Privacy Policy

1. Data Controller Information

Kordex Solutions Limited (trading as NaijaRent) is the Data Controller responsible for your personal data. Our Data Protection Officer (DPO) can be reached at:

• Email: dpo@naijarent.net
• Address: Suite 8, Crown Plaza, Utako, Abuja, FCT, Nigeria
• Company: Kordex Solutions Limited (RC 9438853)

2. Personal Data We Collect

We collect the following categories of personal data:

• Identity Data: Full name, profile photo, National Identification Number (NIN) or BVN where provided for verification.
• Contact Data: Email address, phone number, WhatsApp number, mailing address.
• Account Data: Username, password (hashed), account role (user/landlord/agency/admin), account creation date.
• Property Data: Property listings, images, addresses, coordinates, prices and documents you upload (e.g. C of O, survey plans).
• Transaction Data: Records of enquiries, messages exchanged on the platform and subscription payments.
• Technical Data: IP address, browser type and version, device identifiers, time zone, pages visited, and session cookies.
• Usage Data: Search history, saved properties, interaction logs and AI assistant queries.
• Communications Data: Messages sent through the platform between users, landlords and agencies.
• Diagnostic Data: When the app or website hits an error or crashes, a technical report of what went wrong: the error and where in our code it happened, your device model, operating system and app or browser version, the screen or page you were on, and your country (worked out from your connection; the IP address itself is not stored). On the mobile app the report also carries a random installation identifier and, if you are signed in, your internal NaijaRent account number (never your name, email or phone number). We also record how long a sample of page loads and requests take.

We do not collect sensitive personal data (as defined under Section 30 of the NDPA 2023) such as biometric data, health records or political opinions unless explicitly consented to and legally required.

3. Legal Basis for Processing

Under the NDPA 2023 and NDPR 2019, we process your personal data on the following lawful bases:

• Contractual Necessity: To create and manage your account and provide the platform services you have requested.
• Legitimate Interests: To improve our platform, prevent fraud, ensure platform security, and conduct analytics — provided these do not override your rights.
• Consent: For marketing communications and optional data sharing. You may withdraw consent at any time.
• Legal Obligation: To comply with applicable Nigerian laws including the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, EFCC Act, and directives from NDPC.

4. How We Use Your Personal Data

• To register and manage your NaijaRent account and maintain session security.
• To display and facilitate property listings, enquiries and direct communications.
• To verify property listings and, where applicable, verify landlord and agency identities.
• To process subscription payments and issue receipts.
• To send transactional emails (account verification, password reset, listing updates) via Resend.
• To power our AI property assistant (queries are processed via Google Gemini API and are not stored beyond the session).
• To answer property searches you send to our WhatsApp assistant.
• To send push notifications about new messages and enquiries.
• To show property locations on maps and turn listing addresses into map coordinates.
• To automatically screen uploaded photos for explicit content and check that listing photos show the property.
• To detect, diagnose and fix crashes, errors and slow performance in the app and website.
• To prevent fraudulent listings and protect users from property scams.
• To comply with requests from Nigerian law enforcement or regulatory authorities where legally required.
• To send marketing communications, where you have opted in, which you may unsubscribe from at any time.

5. Data Sharing and Third Parties

We share personal data only in the following circumstances:

• Resend (email delivery): Your email address is shared with Resend Inc. solely to deliver transactional emails. Resend processes data under appropriate data processing agreements.
• Cloudflare Inc.: Our infrastructure provider. Data is stored on Cloudflare D1 servers in accordance with Cloudflare's data processing addendum. Cloudflare may store data in EU/US jurisdictions — we rely on Standard Contractual Clauses (SCCs) for such transfers.
• Google LLC: AI query processing via Google Gemini API. No personally identifiable property enquiry content is intentionally sent to this API. Google also provides push notifications (Firebase Cloud Messaging, which receives your device's push token and the notification text), maps and address lookup (Google Maps Platform, which receives listing addresses and coordinates), and automated photo screening (Google Cloud Vision, which receives the photos you upload).
• Meta Platforms, Inc. (WhatsApp): If you message our WhatsApp assistant, your WhatsApp number and messages are processed by Meta to deliver them.
• Groq, Inc.: Backup AI provider for the WhatsApp assistant. It receives the text of your search message only when Google Gemini is unavailable.
• Sentry (Functional Software, Inc.): Error and crash monitoring. Sentry receives the Diagnostic Data described in Section 2, stores it in its European Union data region (Germany) and deletes it after 30 days. We have configured it not to collect cookies, request or form contents, or IP addresses, and we do not send it your name, email address or phone number.
• Other Platform Users: Landlord/seller contact details are visible to prospective buyers or tenants as part of the listing. You consent to this by publishing a listing.
• Legal Authorities: We may disclose data to the Nigeria Police Force, EFCC, NDPC, FCCPC or any court of competent jurisdiction when required by law or valid court order.

We do not sell your personal data to third parties for marketing purposes.

6. Cross-Border Data Transfers

Your data may be transferred to and stored in countries outside Nigeria (including the United States and the European Economic Area) as part of our infrastructure services. Where such transfers occur, we ensure appropriate safeguards are in place in accordance with Section 43 of the NDPA 2023, including the use of Standard Contractual Clauses (SCCs) or transfers to countries with adequate data protection levels as recognised by the NDPC. Error and crash reports are stored in the European Union (Germany).

7. Data Retention

We retain your personal data for as long as:

• Your account is active on the platform.
• Required to fulfil the purposes set out in this policy.
• Required by Nigerian law (e.g., financial records must be kept for a minimum of 6 years under the Companies Income Tax Act).

Upon account deletion, we will delete or anonymise your personal data within 30 days, except where retention is required by law or for the resolution of disputes. Error and crash reports are deleted automatically after 30 days.

8. Your Rights Under the NDPA 2023

As a data subject under the Nigerian Data Protection Act 2023, you have the following rights:

• Right to be Informed: To know what data we hold and how we use it.
• Right of Access: To obtain a copy of your personal data we hold.
• Right to Rectification: To correct inaccurate or incomplete personal data.
• Right to Erasure: To request deletion of your data where no legal basis for retention exists.
• Right to Restrict Processing: To limit how we use your data in certain circumstances.
• Right to Data Portability: To receive your data in a structured, machine-readable format.
• Right to Object: To object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact our DPO at dpo@naijarent.net. We will respond within 30 days in accordance with Section 34 of the NDPA 2023. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

9. Cookies and Tracking

We use strictly necessary cookies to maintain your session and keep you logged in. We do not use third-party advertising cookies or cross-site tracking, and our error monitoring does not set cookies. You may disable cookies in your browser settings, but this may affect platform functionality (e.g., you may not be able to stay logged in).

10. Security

We implement technical and organisational measures to protect your personal data, including: TLS/HTTPS encryption in transit, salted one-way password hashing, access controls, and regular security reviews. However, no internet transmission is completely secure. In the event of a data breach that poses a high risk to your rights and freedoms, we will notify affected users and the NDPC within 72 hoursas required by Section 40 of the NDPA 2023.

11. Children's Privacy

NaijaRent is not directed at persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal data, please contact us at dpo@naijarent.net and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Where material changes are made, we will notify you by email (to your registered address) or via a prominent notice on the platform at least 14 daysbefore the changes take effect. Continued use of the platform after that date constitutes acceptance of the updated policy.

13. Governing Law

This Privacy Policy is governed by the laws of the Federal Republic of Nigeria, including the Nigerian Data Protection Act (NDPA) 2023, the Nigerian Data Protection Regulation (NDPR) 2019, the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, and all regulations issued by the NDPC.