Legal
Privacy Policy
Last updated: 24 August 2026
This explains what we collect when you use this store, why we collect it, who we share it with, and what you can ask us to do about it. It is written to be read, not to be survived.
Who we are
This store is operated by BluOrchid Aesthetics, a doctor-led aesthetic clinic in Lagos, trading as 8SKIN PRO.
| Address | Plot 113, beside Medplus Pharmacy, Hakeem Dickson, Lekki Phase 1, Lekki, Lagos, Nigeria |
| info@bluorchidaesthetics.com | |
| +234 915 462 2221 |
Where this policy says we, it means that business. Where it says you, it means anyone who visits this site or places an order. We are the data controller, which means we decide what is collected and why, and we are accountable for it.
What we collect
When you place an order
Your name, email address, phone number, delivery address, what you ordered, and any delivery notes you write.
When you pay
Nothing. Payment is handled entirely by Paystack on their own secure system. Your card number, CVV and PIN never reach this website and we never see them. Paystack returns only a confirmation that the payment succeeded, and a reference number.
When you contact us
Whatever you choose to tell us, by email or on WhatsApp. If you describe a skin concern, that is health information, and we treat it as sensitive. See the section below.
When you simply browse
Your IP address, roughly which city you are in, which device and browser you are using, which pages you looked at and how long you stayed. This arrives through cookies and similar technology, and it is used to understand how the site performs rather than to identify you personally.
What we never ask for
We do not collect your BVN, your NIN, your date of birth or your bank account details. If anything on this site ever asks you for those, it is not us. Close the page and tell us.
Why we collect it
Under the Nigeria Data Protection Act 2023 we must have a lawful reason for processing your information. Ours are:
| What we do | Why we are allowed to |
|---|---|
| Process and deliver your order | Necessary to perform our contract with you |
| Email you about your order | Necessary to perform our contract with you |
| Answer your questions | Our legitimate interest in running the business |
| Prevent fraud and keep the site secure | Legitimate interest, and legal obligation |
| Keep accounting and tax records | Legal obligation |
| Send you marketing | Your consent, withdrawable at any time |
| Measure our ads and site performance | Your consent, given in the cookie banner |
| Discuss your skin during a consultation | Your explicit consent |
You are never required to accept marketing in order to buy. The two are separate and always will be.
Skin and health information
If you use your consultation credit, or describe a skin concern to our team, you are sharing health information. That is a special category of personal data and we treat it accordingly.
- It is seen only by the clinical team who need it in order to advise you.
- It is never used for advertising, and never shared with Meta, Google or any other advertising platform.
- It is held under the same confidentiality obligations that apply to BluOrchid's clinical practice.
- Before and after photographs are never used publicly without separate, specific, written consent, and that consent can be withdrawn at any time.
Who we share it with
We do not sell your information. We share it only with the companies that make the store work, and only with what they need.
| Who | What they receive |
|---|---|
| Paystack | Your name, email and the amount, to take the payment |
| Our delivery partners | Your name, phone number and delivery address, to bring you your box |
| Our email service provider | Your name and email, to send order emails and, with consent, marketing |
| Google Analytics | Anonymised usage data |
| Meta | Hashed or anonymised event data, only if you accept advertising cookies |
| Our hosting provider | Whatever is stored on the site, in order to host it |
| Our accountants, and regulators or law enforcement where legally required | Only what is required |
We use more than one delivery partner, and which one carries your order depends on where you are. Some of the companies above store data outside Nigeria. Where that happens we rely on the transfer safeguards permitted under the Nigeria Data Protection Act 2023, and we only use providers who commit to an adequate standard of protection.
How long we keep it
| What | How long |
|---|---|
| Order and transaction records | Six years, for tax and accounting |
| Marketing contact details | Until you unsubscribe, then a suppression record so we do not contact you again by mistake |
| Consultation and skin notes | In line with BluOrchid's clinical records policy |
| Website analytics | Fourteen months |
| Customer service messages | Two years |
Your rights
Under the Nigeria Data Protection Act 2023 you can ask us to:
- Show you what we hold about you
- Correct anything that is wrong
- Delete it, where we are not legally required to keep it
- Stop using it for a particular purpose
- Send you a copy in a portable format
- Withdraw consent you gave earlier, including for marketing
Email info@bluorchidaesthetics.com and we will respond within 30 days. There is no charge. We may ask you to confirm your identity first, so that nobody else can request your information by pretending to be you.
If you are not satisfied with how we have handled it, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng.
Cookies
Cookies are small files a website stores on your device.
Necessary cookies keep your basket and your checkout session working. The site cannot function without them, so they are always on.
Analytics and advertising cookies tell us how the site is performing and let us measure our advertising. These run only if you accept them in the cookie banner, and you can change your mind at any time using the cookie link in the footer.
You can also block or delete cookies in your browser settings. Blocking necessary cookies will stop checkout from working.
Security
The site runs over an encrypted connection. Payment is handled by Paystack, who are PCI DSS certified. Access to customer records is limited to the staff who need it.
No system is perfect. If a breach ever occurs that puts you at risk, we will tell you and the Nigeria Data Protection Commission, as the law requires.
Children
This store is not intended for anyone under 18 and we do not knowingly collect information from children. If you believe a child has given us their information, email us and we will delete it.
Changes
If this policy changes we will update the date at the top. If the change is significant, we will tell you directly.
Contact
WhatsApp +234 915 462 2221
Plot 113, beside Medplus Pharmacy, Hakeem Dickson, Lekki Phase 1, Lekki, Lagos