Privacy Policy

[REGISTERED NAME] ([RC NUMBER]), registered at [REGISTERED ADDRESS], Lagos, Nigeria, is the data controller for personal data collected through Dullam. That means we decide what is collected and why, and we are accountable for it under the Nigeria Data Protection Act 2023 (NDPA).

Questions, requests or complaints about your data: privacy@[DOMAIN].

When you create an account: your name, email address and a securely hashed password. For business accounts, your company name, the team members you invite, and your brand kit.

When you design: the artwork, images, text and templates you upload or create, and the drafts we save so you can come back to them.

When you order: delivery address, phone number, email, what you bought, the amount, and the status of the order as it moves through production and delivery.

When you pay: a transaction reference, the amount, and whether the payment succeeded. We never see or store your card number — Paystack handles the card and we only receive the outcome.

When you contact us: the message you send and our reply, kept so we can pick up where we left off.

Technical data: our servers log IP addresses and request details for security, fraud prevention and debugging.

We do not collect sensitive personal data — such as health, religious or biometric information — and we ask that you do not send it to us.

Under the NDPA we must have a lawful basis for each use:

• To fulfil your order — producing, checking and delivering it, and handling payment. Basis: performance of our contract with you.
• To run your account — signing you in, saving your designs, showing your order history. Basis: performance of our contract.
• To keep you informed — order confirmations, production and delivery updates, and service notices. Basis: performance of our contract.
• To keep the platform secure — preventing fraud and abuse, investigating incidents. Basis: our legitimate interest in a safe service.
• To improve what we make — understanding which products and features are used. Basis: our legitimate interest in improving the service.
• To send marketing — only where you have asked for it. Basis: your consent, withdrawable at any time.
• To meet our legal obligations — tax, accounting and regulatory records. Basis: legal obligation.

Your order is made by a vendor in our network, but they never receive your personal details. This is built into the platform, not just a policy.

A vendor sees only:

• an anonymous brief reference, not your order number;
• the product, quantity, variant and your artwork;
• the city the order ships to.

They do not see your name, email address, phone number, street address, or what you paid. The full delivery address goes only to the courier at dispatch.

We do not sell your personal data. We share it only with providers who help us run the service, and only what each one needs:

• Paystack — payment processing. They receive your payment details directly; we do not.
• Delivery partners — your name, address and phone number, so they can deliver your order.
• Postmark — email delivery for receipts, order updates and password resets.
• Termii and Twilio — SMS and WhatsApp notifications, where you have opted into them.
• Supabase — our database and hosting provider.
• Cloudflare — storage for the files you upload.
• Anthropic— powers the studio’s design assistant. Where you use it, your prompt and design context are sent to generate a suggestion. It is not used to train their models.

We may also disclose data where the law requires it, or to establish or defend legal claims. If Dullam is ever acquired or merged, data would transfer as part of that business, and we would tell you first.

Our database is hosted in the European Union (Ireland), and some of our providers operate in the United States. This means your personal data is transferred outside Nigeria.

The NDPA allows these transfers where the destination gives adequate protection, or where appropriate contractual safeguards are in place. We rely on our providers’ data processing agreements and standard contractual clauses, and we only work with providers who commit to a comparable standard of protection.

We do not use advertising cookies, analytics cookies, or tracking pixels. We do not track you across other websites, and there is no third-party tracker on this site.

The only cookies we set are strictly necessary ones that keep you signed in. They are first-party, httpOnly — meaning JavaScript cannot read them — and there are six, covering the customer, vendor and admin sign-ins and their session renewals. Blocking them means you cannot sign in.

We also use your browser’s local storage for conveniences like your shopping cart before you sign in, an in-progress gift kit, and your preferred 3D preview quality. That information stays on your device and is not sent to us or to anyone else. Clearing your browser data removes it.

• Account data — while your account is open, and for a reasonable period afterwards in case you return.
• Designs and drafts — while your account is open, so you can reorder. You can delete any of them yourself at any time.
• Order and payment records — at least seven years, because Nigerian tax and company law require us to keep them.
• Support messages — up to three years.
• Security logs — up to twelve months.

When we no longer need personal data, we delete it or irreversibly anonymise it.

• Traffic between you and Dullam is encrypted in transit.
• Passwords are hashed with scrypt — we cannot read them, and neither can anyone who obtained the database.
• Sessions use httpOnly cookies rather than tokens exposed to JavaScript, which limits the damage a cross-site scripting bug could do.
• Our team’s access is scoped by role and enforced on the server, so staff only reach what their job requires.
• The vendor network is separated from customer data by design — see what vendors see.

No system is perfectly secure. If a breach affects your rights, we will notify you and the Nigeria Data Protection Commission (NDPC) as the NDPA requires.

Under the NDPA you have the right to:

• Access — get a copy of the personal data we hold about you.
• Correct — have inaccurate data fixed. Most of it you can edit yourself in your account settings.
• Delete — have your data erased, except records we must keep by law.
• Port — receive your data in a portable format.
• Object or restrict — object to processing based on our legitimate interests, or ask us to pause it while a concern is resolved.
• Withdraw consent — at any time, where we relied on consent. Every marketing email has an unsubscribe link.

Email privacy@[DOMAIN] and we will respond within 30 days. There is no charge, and we may ask you to confirm your identity first so we do not hand your data to someone else.

Dullam is not intended for children, and account holders must be at least 18. If we learn we have collected a child’s personal data without proper consent, we will delete it. If you believe that has happened, please contact us.

We will update this page as the platform changes. When a change is significant, we will update the date shown and tell account holders by email rather than relying on you to notice.

If you are unhappy with how we have handled your data, please tell us first at privacy@[DOMAIN] — we would rather fix it directly.

You also have the right to complain to the Nigeria Data Protection Commission (NDPC), Nigeria’s data protection regulator, at ndpc.gov.ng.