Privacy Policy

Who we are

This policy explains how Prudential Atelier Limited, trading as Prudent Gabriel, Prudential Atelier, Prudential Bride and Prudential Kids ("we", "us"), collects and uses personal data when you visit prudentgabriel.com, shop with us, book a consultation, commission a piece, chat with us or apply for a role. Prudent Gabriel was founded by Mrs. Prudent Gabriel-Okopi and works from its atelier in Ajah, Lagos, Nigeria.

We are the data controller of your personal data: we decide why and how it is used. We follow the Nigeria Data Protection Act 2023 (the NDPA) and the rules the Nigeria Data Protection Commission (the NDPC) makes under it, which replaced the Nigeria Data Protection Regulation 2019 (the NDPR). Where you are in the European Union or the United Kingdom and we sell to you there, we also follow the General Data Protection Regulation (the GDPR, and the UK GDPR).

Our address:

Prudential Atelier
14 Atelier Close
Victoria Island
Lagos, Nigeria

Our data protection contact

Questions, requests and complaints about your personal data go to our data protection contact at [email protected]. Put "Privacy" in the subject line. This mailbox is read by the person responsible for data protection at Prudent Gabriel, who reports to the directors.

The short version

We collect what we need to make, sell, deliver and look after your pieces, and to run your account.
We never sell your data, and we do not use advertising trackers.
Marketing emails go only to people who ask for them, and every one has a one-click unsubscribe.
Our website and database are hosted in Germany. Payments, email and a few other services are run by trusted providers, some outside Nigeria, under safeguards described below.
You can see, download, correct and delete your data. Most of it from your account; the rest by writing to us.

What we collect

Account details. Your name, email address, phone number, a password (stored only as a bcrypt hash, never readable), and, if you add them, a profile picture, a display name and the day and month of your birthday (not the year). If you sign in with Google, Google sends us your name, email address and picture. If you pay for an order, a consultation or a commission without an account, we open an account for that email address and send you a link to choose your password.

Measurements and fit. If you choose made to measure or commission a piece, the measurements you give us (for example bust, waist, hip, shoulder, sleeve, lengths, neck and armhole), the size you choose from our chart, your style preferences, colours, occasions and budget range if you fill in a style profile, and dates you ask us to remember (for example an anniversary). We use your measurements only to cut and make your pieces: they are not used for marketing and are never shown on the public site.

Orders and payments. What you order, prices, currency, delivery or collection details, gift messages, notes, coupon use, the payment method you chose, payment references and status from the payment provider, and invoices. We never see or store your full card number. If you save a card, the provider gives us a token, the card brand, the last four digits and the expiry date. If you pay by bank transfer, we keep the receipt you upload, which can show your account name and number.

Consultations and commissions. Your enquiry (the occasion, its date and location, where you live, the number of pieces, how you can attend fittings, the date you need the piece, colours and inspiration pictures), your booking (the type of consultation, preferred dates, the fee and the exact consultation terms you accepted), your commission brief, moodboards, sketches, the photographs and notes the workroom takes at each stage, your approvals, alteration requests and receipt confirmation.

Children's sizes. If you order a children's piece made to measure, the child's measurements, given by you as the parent or guardian, are kept on your order. We do not create accounts for children (see Children below).

Messages. What you write to us through the contact form (with the internet (IP) address it arrived from), by email, and in live chat (your name, the email address or phone number you give us to reply to, your messages and ours, any photos or PDFs either side sends, and the page or piece the conversation started from).

Reviews. Your rating, review and any photo you attach. A review is published only after we approve it.

Prudent Points and referrals. Your points balance and every credit and debit, your referral code, and who introduced you or whom you introduced.

Job applications. Your name, contact details, experience, cover letter, CV and portfolio. For industrial-training placements also your school, course, year, registration number, your supervisor's name and contact details, your school letter and your student identity card. Please send only what the application asks for.

Technical data. When you use the site, our servers and Cloudflare (which protects and speeds up the site) process your IP address and browser details to deliver pages and stop abuse. We keep IP addresses only briefly, for rate limiting and in security and contact-form records. Error reports from your browser record the page address with any private link codes removed. If you accept analytics, we count page visits in aggregate, with broad facts such as country, device type and whether it is a return visit (no IP address, no profile of you) and note which campaign link brought you to us, so we know which posts lead to an order. See the Cookie Policy.

Where it comes from

Almost all of it comes from you. Some comes from others: payment providers (whether a payment succeeded), Google (if you sign in with Google), carriers (tracking updates), a friend who refers you (your relationship to them), and our staff (notes and photographs made while working on your piece).

Why we use it, and our legal basis

The NDPA (section 25) and the GDPR (Article 6) allow us to use personal data only on a lawful basis. Ours:

To make, sell and deliver what you order, take payment, run your account, book and hold your consultation and keep you informed about your order or commission. *Basis: performing our contract with you, or steps you ask for before one.*
To keep financial and tax records and answer lawful requests from regulators and courts. *Basis: legal obligation.*
To keep the site secure, prevent fraud and spam (including the security check on our enquiry form), and enforce our terms. *Basis: our legitimate interest in protecting the house and our clients.*
To improve the site and our service, understand which pages and campaigns work (only with your analytics consent), answer chat and contact messages, remind you about a bag you left, points about to lapse or a piece waiting for collection, ask for a review after delivery, and run Prudent Points and referrals. *Basis: our legitimate interests in running and improving a made-to-order house, balanced against yours. You can object at any time.*
To send you news of collections and private events. *Basis: your consent, which you can withdraw at any time.*
To award birthday points and send a birthday note, when you add your birthday. *Basis: your consent, given by adding it; remove it in your account at any time.*
To assess a job application. *Basis: steps you ask for before a contract, and our legitimate interest in recruiting.*

We do not use your data for any other purpose without telling you first, and we do not process sensitive personal data (such as health, religious or political information) about you. Please do not send it to us.

Marketing

We send marketing emails only to people who opt in, when they register, in their account settings, or by joining our newsletter. Every marketing email has a one-click unsubscribe link, and you can also switch marketing off in your account. Service messages about an order, a payment, a booking or your account are not marketing and are still sent. We do not sell or share your details for anyone else's marketing.

We do not sell your personal data. We share it only with providers who help us run the house, under contracts that require them to protect it and use it only on our instructions, and with others where the law requires.

Hosting. Contabo GmbH, Germany: the servers that run the website, our database and our files (including receipts, consultation pictures and CVs).
Website protection and delivery. Cloudflare, Inc. (United States, global network): all traffic to the site, and the security check on our enquiry form (Turnstile).
Payments. Paystack and Monnify (Nigeria), Flutterwave (Nigeria and abroad) and Stripe (United States and Ireland): your name, email address, the amount and a reference, so they can take and confirm payment. Card details go straight to them.
Email delivery. Resend (United States), Brevo (France) or our configured mail host: the address, subject and content of the emails we send you.
Sign-in. Google (United States), if you choose to sign in with Google.
Meetings. Zoom or Google, if your virtual consultation uses their service.
Maps. Google Maps, only if you choose to show the map on our contact page.
Delivery. GIG Logistics (Nigeria) and DHL (worldwide): your name, phone number and address when we book your parcel. Rate quotes use only the destination, weight and value.
Messaging. If you ask us to reach you on WhatsApp, the conversation takes place on Meta's service.
Professional advisers, regulators and courts, where the law requires or to establish or defend legal claims, and a buyer of the business if Prudent Gabriel is ever sold (under the same protections).

Sending data outside Nigeria

Because our servers are in Germany and some providers are abroad, your data leaves Nigeria. We transfer it only as sections 41 to 43 of the NDPA allow: to countries with an adequate level of protection (Germany and the rest of the European Economic Area are governed by the GDPR), or under contractual safeguards with the provider (such as the standard contractual clauses in its data processing terms), or where the transfer is necessary to perform our contract with you (for example, paying a foreign card processor or sending an international parcel). Data we receive from the EU or UK is protected by the same safeguards. Ask our data protection contact for details of the safeguard that applies.

How long we keep it

We keep personal data only as long as we need it for the purpose we collected it, then delete or anonymise it:

Orders, invoices, payments and bank-transfer receipts: six years after the end of the financial year they belong to, as Nigerian tax and company law requires.
Your account, measurements and style profile: while your account is open. When you delete your account they are erased (see Your rights). Measurements recorded on an order stay with that order's record.
Commission records (brief, stage photographs, approvals): with the order record. Stage photographs are kept so we can stand behind our work and any alteration under warranty.
Consultation enquiries we cannot take: twelve months after our decision.
Job applications that do not lead to a role: twelve months after the role is filled or the application closed, then deleted with their files.
Contact-form messages: two years.
Live chat: kept indefinitely, so we can look back at what was agreed about an order, until you ask us to erase it.
Unfinished checkouts: ninety days.
Copies of emails we sent you: two years.
Error logs: ninety days. Security and activity logs: two years, and longer only for records of payments, permissions and deletions.
Marketing consent and unsubscribes: for as long as we hold your email, so we can prove your choice and keep honouring it.
Backups: fourteen days, then overwritten.

Many of these deletions run automatically every night. We may keep data longer only where the law requires or to establish, exercise or defend a legal claim.

Your rights

Under the NDPA (sections 34 to 38) and, where it applies, the GDPR, you have the right to:

be told how your data is used (this policy);
access your data and receive a copy;
correct data that is wrong or incomplete;
erase your data, where we no longer need it or have no other lawful basis to keep it;
restrict our use of it while a question about it is resolved;
object to our use of it on the basis of legitimate interests, and to direct marketing at any time;
portability: receive the data you gave us in a common, machine-readable format, or have it sent to someone else;
withdraw consent at any time, without affecting what we did before;
not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (we make no such decisions).

Doing it yourself. In your account you can update your details, addresses, measurements and style profile, switch marketing on or off, download a copy of your data (Account, Settings, Download my data) and delete your account. Deleting your account erases your profile details, addresses, measurements, style profile, moodboards, saved cards, wishlist, dates and chats, and unsubscribes your email. Your login is closed. Orders, invoices and payment records are kept, without your account, for the period the law requires.

Writing to us. Email [email protected] with "Privacy" in the subject, the email address you used with us, and what you would like. We may need to confirm your identity before we act. We reply within thirty days, free of charge. If a request is complex we may need up to two further months under the GDPR, and we will tell you why within the first month. If the law requires us to keep something you asked us to erase, we tell you what and why.

Automated decisions and profiling

We do not make decisions about you that are based solely on automated processing and that have legal or similarly significant effects. Some routine things happen automatically: your loyalty tier is set by your points balance, reminder emails follow what you did (a bag left, points about to lapse, a piece waiting), and enquiries for events within a short time are flagged for a phone call. None of these decides whether we will serve you; a person at Prudent Gabriel always decides whether to take a commission.

Security

We protect your data with measures suited to the risk: encrypted connections (HTTPS) everywhere; passwords stored only as bcrypt hashes; payment keys, saved-card tokens and private link codes encrypted or hashed at rest; private files (receipts, consultation pictures, CVs and identity documents, chat files) refused on any public address and opened only by staff whose role needs them, and a receipt link emailed inside the house stops working after 7 days; a senior administrator viewing the site as you, to help you, does so for a limited time and every such visit is logged; role-based access with logged administrator actions; rate limits and a security check against automated abuse; and regular security reviews. No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we notify the NDPC within 72 hours of becoming aware of it and tell you without undue delay where the risk to you is high, as section 40 of the NDPA requires.

Children

Our clothes include pieces for children, but the site and our accounts are for adults. Under the NDPA a child is anyone under 18. We do not knowingly create an account for, or collect data directly from, anyone under 18. A child's measurements or details reach us only from a parent or guardian ordering for them, who consents on the child's behalf and can ask us to correct or erase them at any time. Photographs of children in our Prudential Kids gallery are published only with a parent's or guardian's written consent. If you believe a child has given us their data, write to us and we will delete it.

Job applicants and staff

This policy covers job applications made through our careers page. Our staff are given a separate notice about the employment records we keep.

Complaints

If you are unhappy with how we have handled your data, please tell us first at [email protected] so we can put it right. You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng). If you are in the European Union you may complain to the data protection authority where you live or work, and in the United Kingdom to the Information Commissioner's Office (ico.org.uk).

Changes to this policy

We update this policy when our practices or the law change. The date at the top shows when it last changed. If a change materially affects how we use data you have already given us, we tell you by email or on the site before it takes effect.

Last updated: 15 October 2026Version nd-3:9b832911e656