POPIT!

Gourmet Popcorn

PRIVACY POLICY

Effective Date: March 2026

Last Updated: May 2026

1. Introduction

This Privacy Policy describes how POPIT! Gourmet Popcorn ('POPIT!', 'we', 'us', or 'our') collects, uses, stores, and protects your personal information when you visit www.trypopit.com (the 'Website'), place an order, or interact with us through any of our channels including Instagram and WhatsApp.

POPIT! is a food brand registered and operating in Nigeria. We are committed to protecting your privacy in accordance with the Nigeria Data Protection Regulation (NDPR) 2019, the Nigeria Data Protection Act (NDPA) 2023, and other applicable Nigerian law.

By using our Website, placing an order, or otherwise providing us with your personal information, you consent to the practices described in this Privacy Policy.

Note: Please read this policy carefully. If you do not agree with any part of it, please do not use our Website or services.

2. Who We Are

Business Name: POPIT! Gourmet Popcorn

Instagram: @trypopit

Country of Operation: Nigeria

For any questions about this Privacy Policy or how we handle your data, contact us at hello@trypopit.com.

3. Information We Collect

We collect personal information in the following ways:

3.1 Information You Give Us Directly

When you place an order, contact us, or interact with us, you may provide:

• Full name

• Delivery address (street, city, state, Nigeria)

• Phone number

• Email address

• Instagram or WhatsApp handle (if you contact us through these channels)

• Order details including product type, size, quantity, and any special instructions

• Payment-related information — note: we do not store card details; payments are processed by third-party payment providers

3.2 Information We Collect Automatically

When you visit trypopit.com, we may automatically collect:

• IP address

• Browser type and version

• Device type (mobile, desktop, tablet)

• Pages visited and time spent on the Website

• Referring website or source

• Geographic location (country/city level, not precise location)

This data is collected via cookies and analytics tools (see Section 7 — Cookies).

3.3 Information From Third Parties

If you contact us or place an order via Instagram DM or WhatsApp, we collect the information you provide within those conversations, including your name, contact details, and order specifics. These platforms have their own privacy policies which govern how they handle your data independently of POPIT!.

4. How We Use Your Information

We use your personal information only for the following purposes:

4.1 To Fulfil Your Order

• Process and confirm your order

• Prepare and pack your POPIT! products

• Arrange delivery to your specified address

• Send you order confirmation and delivery updates

• Resolve any issues with your order (e.g. damaged goods, incorrect items)

4.2 To Communicate With You

• Respond to your enquiries, messages, and complaints

• Send you information you have requested (e.g. wholesale pricing, B2B information)

• Notify you about changes to our products, pricing, or policies

4.3 To Improve Our Business

• Analyse website traffic and user behaviour to improve the Website experience

• Understand which products and pages are most popular

• Identify and fix technical issues

4.4 For Marketing (With Your Consent)

• Send you promotional messages, offers, or news about POPIT! products — only where you have opted in or where permitted under applicable Nigerian law

4.5 Legal and Compliance Purposes

• Comply with applicable Nigerian laws and regulations

• Maintain records as required by NAFDAC and other regulatory bodies

• Enforce our Terms and Conditions

• Respond to lawful requests from government authorities

Note: We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

5. Legal Basis for Processing

Under the NDPR and NDPA 2023, we process your personal data on the following legal bases:

• Contract performance: processing necessary to fulfil your order or respond to your enquiry

• Legitimate interests: analysing website traffic and improving our services, where your interests and rights are not overridden

• Consent: for marketing communications, where you have given clear consent

• Legal obligation: where we are required to process data to comply with Nigerian law

6. Who We Share Your Information With

We share your personal information only where necessary, with the following categories of recipients:

6.1 Delivery and Logistics Partners

We share your name, phone number, and delivery address with our courier or logistics partners solely to fulfil your delivery. These partners are contractually obligated to handle your data securely and only for the purpose of delivering your order.

6.2 Payment Processors

Online payments are processed by third-party payment providers. We share only what is necessary to complete your transaction. We do not store your card details on our systems.

6.3 Website and Technology Providers

Our Website is built on Odoo. Odoo processes certain technical and operational data as part of providing the platform. We also use analytics tools (such as Google Analytics and/or Plausible) which may process anonymised or pseudonymised data about how visitors use our Website.

6.4 Legal and Regulatory Authorities

We may disclose your information to Nigerian regulatory bodies, law enforcement agencies, or courts where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of POPIT!, our customers, or others.

6.5 Business Transfers

If POPIT! is acquired, merged, or undergoes a significant change in ownership, your personal information may be transferred to the new owner. We will notify you of any such change via the Website or by email.

Note: We do not share your personal data with any third party for their own marketing or commercial purposes.

7. Cookies and Tracking Technologies

Our Website uses cookies and similar tracking technologies to enhance your browsing experience and collect analytics data.

What Are Cookies?

Cookies are small text files placed on your device by a website. They help the website remember your preferences and understand how you use it.

Cookies We Use

• Essential cookies: required for the Website to function properly (e.g. session management, shopping cart)

• Analytics cookies: used to understand how visitors interact with the Website (e.g. pages visited, time spent). These may be set by Google Analytics or Plausible

• Preference cookies: remember your settings and preferences for a better experience

Managing Cookies

You can control and delete cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Website. Most browsers allow you to:

• See what cookies are set and delete them individually

• Block third-party cookies

• Block all cookies from specific websites

• Block all cookies from being set

For guidance, visit your browser's help section or www.aboutcookies.org.

8. How Long We Keep Your Information

We retain your personal information only for as long as necessary for the purposes outlined in this policy, or as required by Nigerian law.

Order information: 7 years (for accounting and regulatory compliance)

Customer communications: 2 years from last interaction

Website analytics data: As configured by analytics provider (typically 26 months)

Marketing consent records: Until you withdraw consent, plus 1 year

When your data is no longer needed, we will securely delete or anonymise it.

9. Your Rights

Under the NDPR and NDPA 2023, you have the following rights regarding your personal data:

• Right of access: you may request a copy of the personal data we hold about you

• Right to rectification: you may ask us to correct inaccurate or incomplete data

• Right to erasure: you may request that we delete your personal data, subject to legal obligations that require us to retain it

• Right to restrict processing: you may ask us to stop actively processing your data in certain circumstances

• Right to data portability: you may request your data in a structured, commonly used format

• Right to object: you may object to our processing of your data where we rely on legitimate interests

• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at hello@trypopit.com. We will respond within 30 days. We may need to verify your identity before processing your request.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at www.ndpc.gov.ng.

10. Data Security

We take the security of your personal information seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction, or alteration. These measures include:

• Secure HTTPS encryption on our Website

• Access controls limiting who within POPIT! can access customer data

• Use of reputable, security-compliant third-party platforms (Odoo, payment processors)

• Regular review of our data handling practices

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your rights and freedoms, we will notify you and the relevant regulatory authority as required by law.

11. Children's Privacy

Our Website and services are not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately at hello@trypopit.com and we will delete it promptly.

POPIT! products are enjoyed by families and children, but all purchases and data interactions on this Website are intended to be completed by adults aged 18 and over, or by minors with parental supervision.

12. Third-Party Links

Our Website may contain links to third-party websites, including our Instagram page, payment portals, and logistics partner websites. This Privacy Policy applies only to trypopit.com. We are not responsible for the privacy practices of any third-party websites. We encourage you to read the privacy policies of any external sites you visit.

13. International Data Transfers

POPIT! operates in Nigeria and primarily processes data within Nigeria. However, some of our service providers (such as analytics tools or cloud-based platforms) may process data outside Nigeria. Where this occurs, we take steps to ensure your data is protected to a standard equivalent to Nigerian law, including through contractual arrangements with those providers.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the 'Last Updated' date at the top of this policy

• Post a notice on our Website

• Where appropriate, notify you by email

We encourage you to review this policy periodically. Your continued use of our Website after any changes constitutes your acceptance of the updated policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how POPIT! handles your personal data, please contact us:

Instagram: @trypopit

We aim to respond to all privacy-related enquiries within 30 days.

POPIT! Gourmet Popcorn

Handcrafted in Lagos, Nigeria.

Note: This Privacy Policy is provided as a template for POPIT! and should be reviewed by a qualified Nigerian lawyer before publication to confirm full compliance with the NDPR, NDPA 2023, and any sector-specific regulations applicable to food businesses and e-commerce in Nigeria.