Privacy Policy

Duke Music • dukemusic.net

Effective Date: 11 April 2026

Operated by: Arahastores Havuna Ent. Ltd.

Preamble & Introduction

This Privacy Policy ("Policy") is published by Arahastores Havuna Ent. Ltd. ("the Company," "we," "us," or "our"), the registered legal entity that owns and operates Duke Music, accessible at dukemusic.net (the "Platform"). This Policy explains who we are, what personal data we collect from you, why we collect it, how we use it, who we share it with, how long we keep it, how we protect it, and what rights you have over it.

This Policy applies to all Users, visitors, registered account holders, and purchasers who interact with the Platform in any capacity. It covers data collected directly through the Platform and, where applicable, data received from third-party services integrated with the Platform.

IMPORTANT: Duke Music is a globally accessible platform operated from the Federal Republic of Nigeria. Your data may be processed in Nigeria and in other countries where our service providers are located. This Policy is designed to comply with the Nigeria Data Protection Act 2023 and the NDPR 2019.

1. Identity of Data Controller

Legal Entity NameArahastores Havuna Ent. Ltd.
Trading NameDuke Music
Websitedukemusic.net
ContactVia official contact page

3. Personal Data We Collect

Data You Provide Directly

  • Identity DataFull name, username
  • Contact DataEmail address
  • Transaction DataPurchased tracks, dates, order references
  • CommunicationsSupport tickets, refund requests

Data Collected Automatically

Technical DataIP address, browser type, OS, device type
Usage DataPages visited, clicks, search queries, download activity

4. Legal Basis for Processing

We process data under the following legal bases as defined by the NDPA 2023:

Contract Performance
Managing accounts, processing purchases, and delivering content.
Legitimate Interest
Fraud prevention, platform improvement, and enforcing terms.
Legal Obligation
Tax compliance and responding to law enforcement requests.
Consent
Optional marketing communications (withdrawable at any time).

5. How We Use Your Data

We use your data to operate the platform, process secure payments via Paystack, protect against fraud, and improve our services.

What We Will NEVER Do

We will NEVER sell your personal data to third parties for marketing. We will NEVER share your data for advertising targeting without explicit consent.

6. Cookies & Tracking

We use strictly necessary cookies for core functionality (login, checkout) and optional analytics cookies to improve performance.

Necessary

Login sessions, shopping cart, and security features.

Analytics

Anonymised navigation patterns and error tracking.

7. Data Sharing

We share data with trusted processors including Paystack (Payments), Web Hosting providers, and Email Delivery services. All processors are contractually bound to protect your data.

8. International Transfers

As a global platform, your data may be processed in Nigeria and other countries where our service providers are located. We implement safeguards to ensure adequate protection levels.

9. Data Retention

Account DataDuration of active account + 2 years.
Transaction Records7 years (Tax & Commercial law).

10. Data Security

We use TLS/HTTPS encryption, password hashing, and secure server infrastructure. Payment data is handled exclusively by PCI DSS compliant providers (Paystack).

11. Breach Response

In the event of a breach, we will notify the NDPC within 72 hours and inform affected users without undue delay if there is a risk to their rights and freedoms.

12. Your Rights

Right of Access
Right to Rectification
Right to Erasure
Right to Restriction
Right to Data Portability
Right to Object
Right to Withdraw Consent

13. Children's Privacy

The Platform is not intended for children under 13. We do not knowingly collect data from children under this age threshold.

17. Nigerian Compliance

Our activities are governed by the Nigeria Data Protection Act 2023 (NDPA). We process data only on lawful grounds defined by this instrument.

18. GDPR Compliance Addendum (EEA & EU Users)

If you are a resident of the European Economic Area (EEA) or the European Union (EU), the General Data Protection Regulation (GDPR) applies to our processing of your personal data. Here is the explicit legal disclosures required under European law:

Your Rights under GDPR

  • Right to be Forgotten (Erasure): Request permanent erasure of your account and related transactional details.
  • Right of Access & Portability: Obtain a portable, machine-readable transcript of your personal data.
  • Right to Rectification: Request correction of inaccurate identifiers immediately.
  • Right to Object & Restrict: Stop computational parsing or processing activities regarding your files.
  • Right to Lodge Complaints: File structural grievances with your local EU Data Protection Authority.

Legal Bases under GDPR Article 6

We process personal data only when we have a lawful basis under Article 6. These are:

  • Consent: When you opt-in to marketing or specific optional profiling.
  • Contract Performance: To deliver music purchases and process functional login profiles.
  • Legitimate Interests: For platform fraud validation and security auditing.
  • Legal Obligation: For taxation logs required by fiscal authorities.

Data Protection Officer Designation

Arahastores Havuna Ent. Ltd. acknowledges that we are exempt as a small business from the mandatory requirement to appoint a formal full-time Data Protection Officer (DPO) under GDPR Article 37. However, the integrity of your privacy remains paramount: all data controller grievances can be directly investigated by contacting our response desk via support@dukemusic.net.

20. Contact & Complaints

For privacy concerns or to exercise your rights, contact us:

support@dukemusic.net

Nigeria Data Protection Commission (NDPC)

www.ndpc.gov.ng

Last updated: 11 April 2026 • Arahastores Havuna Ent. Ltd.