NaijaStay Technologies Limited (“NaijaStay,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our platform, mobile application, and website. It complies with the Nigeria Data Protection Act (NDPA) 2023 and applicable international data protection standards.

By using NaijaStay, you consent to the data practices described in this policy. If you do not agree with any part of this policy, you must discontinue use of the platform immediately.

We use your personal data for the following purposes:

• Platform Operations: To create and manage your account, process bookings and payments, facilitate communication between guests and hosts, and provide customer support.
• Identity Verification: To verify your identity through our KYC process as required by Nigerian law and our Terms of Service.
• Fraud Prevention: To detect, prevent, and investigate fraudulent activity, unauthorized transactions, and violations of our Terms of Service.
• Legal Compliance: To comply with applicable laws, regulations, and lawful requests from law enforcement and regulatory authorities, including activation of the Break-Glass protocol as described in our Terms of Service.
• Service Improvement: To analyze usage patterns, improve our platform, develop new features, and personalize your experience.
• Marketing: With your consent, to send promotional communications about our services, special offers, and platform updates. You may opt out at any time.

Under the NDPA 2023, we process your personal data on the following legal bases:

• Consent: Where you have given explicit consent (e.g., for marketing communications, biometric data processing).
• Contractual Necessity: Where processing is necessary to perform our obligations under our Terms of Service (e.g., processing bookings, verifying identity).
• Legal Obligation: Where processing is required to comply with Nigerian law (e.g., anti-money laundering checks, reporting to law enforcement).
• Legitimate Interests: Where processing is necessary for our legitimate interests (e.g., fraud prevention, platform security, service improvement), provided your fundamental rights are not overridden.

We may share your personal data with the following categories of recipients:

• Hosts and Agents: Limited information necessary to facilitate bookings (name, contact details, booking dates). Your NIN and biometric data are never shared with hosts.
• Service Providers: Third-party vendors who help us operate our platform, including payment processors (Paystack, Flutterwave), identity verification services (QoreID), cloud hosting, and analytics providers.
• Law Enforcement: Where required by law or where a valid trigger condition under the Break-Glass protocol has been met (as detailed in our Terms of Service, Article IV).
• Regulatory Authorities: NIMC, FCCPC, or other regulatory bodies where required by Nigerian law.
• Professional Advisors: Lawyers, auditors, and insurers where necessary for legal compliance or dispute resolution.

We do not sell your personal data to third parties for their own marketing purposes.

We implement appropriate technical and organizational measures to protect your personal data, including encryption (at rest and in transit), access controls, regular security assessments, and secure data storage. Verified identity data (NIN, biometrics) are encrypted and stored in a secured identity vault, accessible only under the Break-Glass protocol conditions.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by Nigerian law. Account data is retained for the duration of your account plus six (6) years to comply with legal and regulatory obligations. You may request deletion of your data as described in Section 7 below.

NaijaStay uses cookies and similar tracking technologies to enhance your experience, analyze platform usage, and enable certain functionality. You can control cookie preferences through your browser settings. Essential cookies are required for the platform to function properly; disabling them may affect your ability to use certain features. We do not use cookies for targeted advertising purposes at this time.

Under the Nigeria Data Protection Act (NDPA) 2023, you have the following rights regarding your personal data:

• Right to be Informed: To know what personal data we collect and how we use it (this policy).
• Right of Access: To request a copy of the personal data we hold about you.
• Right to Rectification: To request correction of inaccurate or incomplete data.
• Right to Erasure: To request deletion of your personal data, subject to legal obligations requiring retention.
• Right to Restrict Processing: To request restriction of processing in certain circumstances.
• Right to Data Portability: To receive your data in a structured, commonly used format.
• Right to Object: To object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: To withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact our Data Protection Officer at privacy@naijastay.com.ng. We will respond to your request within the timeframe required by the NDPA 2023.