GDPR & Data Protection

Overview

PrimeShieldHub Gadgets Limited ("PrimeShieldHub," "we," "us," or "our") is committed to protecting the privacy and personal data of all individuals who interact with our services. This GDPR compliance page explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 and the Nigeria Data Protection Act (NDPA) 2023.

While PrimeShieldHub is a Nigerian company headquartered in Benin City, Edo State, we serve customers globally and are committed to upholding the highest standards of data protection for all users, regardless of their location.

This policy applies to all personal data processed through:

Our website: primeshieldhub.com
Our API services: api.primeshieldhub.com
Our mobile applications and progressive web apps
Our WhatsApp business channel (+234 810 353 5978)
Our email communications (primeshieldhub@gmail.com)
In-person transactions at our physical locations

What Personal Data We Collect

We collect only the personal data that is necessary to provide you with our products and services. The categories of personal data we may collect include:

Information You Provide Directly

Identity Data: Full name, username, or similar identifier
Contact Data: Email address, phone number, delivery address, billing address
Financial Data: Payment card details (processed securely via Paystack — we never store full card numbers), bank transfer references, cryptocurrency wallet addresses
Profile Data: Account credentials (hashed passwords), purchase history, wishlist items, preferences
Communications Data: Messages sent via WhatsApp, email, or contact forms
Review Data: Product reviews, ratings, and feedback you submit

Information Collected Automatically

Technical Data: IP address, browser type and version, device type, operating system, screen resolution, timezone setting
Usage Data: Pages visited, products viewed, time spent on pages, click patterns, navigation paths
Device Fingerprint: A SHA-256 hash generated from canvas, WebGL, audio, and font characteristics for fraud prevention (not reversible to identify you personally)
Cookie Data: Session identifiers, preferences, analytics tokens (see Cookie Policy section below)

Information We Do NOT Collect

Sensitive personal data (race, ethnicity, political opinions, religious beliefs, health data, biometric data for identification)
Government identification numbers (except where required by Nigerian law for business registration verification)
Children's data (we do not knowingly collect data from persons under 16)

How We Use Your Data

We process your personal data for the following purposes:

Order Fulfillment: To process and deliver your orders, communicate order status, and handle returns
Account Management: To create and maintain your account, authenticate logins, and manage preferences
Customer Support: To respond to inquiries, resolve issues, and provide assistance via WhatsApp, email, or phone
Payment Processing: To process payments securely through our payment partners (Paystack, bank transfer, cryptocurrency)
Fraud Prevention: To detect and prevent fraudulent transactions using device fingerprinting and behavioral analysis
Marketing: To send promotional offers, newsletters, and product recommendations (only with your explicit consent)
Analytics: To analyze website usage, improve user experience, and optimize our services
Legal Compliance: To comply with applicable laws, regulations, and legal processes

Legal Basis for Processing

Under GDPR, we rely on the following legal bases for processing your personal data:

Contractual Necessity (Article 6(1)(b)): Processing your orders, managing your account, and delivering products you've purchased
Legitimate Interests (Article 6(1)(f)): Fraud prevention, network security, service improvement, and business analytics
Consent (Article 6(1)(a)): Marketing communications, cookie placement (non-essential), and newsletter subscriptions
Legal Obligation (Article 6(1)(c)): Tax records, business registration compliance, and law enforcement requests

Your Data Protection Rights

Under GDPR and the Nigeria Data Protection Act, you have the following rights regarding your personal data:

Right to Access

You can request a copy of all personal data we hold about you, free of charge.

Right to Rectification

You can request correction of inaccurate or incomplete personal data we hold about you.

Right to Erasure

You can request deletion of your personal data ("right to be forgotten") under certain circumstances.

Right to Restrict Processing

You can request limitation of how we process your data while disputes are resolved.

Right to Data Portability

You can request your data in a structured, machine-readable format to transfer to another service.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

Rights re: Automated Decisions

You have the right not to be subject to decisions based solely on automated processing.

Right to Withdraw Consent

You can withdraw previously given consent at any time without affecting prior lawful processing.

To exercise any of these rights, please contact our Data Protection Officer at primeshieldhub@gmail.com or via WhatsApp at +234 810 353 5978. We will respond within 30 calendar days as required by GDPR.

Cookie Policy

Cookies are small text files stored on your device when you visit our website. We use the following categories of cookies:

Category	Purpose	Duration	Consent Required
Essential / Strictly Necessary	Authentication, session management, shopping cart functionality, security (CSRF tokens)	Session to 24 hours	No (necessary for service)
Functional / Preference	Language preferences, currency selection, theme settings, recently viewed items	Up to 1 year	Yes
Analytics & Performance	Google Analytics (GA4), page performance metrics, user behavior analysis	Up to 2 years	Yes
Marketing & Personalization	Product recommendations, personalized offers, retargeting	Up to 90 days	Yes

When you first visit our website, you will see a cookie consent banner allowing you to accept or reject non-essential cookies. You can change your preferences at any time by clearing your browser cookies and revisiting the site, or by contacting us.

For detailed information about specific cookies we use, please refer to our Privacy Policy.

International Data Transfers

PrimeShieldHub is based in Nigeria, and your data is primarily stored on Cloudflare's global infrastructure with D1 databases, R2 storage, and KV stores distributed across Cloudflare's edge network.

For data transferred outside Nigeria or the European Economic Area (EEA), we ensure appropriate safeguards are in place, including:

Cloudflare's certification under the EU-US Data Privacy Framework
Standard Contractual Clauses (SCCs) for international data transfers
Data processing agreements with all third-party service providers
Encryption of data in transit (TLS 1.3) and at rest (AES-256)

Our primary data processing partners include:

Cloudflare — Hosting, CDN, D1 database, R2 storage, KV, Workers
Paystack — Payment processing (PCI-DSS Level 1 certified)
Google — Analytics (GA4), Gemini AI (for AI Assistant)
Twilio — SMS and WhatsApp notifications
Resend — Transactional email delivery
Telegram — Bot notifications (staff/internal use)

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

Account Data: Retained while your account is active, plus 2 years after last activity
Order Data: Retained for 7 years (Nigerian tax law requirement)
Payment Records: Retained for 7 years (financial compliance)
Customer Support Messages: Retained for 2 years after resolution
Analytics Data: Retained for 26 months (Google Analytics default)
Device Fingerprints: Retained for 24 hours (then regenerated)
OTP Codes: Automatically deleted after 5 minutes (or upon verification)
Session Tokens: Expire after 24 hours of inactivity

After the retention period expires, personal data is either permanently deleted or anonymized so it can no longer be associated with you.

Security Measures

We implement appropriate technical and organizational measures to protect your personal data:

Encryption: All data transmitted between your browser and our servers is encrypted using TLS 1.3. Data at rest is encrypted using AES-256-GCM
Password Security: Passwords are hashed using PBKDF2 with 100,000 iterations and unique salts — we never store plain-text passwords
JWT Authentication: Session tokens are signed with HMAC-SHA256 and include device fingerprint binding
CSRF Protection: All state-changing requests require valid CSRF tokens
OTP Verification: Two-factor authentication via email OTP for sensitive operations
Rate Limiting: API endpoints are rate-limited to prevent abuse (60 requests per minute per client)
Device Fingerprinting: Advanced canvas/WebGL/audio/font fingerprinting for fraud detection
Cloudflare Turnstile: Bot protection on forms and authentication endpoints
Security Headers: Strict CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy
Regular Audits: Automated security scanning and dependency vulnerability monitoring

Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at primeshieldhub@gmail.com. We will take steps to delete such information promptly.

Data Protection Officer

Our Data Protection Officer (DPO) is responsible for overseeing compliance with data protection laws and handling your privacy-related inquiries:

Freedom Evbakoe Amenaghawon
Founder & CEO / Data Protection Officer
PrimeShieldHub Gadgets Limited
108 Ekhorutomwen Street, Benin City, Edo State, Nigeria
Email: primeshieldhub@gmail.com
Phone/WhatsApp: +234 810 353 5978

Complaints & Supervisory Authority

If you believe our processing of your personal data violates applicable data protection laws, you have the right to lodge a complaint with a supervisory authority.

In Nigeria, the supervisory authority is the Nigeria Data Protection Commission (NDPC):

Website: ndpc.gov.ng
Email: info@ndpc.gov.ng

For EU residents, you may contact your local Data Protection Authority in your country of residence. A full list of EU DPAs is available at the European Data Protection Board website.

We encourage you to contact us first at primeshieldhub@gmail.com so we can attempt to resolve your concern directly before escalating to a supervisory authority.