Booking and children's privacy

Who handles your information

Kidz Paint Party Ltd, trading as KidzPaint by Sip and Paint .NG, handles your booking information. Contact sipandpaint.ng@gmail.com with privacy questions.

What we collect and why

For a booking, we collect the parent's name, WhatsApp phone number and email address. For each child, we collect only their first name and age. We also retain chosen sessions, payment references, consent and payment status to organise attendance, handle enquiries and keep payment records. Children do not need accounts.

Parent or guardian consent

The person making a booking must be the parent or authorised guardian and consent to the use of these details for the booking. Booking consent does not authorise marketing or photography. We do not request children's surnames, school details or birth dates in online checkout.

Payments and access

Paystack handles checkout. KidzPaint never stores card numbers, CVVs or PINs. Payment amounts are checked before a booking is marked paid. Booking details are available only to authorised staff. Lovable Cloud provides booking storage and account services. Confirmation pages do not display children's or parents' private details.

Your rights under Nigerian law

The Nigeria Data Protection Act 2023 provides rights relating to your personal data, including access, correction and, where applicable, deletion, objection and withdrawal of consent. Contact us to make a request. Withdrawal does not affect prior lawful processing, and some payment records may need to be retained by law. You may also raise concerns with the Nigeria Data Protection Commission.

How long we keep information

• Children's first names and ages, and the parent's name, phone number and email: kept for 24 months after the last session booked, so we can help with rebookings and questions, then deleted.
• Payment records (amounts, dates, Paystack references, invoices): kept for 6 years, as Nigerian law requires us to keep financial records.
• Unpaid or abandoned bookings: deleted after 90 days.

You can ask us to delete your details sooner. We will do so unless we must keep payment records by law.

Why we use your information

These are the legal bases under the Nigeria Data Protection Act 2023:

• To arrange and run the session you booked: performance of a contract with you.
• To keep payment and tax records: legal obligation.
• To keep bookings and payments secure and prevent fraud: legitimate interest.
• To send marketing or to photograph your child: only with your separate consent, which you can withdraw at any time. Booking alone never counts as this consent.

Who we share it with

• Paystack, which processes payments in Nigeria.
• Lovable Cloud, which stores booking information and may hold it on servers outside Nigeria. Where information leaves Nigeria, we rely on our providers' contractual safeguards and security measures, as the Nigeria Data Protection Act 2023 permits.
• The venue hosting your session receives only what it needs to run it, such as the number of children and their first names.

We never sell your information.

Confirming parent or guardian consent

Before paying, the person booking confirms they are the child's parent or authorised guardian and agrees to the use of these details for the booking. Our team may confirm this at check-in.

If something goes wrong

If a data breach puts your information at risk, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and we will tell affected parents without undue delay where there is a high risk to them.

Contact and requests

Email privacy requests to sipandpaint.ng@gmail.com with the subject "KidzPaint privacy request". We will reply within 30 days. You can also raise a concern with the Nigeria Data Protection Commission.