevant ads. We don't send Meta your name, phone number, email or any health information, and the Pixel never runs on pages about health, cautions or side effects. - Your choice: the banner gives you Accept and Reject as equal choices. If you reject, the Pixel doesn't load and the site works exactly the same. You can change your mind at any time with the "Cookie settings" link at the bottom of every page. We'll then delete the Meta cookies.
- Meta is responsible for its own use of this information. See Meta's privacy policy at facebook.com/privacy/policy.
8. Sending information outside Nigeria
Some of the organisations in section 4 (WhatsApp/Meta, Cloudflare, the providers of the AI writing tools we use to draft replies) store or process information outside Nigeria, mainly in the USA and Europe. The law allows this:
- for WhatsApp chats, orders and services you asked for, because the transfer is needed to deal with your request or contract (NDPA s.43(1)(b));
- for the Meta Pixel, only with your consent after we've told you that those countries may not protect your information as strongly as Nigerian law does, and that it may be harder to enforce your rights there (s.43(1)(a));
- otherwise, where the recipient is bound by contract terms giving adequate protection (s.41(1)(a)).
We keep a record of the basis for each transfer.
9. How long we keep your information
| Information | How long |
|---|---|
| WhatsApp chats | Up to 6 months after your last order or delivery (or after our last chat, if you didn't buy), then deleted or archived. Longer only if there's an open complaint, refund or safety case, until it's settled |
| Chat text used for improving our service | Deleted straight after use. The notes kept don't identify anyone and are reviewed every year |
| Orders, delivery and payment records | 6 years, to meet tax and accounting law |
| Your "yes/no" to refill reminders and marketing, and our chat notice record | As long as we're in touch, then 6 months |
| Safety (side-effect) records | Kept as long as the law and the manufacturer's safety reporting duties require |
| Requests to delete or object | A short log (date, what was done) for 2 years, so we can show we did it |
| Cookie choice | 6 months, then we ask again |
10. Your rights
Under the Nigeria Data Protection Act 2023 (Part VI) you can:
- be told how we use your information (this notice);
- get a copy of your information;
- have it corrected if it's wrong or out of date;
- have it deleted;
- restrict our use of it while a request or complaint is being dealt with;
- object to our use of it, including for marketing and for chat notes (we'll stop unless we have a strong legal reason not to, and we always stop marketing);
- withdraw consent at any time (refill reminders, marketing messages, Meta Pixel). This doesn't affect what we did before you withdrew;
- receive your information in a common format to take elsewhere, where that applies;
- not be subject to decisions made only by automated means (we don't make any);
- complain to the Nigeria Data Protection Commission (section 11).
To use any of these rights, message us on WhatsApp (+2349061987599) or email us at hobaofficialstore@gmail.com. It's free. We may ask you to confirm it's really you. We'll reply within 7 days, and act within 30 days at the latest.
11. Complaints
Please tell us first (WhatsApp +2349061987599 or email hobaofficialstore@gmail.com) and we'll try to put it right within 7 days.
You also have the right to complain to the Nigeria Data Protection Commission (NDPC) at any time:
- Website: ndpc.gov.ng (online reporting: services.ndpc.gov.ng/breach/)
- Email: info@ndpc.gov.ng
- Address: No. 12 Dr Clement Isong Street, Abuja
- Phone: +234 (0) 916 061 5551
(NDPC contact details checked on ndpc.gov.ng on 11 October 2026. Re-check before publishing.)
12. Children
Hoba is not for children under 6, and our services are meant for adults. We don't knowingly collect information from anyone under 18. If we find we have, we delete it.
13. Keeping your information safe
Only the people who need it can see your information. Our business phone and accounts are protected with passwords and two-step verification. We remove names, numbers and health details before chats are used to improve our service. If a breach puts you at high risk, we'll tell you and the NDPC as the law requires.
14. Changes to this notice
If we change this notice, we'll update the date at the top. For important changes we'll tell you on WhatsApp if you're a customer.