Last updated: September 2026 — Version 2.4 · Compliant with NDPA 2023, EU GDPR, and UK GDPR
The data controller responsible for personal data collected through this Platform is COOL ROOM DIGITAL, operating under the AFRIVITA brand at afrivita.net. For all privacy-related enquiries, requests, or complaints, the Customer may contact the Company's designated Data Protection Point of Contact at: afrivita01@gmail.com. The Company is committed to responding to all data subject requests within thirty (30) calendar days of receipt, in compliance with applicable data protection legislation.
This Privacy Policy governs the collection, use, storage, transfer, and deletion of personal data processed by COOL ROOM DIGITAL in connection with the operation of afrivita.net and its associated services. It applies to all data subjects who interact with the Platform, regardless of their country of residence, and reflects the Company's obligations under the Nigeria Data Protection Act 2023 (NDPA), the European Union General Data Protection Regulation (EU) 2016/679 (GDPR), the UK GDPR as retained under the Data Protection Act 2018, and other applicable national data protection frameworks.
The Company does not collect, process, transmit, store, or have access to any payment card data (including card numbers, CVV codes, or expiry dates), bank account credentials, or mobile money authentication information. All payment data is processed exclusively by the Company's authorised payment service providers — including Flutterwave Technology Solutions Ltd., Stripe Payments Europe Ltd., and Gumroad Inc. — each of which maintains PCI-DSS Level 1 certification or equivalent. Customers are directed to the respective privacy policies of these processors for information regarding their data handling practices.
In the course of providing its services, the Company may transfer personal data to service providers located outside the Customer's country of residence, including transfers to the United States of America, the Republic of Ireland, and other jurisdictions. Where such transfers involve data of EU or UK data subjects, the Company ensures that appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission (Decision 2021/914) and equivalent UK International Data Transfer Agreements, or reliance on an adequacy decision where applicable.
The Company retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Specifically: Order and transaction records are retained for a minimum of seven (7) years to satisfy statutory accounting and tax obligations. Customer support communications are retained for a maximum of three (3) years from the date of last interaction. Technical and usage data collected via server logs is retained for a maximum of thirteen (13) months. Upon expiry of the applicable retention period, data is securely deleted or irreversibly anonymised.
Depending on the Customer's jurisdiction, the following rights may be available:
To exercise any of the above rights, submit a written request to afrivita01@gmail.com. The Company will respond within thirty (30) days and may request verification of identity before processing the request.
The Platform deploys the Meta Pixel (a JavaScript-based tracking technology) and the Google Analytics tag (gtag.js) to collect usage and conversion data. These technologies may set first-party and third-party cookies on the Customer's device. The Meta Pixel transmits event data — including PageView, InitiateCheckout, and Purchase events — to Meta Platforms Ireland Ltd. for advertising measurement and audience building purposes. Customers may opt out of interest-based advertising by visiting facebook.com/ads/preferences or by using the AdChoices opt-out tool at optout.aboutads.info.
The Company implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include: encrypted data transmission via TLS 1.2 or higher across all Platform endpoints; access controls limiting data access to authorised personnel on a need-to-know basis; use of reputable, security-certified third-party service providers; and regular review of security practices in line with evolving threat landscapes.
The Company reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or business practices. The current version is always accessible on this page. Material changes will be communicated to Customers via email where the Company holds a valid email address for the data subject.