Effective Date: 11 September 2026
Last Updated: 11 September 2026

This GDPR Compliance Policy explains how BoldThread Africa, operated by BOLD THREAD GRAPH, handles personal information in accordance with applicable data protection principles, including the General Data Protection Regulation (GDPR) and UK GDPR, where these laws apply.

BoldThread Africa operates an e-commerce platform serving customers in Ghana, Nigeria, and other supported locations through:

https://boldthread.africa/

This policy explains our approach to transparency, user data protection, privacy rights, security, and responsible processing of personal information.

1. Our Approach to Data Protection

At BoldThread Africa, we respect customer privacy and aim to process personal information responsibly.

We follow key data-protection principles, including:

  • Processing information fairly and transparently
  • Collecting information only where reasonably necessary
  • Using information for legitimate purposes
  • Keeping information accurate where required
  • Protecting information through appropriate safeguards
  • Retaining information only when reasonably necessary
  • Respecting applicable privacy rights

2. When GDPR or UK GDPR Applies

The GDPR or UK GDPR may apply to certain customers or processing activities, including where:

  • A customer is located in the European Economic Area (EEA)
  • A customer is located in the United Kingdom
  • Personal information is processed in connection with activities covered by GDPR or UK GDPR requirements

GDPR or UK GDPR does not automatically apply to every customer, transaction, or website visitor.

Where these laws apply, BoldThread Africa will provide the protections and rights required by those laws.

3. Information We Process

Depending on how customers use our website, we may process categories of personal information including:

Identity Information

  • Name
  • Customer account details
  • Order information

Contact Information

  • Email address
  • Delivery address
  • Billing address
  • Customer support communication details

Transaction Information

  • Orders placed
  • Products purchased
  • Payment status
  • Refund information
  • Delivery information

Technical Information

  • IP address
  • Browser information
  • Device information
  • Website usage information
  • Cookie information

Customer-Provided Information

This may include information submitted through:

  • Contact forms
  • Reviews
  • Feedback
  • Customer support requests
  • Account updates

4. Lawful Bases for Processing

Where GDPR or UK GDPR applies, we may process personal information based on the following lawful bases:

Contractual Necessity

We may process information where necessary to:

  • Process orders
  • Complete payments
  • Arrange delivery
  • Manage returns and refunds
  • Provide customer-requested services

Consent

We may rely on consent for activities such as:

  • Certain marketing communications
  • Optional cookies
  • Other processing activities requiring permission

Customers may withdraw consent where applicable.

Legal Obligation

We may process information where required to comply with:

  • Tax requirements
  • Accounting obligations
  • Legal requests
  • Regulatory requirements
  • Fraud-prevention obligations

Legitimate Interests

We may process information where necessary for legitimate business interests, including:

  • Improving website performance
  • Maintaining security
  • Preventing fraud
  • Managing customer relationships
  • Protecting legal rights

We balance these interests against individual privacy rights.

5. Data Protection Principles

Where applicable GDPR principles apply, we aim to ensure that personal information is:

Lawfully and Fairly Processed

Customers are informed about how their information is collected and used.

Collected for Specific Purposes

Information is collected only for clear and legitimate purposes such as orders, support, security, and website operation.

Limited to What Is Necessary

We aim to collect only information reasonably required for the relevant service.

Accurate

Customers may request correction of inaccurate personal information.

Securely Stored

We apply reasonable security measures to protect personal information.

Retained Appropriately

Information is retained only for as long as reasonably necessary or legally required.

6. User Data Protection

We take reasonable steps to protect customer information from:

  • Unauthorised access
  • Loss
  • Misuse
  • Unlawful disclosure
  • Alteration
  • Destruction

Security measures may include:

  • Secure website connections
  • Access controls
  • Security monitoring
  • System updates
  • Backup procedures
  • Appropriate third-party security measures

No online system can guarantee complete security, but we work to reduce risks through reasonable safeguards.

7. Data Subject Rights Under GDPR

Where GDPR or UK GDPR applies, individuals may have rights including:

Right of Access

You may request information about:

  • Whether we process your personal data
  • What information we hold
  • How we use it

Right to Rectification

You may request correction of inaccurate or incomplete personal information.

Right to Erasure

You may request deletion of personal information where:

  • It is no longer necessary
  • Consent has been withdrawn and no other lawful basis applies
  • Processing was unlawful
  • Applicable law requires deletion

This right is subject to legal exceptions.

Right to Restrict Processing

You may request that certain processing activities are limited in specific circumstances.

Right to Object

You may object to certain processing activities, including certain direct marketing activities.

Right to Data Portability

Where applicable, you may request certain personal information in a structured and commonly used format.

Right to Withdraw Consent

Where processing relies on consent, you may withdraw consent at any time.

Withdrawal does not affect processing that occurred before withdrawal.

Right to Lodge a Complaint

You may have the right to complain to an applicable data protection authority.

8. Cookie and Tracking Compliance

BoldThread Africa may use cookies and similar technologies for:

  • Website operation
  • Shopping-cart functionality
  • Security
  • Preferences
  • Analytics
  • Marketing where permitted

Where required by GDPR or UK GDPR, we will seek consent before using non-essential cookies.

Customers may manage cookie preferences through available website controls or browser settings.

More information is available in our Cookie Policy.

9. Marketing Compliance

Where GDPR or UK GDPR applies, we aim to ensure that marketing communications follow applicable consent and privacy requirements.

Customers may:

  • Choose whether to receive promotional messages
  • Withdraw marketing consent
  • Unsubscribe from promotional emails

Essential communications such as:

  • Order confirmations
  • Payment updates
  • Delivery notifications
  • Refund communications
  • Security messages

may still be sent because they are necessary to provide requested services.

10. Third-Party Processors

We may use trusted service providers that process personal information on our behalf.

These may include providers involved in:

  • Website hosting
  • Payment processing
  • Delivery services
  • Analytics
  • Email communication
  • Security
  • Customer support
  • Technical services

Where GDPR or UK GDPR applies, relevant processors may be required to provide appropriate privacy and security protections.

11. International Data Transfers

Some service providers may process personal information outside the country where it was collected.

Where GDPR or UK GDPR applies, international transfers will be handled using appropriate safeguards where required.

These safeguards may include:

  • Adequacy decisions
  • Standard Contractual Clauses (SCCs)
  • Other recognised legal transfer mechanisms

12. Data Retention

We retain personal information only for as long as reasonably necessary for:

  • Order processing
  • Customer support
  • Returns and refunds
  • Accounting requirements
  • Fraud prevention
  • Legal obligations
  • Dispute management

When information is no longer required, it may be securely deleted, anonymised, or otherwise handled according to applicable requirements.

13. Children’s Data

BoldThread Africa does not intentionally collect personal information from children in violation of applicable laws.

Customers must meet the applicable legal requirements for entering into online transactions in their location.

Where a child’s information is processed under applicable law, appropriate safeguards will be applied.

14. Data Breach Management

In the event of a suspected personal-data breach, we will take reasonable steps to:

  • Investigate the incident
  • Identify affected information
  • Limit further risk
  • Improve security measures
  • Provide notifications where legally required

Where GDPR or UK GDPR applies, required notifications will be made within applicable legal timelines.

15. Ghana Data Protection Compliance

For customers and operations connected with Ghana, personal information is handled in accordance with applicable Ghanaian data-protection requirements, including the Data Protection Act, 2012 (Act 843) where applicable.

The principles of transparency, lawful processing, security, and responsible data handling guide our approach.

16. Nigeria Data Protection Compliance

For customers and operations connected with Nigeria, personal information is handled in accordance with applicable Nigerian data-protection requirements, including the Nigeria Data Protection Act, 2023 where applicable.

We aim to maintain appropriate safeguards for customer information and respect applicable privacy rights.

17. Privacy Requests

Customers may submit privacy-related requests, including:

  • Access requests
  • Correction requests
  • Deletion requests
  • Marketing withdrawal requests
  • Cookie preference requests
  • Other privacy concerns

Requests should be submitted using the contact details below.

We may request reasonable verification information before completing certain requests.

18. Changes to This GDPR Compliance Policy

We may update this GDPR Compliance Policy when:

  • Our data practices change
  • New technologies are introduced
  • Legal requirements change
  • Business operations change

The updated version will be published on our website with a revised Last Updated date.

19. Contact Information

Website Name: BoldThread Africa

Website: https://boldthread.africa/

Info Email: info@boldthread.africa

Support Email: support@boldthread.africa

Ghana Address

G3-021-6261, House Number C141/13,
Al Walid Street, Near Maamobi Polyclinic,
Maamobi, Ayawaso East,
Greater Accra, Ghana

Nigeria Address

Block 252, Flat 4,
313 Road, Phase 2,
Kubwa, FCT, Nigeria