Privacy Policy.

Vlaander LTD, a private limited company registered in Nigeria under company number RC 8298878, is the data controller for personal data processed in connection with this storefront. All correspondence regarding this Policy must be addressed to the single inbox identified in §08 below.

We collect only the data necessary to operate the storefront, fulfil orders, and honour security disclosures. Specifically:

• Order data — name, billing address, email address, items purchased, and order timestamps. Required to complete the sale and issue tax receipts.
• Payment data — handled by the payment processor. We do not store full payment card numbers or CVV codes; we receive a tokenised reference sufficient to issue refunds within the inspection window.
• Correspondence — email messages you send to sales@vlaander.com, including any attachments or technical details you elect to include.
• Cart and session state — minimal, first-party cookies sufficient to keep a cart across pages and to maintain a logged-in customer session if you create an account.
• Server logs — IP address, user agent, and the requested URL, retained briefly for security and fraud-prevention purposes.

What we do not collect. We do not run third-party analytics that profile visitors across the open web. We do not place advertising trackers. We do not sell, rent, or otherwise monetise visitor data. We do not collect biometric or special-category data within the meaning of applicable data-protection law.

Personal data is used exclusively to: process and fulfil your order; deliver the source code, signed artifact, and related documents; provide the limited support stated in our Terms of Service; respond to security disclosures and other correspondence; meet tax, accounting, and other legal obligations; and detect and prevent fraud, abuse, and unauthorised use of the storefront.

For buyers in jurisdictions where a legal basis must be identified — including under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the UK GDPR and Data Protection Act 2018, the Nigerian Data Protection Act 2023 (“NDPA”), and analogous statutes — processing is grounded in (i) performance of the contract of sale and any reasonable pre-contract steps taken at your request, (ii) compliance with Vlaander’s legal obligations, and (iii) the legitimate interests of Vlaander in operating the storefront, securing it against abuse, and honouring security disclosures, balanced against the rights and freedoms of the buyer.

California buyers. For buyers who are California residents within the meaning of the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (together, the “CCPA”), Vlaander does not “sell” or “share” personal information within the meaning of the CCPA, does not process sensitive personal information for purposes other than those permitted without the additional opt-in under the CCPA, and honours the rights conferred by the CCPA including the rights to know, delete, correct, and limit use of sensitive personal information.

Personal data is shared only with the categories of processor strictly necessary to operate the storefront:

• Storefront and checkout — Shopify International Limited operates the underlying commerce platform and PCI-compliant checkout.
• Hosting and edge delivery — Shopify Oxygen serves the storefront from cloud infrastructure configured by Vlaander.
• Payment processing — the payment providers integrated with the storefront process payment data under their own terms.
• Email delivery — outbound transactional email (order confirmations, download links) is delivered by Shopify’s email infrastructure.
• Legal compliance — disclosure to regulators, tax authorities, courts, or law-enforcement bodies where required by binding order or applicable law.

We do not transfer personal data to any party for the purpose of marketing, advertising, or audience profiling. We do not enrich purchaser data with third-party datasets.

Order data is retained for the period required by Nigerian commercial and tax law and by the corresponding obligations of the jurisdictions in which buyers are located, typically not less than seven (7) years from the date of sale. Correspondence is retained for as long as is reasonably necessary to respond to the matter raised and to maintain a durable record of buyer commitments and disclosures. Server logs are retained for a short window sufficient for security and fraud investigation.

Vlaander is established in Nigeria. The storefront is served by globally distributed edge infrastructure, and many buyers transact from outside Nigeria. By placing an order, you acknowledge and consent to the international transfer of your personal data to Nigeria and to any jurisdiction in which the processors identified in §05 operate.

Transfer mechanism. Where personal data is transferred outside the European Economic Area or the United Kingdom, the transfer is made on the basis of (i) the European Commission’s Standard Contractual Clauses (Module Two — controller-to-processor) and, where applicable, the UK International Data Transfer Addendum, (ii) an applicable adequacy decision under GDPR Article 45 or UK GDPR Article 45, or (iii) another lawful safeguard recognised under applicable law, in each case as supplemented by additional contractual and organisational measures Vlaander maintains.

All privacy correspondence — including subject-access requests, deletion requests, rectification requests, objections to processing, and complaints — must be addressed to sales@vlaander.com. This is the single inbox monitored by Vlaander LTD; no other address is authoritative for matters governed by this Policy.

Subject to applicable data-protection law, you may request access to the personal data we hold about you, correction of inaccurate data, deletion of data we no longer require, restriction of processing, objection to processing based on legitimate interests, withdrawal of any consent previously given, and the right to data portability — a portable, machine- readable export of the personal data you have provided to us. Submit any such request to sales@vlaander.com with the subject line “Privacy request”. We will respond within thirty (30) calendar days. Where we cannot give effect to a request — for example, because retention is required by law — we will state the basis on which the request is refused.

Automated decision-making. Vlaander does not subject buyers to decisions based solely on automated processing — including profiling — that produce legal effects on the buyer or similarly significantly affect the buyer.

Right to lodge a complaint. If you consider that our processing of your personal data infringes applicable data-protection law, you have the right to lodge a complaint with the data-protection supervisory authority in your jurisdiction — including (for buyers in the European Union) your national supervisory authority, (in the United Kingdom) the Information Commissioner’s Office, and (in Nigeria) the Nigeria Data Protection Commission. We would, however, appreciate the opportunity to address your concern before you do so.

The storefront is directed exclusively to professional and institutional buyers. We do not knowingly collect personal data from any person under the age of sixteen (16). If we become aware that we hold such data, we will delete it promptly. If you believe a child has provided personal data to us, email sales@vlaander.com so we can act.

We use only the cookies strictly necessary to operate the storefront. These include: (a) a session cookie set by the storefront platform to maintain a logged-in customer session where you create an account; (b) a cart cookie that allows the cart to persist as you navigate; and (c) a small set of platform-level cookies used by Shopify to secure the checkout against fraud. We do not place advertising cookies, third-party analytics cookies, or cross-site tracking technologies. Your browser’s “Do Not Track” signal, where present, is honoured by virtue of our not deploying tracking technologies in the first place.

We may amend this Policy by publishing a new version on this page. Material changes will be summarised at the top of the page for a reasonable period. The version in force at the time of any purchase governs that purchase.

Vlaander LTD · RC 8298878 · Privacy Policy v1.0 · Effective 2026-06-29 · sales@vlaander.com