Privacy Policy

This policy explains what personal information Toke Cosmetics collects when you shop with us, why we collect it, who we share it with, and the control you have over it. We have written it in plain language and kept it specific to what we actually do, rather than to what a standard template says.

Last updated: 29 September 2026

Who we are

Toke Cosmetics sells skincare, haircare, baby care and men’s grooming products online at tokecosmetics.com and from our stores in Nigeria. For the purposes of the Nigeria Data Protection Act 2023, Toke Cosmetics is the data controller for the information described here.

Head office: Shop No 1, First Floor (opposite Bukka Hut), Ogudu Mall, Kosofe, Ogudu, Ojota, Lagos, Nigeria.

Email: support@tokecosmetics.com
Phone: +234 707 480 0702

We also serve customers from stores in Ikorodu (Lagos), Kubwa (Abuja) and Sangokoya (Ogunpa).

What we collect

When you create an account

• Your name, email address and phone number.
• Your password, which is stored only as a cryptographic hash. Nobody at Toke Cosmetics can read it, including us.
• If you turn it on, two-factor authentication settings.

When you place an order

• Delivery address, including the landmark we ask Nigerian customers for, because couriers here rely on landmarks rather than postcodes.
• The items you bought, what you paid, and your order history.
• Your chosen delivery method and any note you leave for the rider.
• Guest orders are possible without an account. We still need your name, email, phone and address to deliver.

When you pay

We never see or store your card details. Card payments are handled entirely by our payment providers on their own systems. What reaches us is a reference, the amount, the currency, and whether the payment succeeded. If you pay by bank transfer, we see the transfer reference and the name on the account.

When you use the site

• Your IP address and browser user agent.
• Which pages and products you viewed, and what you put in your basket.
• Cookies, described in their own section below.

Other things you choose to give us

• Product reviews and ratings.
• Messages you send us by email, phone or WhatsApp.
• If you join our referral or affiliate programme: your referral code, the orders credited to it, and the account details we need to pay your commission.
• If you subscribe: your email address for our newsletter.

Why we use it, and our lawful basis

What we do	Why	Lawful basis
Take and deliver your order, handle returns and refunds	It is the service you asked for	Performance of a contract
Send order confirmations, delivery updates and receipts	You need to know where your order is	Performance of a contract
Keep your account secure, block bots and fraud	Protecting your account and our shop	Legitimate interest
Keep records of sales and payments	Tax and accounting duties	Legal obligation
Answer your questions	Customer support	Legitimate interest
Remind you once about a basket you did not finish	Helping you complete a purchase you started	Legitimate interest. Tick “Don’t contact me about my basket” at checkout, or email us, to opt out. If you opt out we keep no contact details, only an anonymous record of the basket.
Improve the shop and understand what sells	Running the business well	Legitimate interest
Marketing emails and advertising measurement	Telling you about products and knowing which adverts work	Consent
Pay referral commissions	You joined the programme	Performance of a contract

Where our basis is consent, you can withdraw it at any time and it is as easy to withdraw as it was to give. Withdrawing does not affect anything done before you withdrew.

Who we share it with

We do not sell your personal information. We share it only with the companies that make the shop work, and only with what each of them needs.

Payments

Paystack and Flutterwave process card and transfer payments. They receive your name, email, phone and the amount. They handle your card details directly; we do not.

Delivery

GIG Logistics, AAJ Express and BrandnPack deliver orders. They receive the name, phone number, delivery address and landmark for the parcel they are carrying, because a courier cannot deliver without them. If you choose store pickup, nothing goes to a courier at all.

Email

An email delivery provider sends our order confirmations, delivery updates and marketing email on our behalf. It receives your email address and the content of the message.

Advertising and analytics

Google (Google Analytics and Google Ads), Meta (Facebook and Instagram), TikTok and Snapchat. This only happens if you have accepted marketing cookies. See the section below, which explains exactly what is sent.

Running the site

We rely on a small number of technology suppliers to host the shop, store our product images and backups securely, protect sign-in and checkout from automated abuse, and alert us when something breaks. They act only on our instructions and only for those purposes, and none of them uses your information for their own ends.

We do not publish the individual suppliers here, because a public list of the systems behind a shop is useful mainly to people trying to attack it. If you need the details for a data protection request, ask us and we will provide them.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

Cookies and advertising

Cookies are small files a website stores in your browser. Some are essential and some are not, and we treat the two differently.

Essential cookies

These keep you signed in, remember your basket, remember which country you are shopping from, and protect the checkout from fraud. The shop cannot work without them.

Measurement and marketing cookies

These tell us which products people look at, and which adverts led to a sale. They are set by Google, Meta, TikTok and Snapchat as well as by us.

When you have accepted marketing cookies, we also send a record of your purchase directly from our servers to those advertising platforms, so that a sale is counted even if your browser blocked the tracking script. What we send is:

• Your email address and phone number, cryptographically hashed before they leave our servers, so the platform can match you to an account it already has without us handing over the address in readable form.
• The order number, the value and the currency.
• The advertising click identifier from the link you arrived on, if there was one.
• Your IP address and browser user agent.

We do not send the contents of your basket to advertisers beyond the product identifiers, and we never send your password, your full payment details or your delivery address.

Your choice

When you first visit, we show a short cookie notice with these options:

• Accept basic — essential cookies plus measurement (Google Analytics), which shows us how the shop is used. No advertising cookies are set, and no purchase is reported to advertising platforms.
• Accept all — adds advertising cookies from Google, Meta, TikTok and Snapchat, and the purchase reporting described above.
• Choose — switch measurement and advertising on or off separately, including both off.

If you are in the UK or the European Economic Area, we also offer Reject all, and nothing beyond essential cookies is used until you choose. Everywhere else, if you do not make a choice we treat it as accepting all, and you can change this at any time.

You can change your mind at any time using the Cookie choices link at the bottom of any page. If you withdraw consent, we stop sending your information to advertising platforms and delete the advertising cookies we are able to reach. You can also clear cookies in your browser settings at any time.

Where your information is kept

Some of our systems, and some of the payment, delivery, email and advertising providers we work with, operate outside Nigeria. Your information may therefore be stored or processed abroad.

Where information is transferred outside Nigeria, we rely on the safeguards in the providers’ own data protection terms and only use providers that commit to appropriate protection.

How long we keep it

• Orders, invoices and payment records — kept for as long as tax and accounting law requires.
• Your account — kept while it is open. Close it and we delete or anonymise what we are not legally required to keep.
• Guest checkout contact details for an unfinished basket — deleted after 30 days.
• IP address and browser user agent collected for advertising measurement — automatically deleted after 90 days. This happens on a timer, not on request, so it does not depend on anyone remembering.
• Your cookie choice — remembered for six months, then we ask again.
• Advertising click identifiers — 90 days.
• Marketing email subscriptions — until you unsubscribe.

Your rights

Under the Nigeria Data Protection Act 2023 you have the right to:

• Ask what personal information we hold about you, and get a copy.
• Have inaccurate information corrected.
• Ask us to delete information we no longer need.
• Ask us to restrict how we use it while a concern is resolved.
• Receive the information you gave us in a portable format.
• Object to use based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time, as easily as you gave it.

If you are shopping with us from the United Kingdom or the European Union, you have equivalent rights under UK and EU data protection law, and you may also complain to your own national regulator.

How to exercise your rights

Email support@tokecosmetics.com and tell us what you would like. We will reply within 30 days. We may ask you to confirm your identity first, because we should not hand somebody’s order history to a stranger.

Much of it you can do yourself: your name, phone number and addresses are editable in your account, your cookie choices are in the Cookie choices link in the footer, and every marketing email has an unsubscribe link.

If you are not satisfied with how we have handled your information, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng. We would rather you came to us first so we can put it right.

Keeping your information safe

The site runs entirely over encrypted connections. Passwords are hashed and cannot be recovered by anyone, including us. Staff accounts require two-factor authentication and can only reach what their role needs. Payment card details never touch our systems. Backups are encrypted and access to them is restricted.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects you, we will tell you and the Commission as the law requires.

Children

Our shop is meant for adults. We do not knowingly collect information from children under 18. If you believe a child has given us their information, email us and we will delete it.

Changes to this policy

When we change this policy we update the date at the top. If a change materially affects how we use your information, we will tell you on the site and, where it is required, ask for your consent again.