Privacy Policy

Effective Date: 20 August 2026

Last Updated: 20 August 2026

Label Stores (“we”, “us”, “our”, “TLS” or the “Company”) is committed to protecting the privacy and security of the personal data entrusted to us by our customers, website users, suppliers, visitors and other individuals with whom we interact.

This Privacy Policy (“Policy”) explains how we collect, process, use, store, disclose and protect personal data in connection with our supermarket operations, physical stores, website, delivery services, customer service channels, loyalty programme, promotions, payment services and other related activities. This Policy applies to our website accessible at www.thelabelstores.com and all TLS digital channels and physical premises.

This Policy is intended to comply with the Nigeria Data Protection Act 2023 (NDPA), the General Application and Implementation Directive (GAID) 2025, the directives and guidelines of the Nigeria Data Protection Commission (NDPC), and all other applicable data protection and privacy laws in Nigeria.

Please read this Policy carefully. If you have any questions, contact us using the details in Section 18. This Policy applies separately from, and does not affect, the separate data processing notices applicable to our employees and staff.

  1. WHO WE ARE

For the purposes of applicable data protection legislation, Label Stores is the data controller in respect of personal data processed in connection with our business activities, except where we process personal data solely on behalf of another entity as a data processor.

Registered Name: Label Stores

Address: 25 Adetola Street, Aguda, Surulere, Lagos State

Email: support@thelabelstores.com

Telephone: 090 8443 4343 / 090 3846 5215

Data Protection Officer (DPO): Label Stores has designated a Data Protection Officer responsible for overseeing compliance with this Policy and applicable data protection law. You may contact the DPO at: dpo@thelabelstores.com.

NDPC Registration: Label Stores is registered with the Nigeria Data Protection Commission (NDPC) as a data controller and files its Data Protection Compliance Programme (DPCP) through a licensed Data Protection Compliance Organisation (DPCO) in accordance with the NDPA 2023.

  1. KEY DEFINITIONS

In this Policy, the following terms have the meanings given below:

(a)  “Personal Data” means any information relating to an identified or identifiable natural person, as defined under the NDPA 2023;

(b)  “Processing” means any operation performed on personal data, including collection, recording, storage, use, disclosure and deletion;

(c)  “Data Subject” means the individual to whom personal data relates;

(d)  “NDPC” means the Nigeria Data Protection Commission established under the NDPA 2023;

(e)  “NDPA 2023” means the Nigeria Data Protection Act 2023; and

(f)  “Sensitive Personal Data” means personal data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, or other categories attracting heightened protection under applicable law.

  1. PERSONAL DATA WE COLLECT

Depending on your interaction with us, we may collect the following categories of personal data:

  • Identity information: your full name, title and other identification information;
  • Contact information: telephone number, email address, residential and delivery address;
  • Transaction information: products purchased, order details, transaction history, payment records, receipts, refunds and returns;
  • Payment information: payment method and limited payment-related information. Where payments are processed through third-party payment providers, we do not directly receive or store complete card details;
  • Loyalty programme information: membership number, purchase history, points balance, rewards, preferences, redemption history and programme participation data;
  • Marketing information: your preferences regarding promotional communications and marketing consent status;
  • Device and technical information: IP address, browser type, device type, operating system, and website interaction data collected through cookies and similar technologies (see Section 10);
  • Location information: particularly in connection with delivery services, website functionality or fraud prevention;
  • CCTV and security information: images or recordings captured by surveillance cameras at our premises for security purposes (see Section 11); and
  • Customer service information: enquiries, complaints, feedback and correspondence records.

We do not knowingly collect Sensitive Personal Data in the ordinary course of our retail operations unless specifically required and disclosed to you at the point of collection.

  1. HOW WE COLLECT PERSONAL DATA

Directly from you

When you: purchase products in-store or online; create an account on our website; register for our loyalty programme; place a delivery order; subscribe to our newsletter; contact customer service; participate in promotions, competitions or surveys; communicate with us through social media; or otherwise interact with us.

Automatically

Through cookies and similar technologies when you use our website or application (see Section 10).

From third parties

From payment service providers, delivery partners, marketing partners, publicly available sources and other service providers. Where we combine information from third parties with information we already hold, we treat the combined data as personal data subject to this Policy.

  1. PURPOSES OF PROCESSING

We process personal data for the following purposes:

  • Processing and fulfilling purchases, orders, payments, refunds and returns;
  • Providing delivery services;
  • Managing customer accounts and our loyalty programme;
  • Providing customer support and responding to enquiries and complaints;
  • Administering promotions, competitions and rewards;
  • Improving our products, services and customer experience;
  • Maintaining transaction and accounting records;
  • Preventing, detecting and investigating fraud, theft and other unlawful activities;
  • Ensuring the security of our premises, employees, customers and property (including through CCTV);
  • Operating and securing our website, applications and IT systems;
  • Sending marketing and promotional communications where permitted by law and your preferences;
  • Complying with legal, regulatory, tax, accounting and reporting obligations;
  • Establishing, exercising or defending legal claims;
  • Conducting business analytics, profiling and reporting (see Section 13); and
  • Any other legitimate purpose disclosed to you at the point of collection.
  1. LAWFUL BASIS FOR PROCESSING

We process personal data only where a lawful basis exists under the NDPA 2023. The lawful bases we rely upon include:

(a)  Performance of a contract: where processing is necessary to fulfil an order, process a payment, provide delivery or manage your account;

(b)  Compliance with a legal obligation: where we are required to process data under applicable law, including tax, regulatory or law enforcement obligations;

(c)  Consent: where we rely on your freely given, specific, informed and unambiguous consent obtained through an active opt-in mechanism — for example, for marketing communications and non-essential cookies;

(d)  Protection of vital interests: where processing is necessary to protect life or physical safety;

(e)  Legitimate interests: where processing is necessary for our legitimate business interests and those interests are not overridden by your rights and freedoms. The legitimate interests we rely upon include fraud prevention, network and information security, direct marketing to existing customers, business analytics, and improvement of our services. We have conducted a balancing test in respect of each such purpose and are satisfied that our interests do not override your fundamental rights.

We will not rely on consent as a lawful basis where another more appropriate basis is available.

  1. MARKETING COMMUNICATIONS

We may send you information about our promotions, discounts, new products, loyalty rewards and related marketing communications. We will only send you marketing communications where you have provided your prior, express consent through an active opt-in mechanism. We will never rely on implied or passive consent for marketing purposes.

You may withdraw your consent or opt out of marketing communications at any time by: following the unsubscribe link in any marketing email; updating your preferences in your account settings; or contacting us at support@thelabelstores.com. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

  1. CHILDREN’S PRIVACY

Our website and services are not directed at children under the age of 18 years. Under the NDPA 2023, individuals under 18 years cannot provide valid consent to the processing of their personal data without parental or guardian consent.

Accordingly:

(a)  We do not knowingly collect personal data from persons under 18 years without prior verifiable parental or guardian consent;

(b)  Where we have reason to believe that personal data has been collected from a person under 18 without the required consent, we will delete such data promptly;

(c)  Parents or guardians who believe that we hold personal data about their child without appropriate consent should contact us immediately at support@thelabelstores.com; and

(d)  Where our services are used in the context of a household account that may include persons under 18, the account holder (who must be 18 or over) is responsible for ensuring that use of the account by persons under 18 is appropriate.

  1. COOKIES AND SIMILAR TECHNOLOGIES

Our website uses cookies and similar tracking technologies. Cookies are small text files placed on your device when you visit our website. We use the following categories of cookies:

Essential / Strictly Necessary Cookies

Required for the website to function and cannot be disabled. These include session management, security, and shopping basket cookies. No consent is required for these cookies.

Performance / Analytics Cookies

Enable us to analyse how visitors use our website (e.g., pages visited, time spent) in order to improve performance. Examples include Google Analytics. These cookies require your consent.

Functional Cookies

Enable enhanced functionality such as remembering your preferences, language settings and login details. These cookies require your consent.

Marketing / Advertising Cookies

Used to deliver relevant advertising and track the effectiveness of our marketing campaigns. These may include third-party advertising cookies (e.g., Meta Pixel). These cookies require your express consent.

Cookie Consent: When you first visit our website, you will be presented with a cookie consent banner allowing you to accept, reject or customise your cookie preferences by category. You may change your preferences at any time through the “Cookie Settings” link in our website footer.

You may also manage cookie preferences through your browser settings. Please note that disabling certain cookies may affect website functionality.

Category

Purpose

Retention

Consent Required

Essential

Core website function, security, basket

Session / up to 12 months

No

Performance

Analytics and website improvement

Up to 24 months

Yes

Functional

Preferences, language, login state

Up to 12 months

Yes

Marketing

Advertising, campaign tracking

Up to 24 months

Yes

 

  1. CCTV AND PREMISES SECURITY

We operate CCTV and other security measures at our physical stores for legitimate purposes including: protecting customers, employees and visitors; preventing and detecting theft, fraud and other unlawful conduct; protecting company property; investigating incidents; and complying with applicable legal obligations.

CCTV recordings will be accessed only by authorised personnel and will be retained for 30 days, after which they will be securely deleted unless required for an active investigation, legal proceedings, or regulatory request, in which case they will be retained for as long as necessary for that purpose. You will be informed of CCTV operation by notices displayed at our premises.

  1. DISCLOSURE OF PERSONAL DATA

We may disclose personal data to the following categories of recipients:

  • Payment service providers processing transactions on our behalf;
  • Delivery and logistics providers;
  • Technology, cloud storage and IT service providers;
  • Customer service providers;
  • Professional advisers, auditors and consultants;
  • Insurers;
  • Affiliated or related companies within our group, where necessary;
  • Government agencies and regulators where legally required;
  • Law enforcement agencies where lawfully requested; and
  • Other third parties where you have authorised the disclosure or it is otherwise permitted by applicable law.

We require all third-party service providers processing personal data on our behalf to implement appropriate contractual, technical and organisational safeguards. We do not sell personal data to third parties.

  1. CROSS-BORDER TRANSFERS

Some of our service providers (including cloud infrastructure providers, analytics providers and payment processors) may be located outside Nigeria. Where personal data is transferred outside Nigeria, we ensure that such transfer is undertaken in accordance with the NDPA 2023 and GAID 2025, including by relying on one or more of the following safeguards:

(a)  Standard Contractual Clauses (SCCs) approved or recognised by the NDPC;

(b)  Transfer to a country that the NDPC has determined provides an adequate level of data protection; or

(c)  Your explicit consent to the specific transfer, where no other safeguard is available.

You may request details of the specific transfer safeguards we rely upon by contacting our DPO at dpo@thelabelstores.com.

  1. PROFILING AND AUTOMATED DECISION-MAKING

We may use your purchase history, loyalty programme data and website behaviour for profiling purposes in order to personalise product recommendations, targeted offers and marketing communications. This profiling does not produce legal or similarly significant effects on you without human review.

Where automated processing produces a decision that has a significant legal or similarly significant effect on you, you have the right to: (a) request human review of the decision; (b) express your views; and (c) contest the decision. To exercise this right, contact us at support@thelabelstores.com.

We may also use automated fraud-scoring tools to prevent and detect fraudulent transactions. Where a transaction is declined by an automated system, you may request a manual review.

  1. DATA SECURITY

We implement appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental or unlawful destruction, loss, alteration, unauthorised disclosure and other unlawful processing. These measures include access controls and authentication, encryption of data in transit and at rest where appropriate, employee training and confidentiality obligations, secure storage and system monitoring, regular security assessments, and vendor security requirements.

No method of transmission over the internet or electronic storage is completely secure. While we take all reasonable steps to protect your personal data, we cannot guarantee absolute security. If you have reason to believe your interaction with us is no longer secure, please notify us immediately.

  1. PERSONAL DATA BREACHES

Where we become aware of a personal data breach, we will promptly assess the incident and take appropriate measures to contain, investigate, remediate and document the breach.

In accordance with the NDPA 2023 and GAID 2025, where a breach is likely to result in a risk to the rights and freedoms of data subjects, we will notify the NDPC within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to affected data subjects, we will also notify the affected individuals without undue delay, providing details of the nature of the breach, the data affected, the likely consequences, and the measures taken or proposed to address it.

  1. DATA RETENTION

We retain personal data only for as long as necessary for the purposes for which it was collected, including to comply with legal, tax, accounting and regulatory obligations, resolve disputes, enforce agreements and prevent fraud. The following retention periods apply:

Category of Personal Data

Retention Period

Basis for Retention

Transaction / purchase records

6 years from transaction date

FIRS / tax compliance; legal claims

Customer account data

Duration of account + 2 years post-closure

Contract; legitimate interests

Loyalty programme data

Duration of membership + 2 years after last activity

Contract; legitimate interests

CCTV footage

30 days (or longer if subject to active investigation)

Security; legal compliance

Marketing preferences / consent records

Until opt-out + 1 year from last interaction

Legal obligation; consent records

Customer service / complaints records

2 years from resolution of enquiry

Legitimate interests; legal claims

Website / device / technical data

12 months rolling

Legitimate interests; security

Payment information

6 years from transaction date (limited data only)

Legal obligation; fraud prevention

Delivery address records

Duration of account + 2 years post-closure

Contract; legitimate interests

Fraud / security investigation records

6 years from conclusion of investigation

Legal claims; regulatory compliance

 

When personal data is no longer required, it will be securely deleted, destroyed or anonymised in accordance with applicable law.

  1. YOUR DATA PROTECTION RIGHTS

Subject to applicable legal limitations and exceptions, you have the following rights under the NDPA 2023:

  • Right of access: to request a copy of the personal data we hold about you;
  • Right to rectification: to request correction of inaccurate or incomplete personal data;
  • Right to erasure: to request deletion of your personal data in appropriate circumstances;
  • Right to restriction: to request that we restrict processing of your personal data in defined circumstances;
  • Right to object: to object to processing based on legitimate interests or for direct marketing purposes;
  • Right to withdraw consent: to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing;
  • Right to data portability: to receive your personal data in a structured, commonly used format where applicable;
  • Right to human review: to request human review of automated decisions that significantly affect you; and
  • Right to information: to receive clear information about how your personal data is processed.

These rights are not absolute and may be subject to lawful exceptions under the NDPA 2023.

How to Exercise Your Rights

To exercise any of the above rights, submit a written request to us at support@thelabelstores.com or by post to our address in Section 18. To protect your data, we may ask you to verify your identity before processing your request. We will respond to your request within 1 (one) month of receipt, which may be extended by a further 2 months where requests are complex or numerous — we will notify you if an extension is needed.

  1. COMPLAINTS

If you believe we have processed your personal data unlawfully or have otherwise infringed your privacy rights, please contact us in the first instance at support@thelabelstores.com or by contacting our DPO at dpo@thelabelstores.com. We will investigate and respond to complaints in accordance with our internal procedures and in compliance with the NDPA 2023.

You also have the right to lodge a complaint directly with the Nigeria Data Protection Commission (NDPC) at any time:

  • Website: www.ndpc.gov.ng
  • Email: info@ndpc.gov.ng

Lodging a complaint with us does not affect your right to complain to the NDPC.

  1. THIRD-PARTY LINKS

Our website may contain links to third-party websites, applications or services. We are not responsible for the privacy practices or content of those sites. We encourage you to read the privacy policies of any third-party sites you visit.

  1. CHANGES TO THIS POLICY

We may update this Policy from time to time to reflect changes in our business operations, technology, legal requirements or regulatory guidance. The updated Policy will be published on our website with an updated effective date. Where changes are material, we will notify registered customers by email or through a prominent notice on our website before the changes take effect. Your continued use of our services after the effective date of an updated Policy will constitute your acknowledgment of the updated Policy.

  1. CONTACT US

For questions, requests or concerns relating to this Policy or our processing of personal data:

Label Stores

Address: 25 Adetola Street, Aguda, Surulere, Lagos State

Email: support@thelabelstores.com

DPO Email: dpo@thelabelstores.com

Telephone: 090 8443 4343 / 090 3846 5215