Privacy Policy | Kristall Klear Direct

Kristall Klear Direct ("KKD", "we", "us") is a data controller registered in Nigeria. This notice explains how we collect, use, store and protect your personal data under the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR) 2019.

1. Information We Collect

We collect only the personal data needed to deliver our service and meet our legal obligations:

Identity & contact: full name, phone number, WhatsApp number, email address.
Delivery: address, city, state, LGA, household size, preferred delivery day/time, optional access notes.
Membership: selected plan, member ID, billing cycle, referral / share code.
Account security: hashed password, login timestamps, password-reset attempts.
Technical: IP address, browser type, device, and limited cookie data (see §6).

2. Lawful Basis & Purposes (NDPA s. 25)

Performance of a contract — fulfilling your membership, scheduling deliveries, processing payments, customer support.
Legal obligation — tax records, accounting, regulatory reporting.
Legitimate interest — fraud prevention, service security, anonymised analytics.
Consent — marketing messages, analytics cookies, Pure Living Rewards™ public leaderboards. You may withdraw consent at any time.

3. Data Sharing & Processors

We do not sell personal data. We share the minimum data necessary with carefully vetted processors acting on our instructions:

Secure Cloud Infrastructure — authorized service providers handling application hosting and encrypted database storage on our behalf.
WhatsApp Business Platform (Meta) — delivery and membership notifications.
Email service provider — transactional confirmations.
FactoryLink™ Logistics Partners — last-mile delivery (name, phone, address, scheduled window only).
Payment provider — when payment is processed for your selected membership term.

Where data leaves Nigeria, transfers rely on adequacy decisions or contractual safeguards as permitted by NDPA s. 41.

4. Data Retention

Active members: for the duration of the membership and 7 years after (tax law).
Reservation / lead data without a membership: up to 24 months, then deleted or anonymised.
Waitlist: until service launches in your city or you ask us to remove your entry.
Activity feed events: initials + city only — no full names or contact data are publicly displayed.

5. Security

Data is encrypted in transit (TLS) and at rest. Row-Level Security policies enforce per-account access. Sensitive operations (admin, payment) require additional authentication. Access to production data is restricted to a named list of staff.

6. Cookies

We use three categories of cookies:

Strictly necessary — login, security, CSRF. These cannot be turned off.
Analytics — aggregated, anonymised usage data used to improve the service. Opt-in only.
Marketing — measuring referrals and Pure Living Rewards™ campaign performance. Opt-in only.

You can review and change your choice any time using the cookie banner shown on your first visit.

7. Your Rights (NDPA Part VI)

You have the right to:

Access the personal data we hold about you;
Correct inaccurate or incomplete data;
Request deletion ("right to be forgotten");
Restrict or object to processing, including direct marketing;
Receive your data in a portable, machine-readable format;
Withdraw consent at any time (without affecting prior lawful processing);
Lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

8. Contact / Data Protection Officer

To exercise any right above or ask a privacy question, email privacy@kkdelivered.com or message us on WhatsApp via the number on the homepage. We respond within 14 days.

9. Children

Our service is intended for adults (18+). We do not knowingly collect data from children; contact us if you believe we hold a child's data so we can remove it.

10. Changes

Material changes to this notice will be communicated by email and posted here with an updated revision date.