Privacy Policy

1. Who we are

Sarah Lawson Imports ("we", "us", "our") operates the e-commerce website at https://sarahlawsonimports.com ("the Website"). We are the data controller responsible for the personal information collected through the Website and through any related channels (WhatsApp, SMS, email, in-store, social media).

This Privacy Policy is issued in line with Ghana's Data Protection Act, 2012 (Act 843) and the Electronic Transactions Act, 2008 (Act 772). It applies to anyone who visits the Website, creates an account, places an order, or otherwise interacts with us.

2. Information we collect

2.1 Information you give us

When you create an account, place an order, contact us, leave a review, or sign up for marketing, we collect:

• Identity & contact details: Full name, email address, phone number, WhatsApp number.
• Delivery information: Shipping address, landmarks, recipient name and phone.
• Order & payment metadata: Items ordered, quantities, totals, payment method, payment reference number, payment status. Full card numbers and Mobile Money PINs are NEVER collected or stored by us — they are handled directly by our payment processor, Moolre.
• Account credentials: Email and a salted, hashed password (we never see your real password).
• Communications: Messages, reviews, ratings, photos, support tickets, and chat transcripts you submit.
• Marketing preferences: Whether you opted in to promotional SMS, email, or push notifications.

2.2 Information collected automatically

When you visit the Website (including our mobile app), we automatically collect:

• Device & technical data: IP address, browser type and version, operating system, device type, screen size, language, and device identifiers.
• Usage data: Pages viewed, products clicked or added to cart, search queries, time spent, referrer URLs, and the path you take through the Website.
• Cookies & local storage: See section 7 for details on cookies and how to control them.
• Push tokens: If you install our app and grant push permission, we store an anonymous push token to send you order updates and promotions.

2.3 Information from third parties

We may receive information about you from third parties — for example, our payment processor confirming a payment, a courier confirming a delivery, social-media platforms when you log in or share content, and advertising platforms reporting on the performance of our adverts. We only combine third-party information with what we hold to deliver the service you asked for.

3. How we use your information

We process your personal information for the following purposes:

4. Lawful basis for processing

In line with Ghana's Data Protection Act, 2012 (Act 843), we only process your personal data where we have a lawful basis to do so:

• Performance of a contract: To take and fulfil your order, deliver the products and provide customer support.
• Your consent: For non-essential cookies, marketing SMS/email, and push notifications. You can withdraw your consent at any time.
• Legitimate interests: To run, secure and improve our business — including fraud prevention, analytics, and protecting our staff and customers — provided your rights are not overridden.
• Legal obligation: To comply with tax, accounting, AML, and other Ghanaian legal requirements.

5. Sharing your information

We do not sell your personal information. We share it only with the following categories of recipient, and only as far as needed to deliver the service:

• Payment processors: Moolre for processing card and Mobile Money payments. We share your name, phone number, order ID and amount; we do not share full card or Mobile Money credentials because we never receive them.
• Couriers & dispatch riders: Your name, delivery address and phone number, so they can deliver your order.
• SMS and email gateways: Your phone number / email and the message content, so we can send order updates and (where consented) marketing.
• Hosting & database providers: Cloud providers that securely store the data that powers the Website.
• Analytics & advertising platforms: Aggregated and pseudonymised data to measure performance of campaigns. Where required, these are subject to your cookie consent.
• Professional advisers: Lawyers, accountants and auditors bound by confidentiality.
• Authorities: Where we are required by law, by a valid order from a Ghanaian court, or to protect our rights, property or safety, or the rights, property or safety of others.
• Business transfers: If our business is sold, merged or restructured, your data may be transferred to the new owner under equivalent privacy protections.

6. Your rights

Under Ghana's Data Protection Act, 2012 (Act 843) you have the following rights in relation to the personal data we hold about you:

To exercise any of these rights, email us at info@sarahlawsonimports.com or use your account settings. We will respond within thirty (30) days. We may need to verify your identity (for example, by confirming the order number and phone you used) before acting on a request.

7. Cookies & similar technologies

We use cookies and similar technologies (local storage, session storage, push tokens) to make the Website work and to improve your experience. You can control non-essential cookies through the cookie banner shown on your first visit and through your browser settings.

Disabling certain cookies — particularly the strictly necessary ones — may break parts of the Website such as login or checkout.

8. Children's privacy

The Website is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at info@sarahlawsonimports.com and we will delete it promptly.

9. International transfers

Some of our service providers (for example, hosting, email, analytics and Moolre's technical infrastructure) operate servers outside Ghana. Where personal data leaves Ghana, we make sure equivalent safeguards apply by selecting providers with strong security and contractual data-protection commitments, in line with Act 843.

10. How long we keep your data

We keep your personal information only for as long as needed for the purpose it was collected, plus any period required by law:

• Account information: While your account is active. Deleted (or anonymised) within 90 days of account closure.
• Order, invoice & payment records: Six (6) years after the order date, to comply with Ghanaian tax and accounting requirements.
• Marketing data: Until you unsubscribe, then deleted within 30 days, except where retention is needed to honour your opt-out.
• Analytics data: Aggregated indefinitely; identifiable usage logs are retained for up to 26 months.
• Customer-service messages: Up to two (2) years after resolution.
• Fraud-prevention records: Up to seven (7) years where needed to defend our business and other customers from repeat fraud.

11. Security

We take the security of your personal information seriously. Our protections include:

• HTTPS/TLS encryption for all data in transit between your device and our servers;
• Database-level access controls and row-level security policies, so staff only see what they need to see;
• Salted, hashed passwords — we never store passwords in readable form;
• Outsourcing payment handling to Moolre so we never see card numbers or Mobile Money PINs;
• reCAPTCHA, rate-limiting and audit logging to detect abuse;
• Regular backups, monitoring, and prompt patching of security issues.

No system can be 100% secure. If we ever experience a personal-data breach that is likely to result in significant harm to you, we will notify you and the Data Protection Commission of Ghana as required by law.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or the law. The "Last updated" date above shows when the latest version came into effect. For material changes (for example, new categories of data or new third-party processors) we will notify you by email or with a prominent notice on the Website before the change takes effect.

13. Contact us

If you have any questions about this Privacy Policy, want to exercise any of your rights, or have a concern about how your data is being handled, please contact us: