privacy policy

IMNY is a womenswear brand based in Accra, Ghana. For the purposes of the Data Protection Act, 2012 (Act 843), IMNY is the data controller for the personal data described in this policy. That means we decide how and why it is used, and we're responsible for protecting it.

For any privacy question or request, contact us at our contact page.

Data you give us

• When you order: your full name, email address, phone number, delivery address (street, area, city, region and GhanaPost digital address if you give one), the items you buy and any discount code you use.
• When you pay: payments are made on Paystack's secure checkout. We receive the payment reference, amount, status, payment channel (for example mobile money or card) and, for cards, the card type and last four digits. We never receive or store your full card number, CVV, mobile money PIN or bank login.
• When you contact us: your email address and your message.
• When you leave a review: your first name, city (optional), email address, rating and review.
• When you join the newsletter: your email address.

Data collected automatically

• Technical data: your IP address, browser and device type, and the pages you request. We use your IP address only to protect the site from abuse (for example, limiting repeated checkout or form attempts), and our hosting provider keeps short-lived server logs for security and troubleshooting.
• Order history: status updates on your order (confirmed, shipped, delivered, refunded) and any notes our team adds to handle it.

We don't ask for or collect sensitive data such as health, religion, ethnicity or ID numbers.

• To process, deliver and support your order (including refunds, returns and exchanges). We need this to perform our contract with you.
• To send order messages such as your order confirmation, status link and delivery updates. These are part of the service, not marketing.
• To prevent fraud and keep the site secure, for example by checking payments with Paystack and limiting abusive traffic. This is in our legitimate interest and yours.
• To keep accounting and tax records as Ghanaian law requires. This is a legal obligation.
• To answer your messages and publish your review. We do this because you asked us to; reviews are only published after we check them.
• To send our newsletter about new drops and restocks, only with your consent. You can withdraw consent at any time.

We share personal data only with trusted service providers who help us run the shop, only the data each one needs, and only for the purposes above. They act on our instructions and must keep your data secure and confidential.

• Paystack (payment processing, refunds and fraud checks). Paystack handles your payment under its own privacy policy.
• Delivery riders and courier companies, who receive your name, phone number and delivery address.
• Supabase (secure database that stores orders and messages) and Vercel (website hosting).
• Resend (sends our emails) and Arkesel (sends order text alerts to our team).

We may also share data if the law requires it (for example, a valid request from a court, the police or the Ghana Revenue Authority), or to protect our rights or the safety of others. If IMNY is ever sold or merged, customer data may transfer to the new owner under this same policy.

We never sell, rent or trade your personal data, and we don't share it with advertisers.

Some of our service providers store or process data on servers outside Ghana, including in the European Union and the United States. Where this happens, we use reputable providers that protect data with encryption, access controls and contractual safeguards, so your data receives a level of protection consistent with Ghanaian law.

• Orders and payment records: 6 years from the date of the order, as required for tax and accounting.
• Contact messages: up to 2 years after we've dealt with them.
• Reviews: for as long as they're published, or until you ask us to remove them.
• Newsletter email: until you unsubscribe.
• IP addresses used for abuse protection: deleted automatically within 24 hours.

We keep this to the minimum the shop needs to work. We don't use advertising cookies, tracking pixels or third-party analytics.

• Your bag is saved in your own browser (local storage) so it's still there when you come back. It never leaves your device until you check out.
• An order cookie is set after checkout so you can return to your order confirmation. It expires after 7 days.
• Paystack may set its own cookies on its checkout page for security and fraud prevention.

You can clear these at any time in your browser settings; the shop will still work, but your bag will be emptied.

• The whole site runs over an encrypted connection (HTTPS), and data is encrypted in storage.
• Card and mobile money details are entered on Paystack, which is PCI DSS certified; they never touch our servers.
• Only authorised IMNY staff can see customer details, and every staff sign-in requires a password and a two-step code.
• Order status links are private and can't be guessed.

Under the Data Protection Act, 2012 (Act 843), you have the right to:

• ask whether we hold personal data about you and get a copy of it,
• have inaccurate or incomplete data corrected,
• ask us to delete data we no longer have a lawful reason to keep,
• object to, or ask us to stop, processing your data, including any direct marketing,
• withdraw your consent at any time, where we rely on consent (such as the newsletter).

To make a request, contact us at our contact page. We may ask you to confirm your identity (for example, by replying from the email address on your order) before we act on it. We'll respond within 21 days and won't charge you for a reasonable request.

If you're not happy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Data Protection Commission of Ghana.

We only send marketing emails if you join our newsletter. We never add you to it just because you placed an order. To stop receiving it, contact us at our contact page and we'll remove your email straight away.

Our shop is meant for adults. We don't knowingly collect personal data from anyone under 18. If you believe a child has given us their data, contact us and we'll delete it.

If we ever discover a security breach that affects your personal data, we'll notify the Data Protection Commission and contact you as soon as possible, telling you what happened and what we're doing about it.

We may update this policy when our services or the law change. The date at the top shows when it was last updated. If we make a significant change, we'll show a notice on the site. See also our terms of service.