1. INTRODUCTION

This Privacy Policy is issued pursuant to the provisions of the Nigeria Data Protection Act, 2023 (“NDPA”), the General Application and Implementation Directive, 2025 (“GAID”), and other applicable laws and subsidiary legislation governing the processing of personal data in Nigeria. It delineates the principles, obligations, and procedures adopted by Onyeishi Uche Chiekwe Real Property Service Ltd (“the Agency”) in the collection, processing, storage, transfer, and protection of personal data obtained through its website, mobile applications, and affiliated platforms.

2. LEGAL FRAMEWORK

This Policy is governed by the following instruments:

• Nigeria Data Protection Act, 2023
• General Application and Implementation Directive, 2025
• Cybercrimes (Prohibition, Prevention, etc.) Act, 2015
• Consumer Protection Framework, 2019 (Central Bank of Nigeria)
• Freedom of Information Act, 2011
• Credit Reporting Act, 2017
• Money Laundering (Prevention and Prohibition) Act, 2022
• Companies and Allied Matters Act, 2020
• Nigerian Communications Commission Data Protection Guidelines
• Guidelines for the Management of Personal Data by Public Institutions (NDPC)

3. DEFINITIONS

Unless the context otherwise requires:

• “Personal Data” refers to any information relating to an identified or identifiable natural person.
• “Data Subject” means any natural person whose personal data is processed by the Agency.
• “Processing” includes any operation performed on personal data, whether by automated or manual means.
• “Controller” refers to the Agency that determines the purpose and means of processing personal data.
• “Processor” means any third party that processes personal data on behalf of the Controller.

4. LAWFUL BASIS FOR PROCESSING

The Agency shall process personal data only where a lawful basis exists, including:

• The express, informed, and unambiguous consent of the Data Subject;
• The necessity of processing for the performance of a contract to which the Data Subject is a party;
• Compliance with a legal obligation imposed by statute or regulatory directive;
• The pursuit of the Agency’s legitimate interests, provided such interests do not override the fundamental rights and freedoms of the Data Subject.

5. CATEGORIES OF PERSONAL DATA

The Agency may collect and process the following categories of personal data:

• Identity data: NIN, full name, date of birth, gender, nationality
• Contact data: email address, telephone number, residential address
• Transactional data: property preferences, financial information, payment records
• Technical data: IP address, browser type, device identifiers
• Location data and behavioral analytics

6. PURPOSE OF PROCESSING

Personal data shall be processed for the following purposes:

• Facilitation of property listings, sales, leases, and related transactions
• Verification of identity and compliance with anti-money laundering obligations
• Communication with clients and prospective clients
• Marketing and promotional activities (subject to opt-in consent)
• Website analytics and service optimization
• Compliance with statutory obligations and regulatory directives

7. DATA SHARING AND DISCLOSURE

The Agency may disclose personal data to third parties under lawful conditions, including:

• Licensed real estate agents and brokers
• Legal and financial advisors
• Regulatory bodies such as the NDPC, EFCC, CAC, and NFIU
• Technology service providers, including hosting and analytics platforms
• Payment processors and escrow agents

All third-party processors shall be bound by data protection agreements in accordance with Section 39 of the NDPA.

8. CROSS-BORDER DATA TRANSFERS

Where personal data is transferred outside the territorial jurisdiction of Nigeria, the Agency shall ensure that:

• The receiving jurisdiction offers an adequate level of data protection;
• Appropriate safeguards are implemented, including standard contractual clauses and binding corporate rules;
• The transfer complies with Sections 41–43 of the NDPA.

9. DATA RETENTION

Personal data shall be retained only for the duration necessary to fulfill the purpose of collection or as required by law. Upon expiration of the retention period, data shall be securely deleted or anonymized in accordance with Section 44 of the NDPA.

10. RIGHTS OF DATA SUBJECTS

Data Subjects are entitled to the following rights under the NDPA:

• Right of access to personal data
• Right to rectification of inaccurate data
• Right to erasure (“right to be forgotten”)
• Right to object to processing
• Right to data portability
• Right to lodge a complaint with the Nigeria Data Protection Commission (NDPC)

Requests may be submitted to the designated Data Protection Officer via the contact details provided herein.

11. SECURITY MEASURES

The Agency shall implement appropriate technical and organizational measures to safeguard personal data against unauthorized access, alteration, disclosure, or destruction, including:

• Secure Socket Layer (SSL) encryption
• Role-based access controls
• Regular vulnerability assessments
• Incident response and breach notification protocols

12. COOKIES AND TRACKING TECHNOLOGIES

Our website utilizes cookies and similar technologies to enhance user experience and collect usage data. Users may manage cookie preferences via browser settings.

13. AMENDMENTS

This Privacy Policy may be amended from time to time to reflect changes in legal requirements or data processing practices. Updates shall be published on our website, and continued use of our services shall constitute acceptance of the revised terms.

14. GOVERNING LAW AND JURISDICTION

This Privacy Policy shall be governed by and construed in accordance with the laws of the Federal Republic of Nigeria. Any dispute arising from or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts of the Federal Capital Territory, Abuja.