Privacy Policy

GidaHaven operates an online marketplace where buyers and renters find property listed by agents, landlords and property companies in Abuja (FCT), Nigeria. In this policy “we”, “us” and “our” mean GidaHaven Tech Limited (RC RC-9816316).

We are the data controller for the personal information described below. We are registered with the Nigeria Data Protection Commission (NDPC) and have a Data Protection Officer. This policy is written to meet our obligations under the Nigeria Data Protection Act 2023 (NDPA).

Questions about this policy or about your data: support@gidahaven.com. Put “Data Protection Officer” in the subject to reach our Data Protection Officer.

Account information. When you create an account we collect your name, and an email address, a phone number, or both. Buyers may register with either an email address or a phone number; agents and landlords must provide both so that buyers can reach them. We store your password only as a cryptographic hash and never in a form we can read.

Agent and landlord profiles. If you list property you also give us a display name, the city you operate in, your preferred contact method, and optionally your company name and Corporate Affairs Commission (CAC) registration number.

Identity verification. If you apply to be verified we collect the type and number of a government-issued identity document (National Identification Number, driver’s licence, international passport or voter’s card). This is sensitive personal information and we collect it only to confirm that you are who you say you are. Of the number we keep only the last four characters. The rest of the request is held for our administrators to review.

ID photo and selfie (manual review, biometric data). If the instant check is not used or cannot confirm you, our team reviews your request by hand. For that we ask for a photograph of your ID document and a selfie. A picture of your face is biometric data, which the law treats as sensitive personal information, so we ask for your explicit consent before you upload them. We keep these two images privately: they are stored in access-controlled storage with no public address, can be opened only by our signed-in administrators through our own system, and every time one is viewed it is recorded in our administrator log. We keep them for as long as your account exists, so that we can answer a request from the Nigeria Police Force, the EFCC or another authority, or investigate fraud, with the documents your verification was based on. If you delete your account we keep them for one more year for the same purpose, and then delete them. We do not use them for anything other than checking who you are and those purposes, and we never show them to other users.

Instant identity check (biometric data). You can choose to run an instant check run by our verification partner, QoreID. It takes a photograph of your physical ID document, reads it, and takes a live picture of your face to confirm that a real person is present. A picture of your face used this way is biometric data, which the law treats as sensitive personal information. We ask for your explicit consent before the check starts, and you can decline it: a request that skips or fails the instant check is reviewed by a person instead. QoreID handles the images; we receive and keep only the result of the check (passed or not, and which checks matched), not your photographs, face image or full identity number. Our Verification Policy explains exactly what we do and do not do.

Listings and media. Property details you publish, and the photographs and videos you upload. Listing content is public by design.

Activity on the service. Saved listings, reviews you write, reports you submit about a listing, support conversations with us, and a record of when a contact button (call, WhatsApp or email) is used on a listing or storefront — see section 4.

Messages to our property assistant. If you message our automated assistant on WhatsApp, we keep your WhatsApp number, what you wrote, what it replied, and the search it ran (area, budget, bedrooms). If your number is the phone number on a GidaHaven account, the assistant acts for that account: an agent can start a draft listing or take a listing down, and messaging from that number confirms you hold it, which counts as verifying your phone. Photos or videos you send for a listing are stored like any other listing media. The chat on our website is not linked to you: we keep what was asked and answered, but not who asked.

Security and technical records. We record each sign-in attempt with the email address or phone number used, the IP address it came from, and whether it succeeded. Administrator actions are recorded with the administrator’s identity and IP address. We keep these to detect and block attacks on accounts.

Account status. If our team freezes or bans an account we record that, the reason we gave, the date and which administrator did it. A frozen account keeps all its data but its listings and deals are hidden. A banned account cannot sign in; we keep the account, including any ID photo and selfie, for one year from the ban, so that the ban holds and we can answer a request from the authorities, and then delete it. Buyers and renters can be frozen or banned too: a frozen buyer cannot write reviews or reveal contact details.

The list of banned details. When an account is banned we keep these on a list, so that a new account which looks like the same person is noticed: the email address and phone number; the names on the account (your name and your display name); any CAC registration number; and the type and last four characters of any ID document you gave us, together with your name. We keep no more of an ID number than the last four characters, which is why an ID match on its own proves little.

How it is used. The list is checked when someone signs up, changes the email address or phone number on an account, or applies for verification, and, for existing accounts, at the moment someone is banned. A match never blocks anyone automatically. It flags the account, with the reason, for our administrators, and a person then decides whether to freeze it, ban it, or dismiss the flag. We do this because a match is only a reason to look: many honest people share a name, and an email address or phone number can change hands. Only administrators can see the list or the flags. If you were flagged by mistake, email us.

Why, and on what basis. To prevent fraud, protect other users and keep the marketplace safe. Basis: our legitimate interest in doing so, and compliance with legal obligations. We do not rely on your consent for this, because a ban would mean nothing if the person could withdraw it.

• To provide the service — creating your account, publishing your listings, showing you saved properties, and releasing a lister’s contact details to you when you ask for them. Basis: performance of a contract with you.
• To verify agents and landlords — checking identity and business registration so buyers can tell genuine listers from impostors. Basis: your consent, and our legitimate interest in a trustworthy marketplace.
• To keep accounts secure — rate-limiting sign-in attempts and investigating suspicious activity. Basis: legitimate interest in protecting users.
• To handle reports and disputes — investigating listings reported as fraudulent, misleading or unavailable. Basis: legitimate interest, and compliance with legal obligations.
• To communicate with you — replying to support requests and sending service messages about your account or listings. Basis: performance of a contract.
• To stop banned people returning — freezing and banning accounts, and flagging new accounts and verification requests that match the list of banned details above, for a person to review. Basis: our legitimate interest in preventing fraud and protecting users, and compliance with legal obligations.
• To investigate fraud and cooperate with law enforcement — looking into listings reported as fraudulent, and responding to the Nigeria Police Force (NPF), the Economic and Financial Crimes Commission (EFCC) and the courts when they make a lawful request, or where the law otherwise allows or requires a disclosure. Basis: compliance with legal obligations, the public interest in preventing and prosecuting crime, protection of victims’ vital interests, and our legitimate interest in keeping the marketplace free of fraud.
• To take payment — where you buy a boost, a spotlight or verification. Basis: performance of a contract.

Your listings, including their photographs, videos, location and price, are public. Your public agent profile shows your display name, company name, city, verification status and the reviews buyers have left.

Your contact details are not shown publicly by default. They are released to a buyer when that buyer chooses to reveal them on one of your listings, according to the contact method you selected.

Revealing a lister’s contact details does not tell them who you are, and we do not pass your name, phone number or email to the lister. We do record when a contact button (call, WhatsApp or email) is used on a listing or storefront: which lister, which listing, which method, when, and your account if you are signed in. Only our administrators can see this record, for example to spot abuse. Once you contact a lister by phone, WhatsApp or email you are dealing with them directly, off this platform, and what you share then is between you and them — this policy does not cover it.

Your identity document details are never shown to other users.

We do not sell personal information. We share it only with service providers who process it on our instructions, and only as far as they need to:

• Cloudinary — hosting and delivering listing photographs and videos, and privately storing the ID photo and selfie described above until your request is decided.
• Resend — sending email: verification codes, password resets, support replies and notices about your account and listings.
• Paystack — processing payment for boosts, spotlights and verification. Card details are entered with Paystack directly and are never sent to or stored by us.
• QoreID — our identity verification partner. If you choose the instant check, QoreID captures a photograph of your ID document and a live image of your face (biometric data) and checks them. We receive the result, not the images.
• Meta (WhatsApp) — carrying messages between you and our assistant when you message us on WhatsApp.
• Google (Gemini) and OpenAI — writing some of the assistant’s replies. They receive your message, the listings that match it, and up to your last four messages to the assistant from the past day, but not your phone number.
• Sentry — recording technical errors so we can fix them. We configure it not to receive names, contact details, request contents or session recordings.
• OpenStreetMap — the maps on listing pages are drawn from its servers, which therefore see your IP address when a map loads.
• Our hosting and database providers, which store the data described above.

We may also disclose information where the law requires it, or to establish, exercise or defend a legal claim.

Why this is lawful. We disclose personal data to law enforcement only where the NDPA allows it: where we are legally required to; where it is necessary for the prevention, detection, investigation or prosecution of a crime; to protect someone’s vital interests; or where it is within our legitimate interests and does not override your rights. In those cases we do not need the person’s consent.

How a disclosure is handled:

• A written request first. We act on a written request from the investigating agency, or a court order, that says which crime and which person it concerns. Where a victim reports a crime to us, we may tell the police what we hold, where the law allows it.
• Only what is needed. We disclose only what is needed to identify and locate the person, from the list above. We do not hand over unrelated messages or other users’ data.
• A record. We record every disclosure in a log that our administrators cannot edit or delete: the agency, the officer’s name, rank and badge or service number, the reference on their request, when it reached us and when we handed the details over, the legal basis, who the details were about, exactly what was released, and who recorded it. Only our superadministrators can see the log. A mistake is put right with a new entry, never by changing an old one.

Some of the providers above store and process data on servers outside Nigeria. Where that happens we rely on the safeguards permitted by section 41 of the NDPA, including contractual protections requiring the provider to protect the data to a standard comparable to Nigerian law. You may ask us for details of the safeguards that apply.

• Account and profile data — until you delete your account.
• ID photo and selfie — while your account exists, and for one year after you delete it, in case an authority asks for them; then deleted.
• Messages to our property assistant — 180 days, then deleted.
• Listings and uploaded media — until you delete the listing or your account, at which point the files are removed from our media provider as well.
• Why a listing was deleted — when an agent deletes a listing we ask why (sold or rented through GidaHaven, sold or rented another way, taken off the market, or another reason) and keep that answer with a short summary of the listing: its type, area, price and how long it was listed. This is how we count how many properties sell or let. It is tied to your account while the account exists, and when you delete your account that link is removed and it stays only as an anonymous count.
• Sign-in records — 30 days, for security monitoring, then deleted.
• Banned details, and the banned account — one year from the ban, then deleted automatically. If a ban is lifted earlier, the banned details are deleted at once. When a banned account is deleted at the end of the year its ID photo and selfie follow the rule above (one more year, then deleted).
• Disclosure log — kept for as long as we need it to show that each disclosure was lawful.
• Email opt-outs — if you unsubscribe from bulletins, your email address is kept on an opt-out list so that we do not email you them again. Account and security emails are not affected.
• Flags on an account — until an administrator dismisses the flag or the account is deleted.
• Records of contact-button use — kept with the listing. If you delete your account, they stay but no longer point to you.
• Administrator action records and records of transactions — kept longer where we need them for accountability, dispute resolution or to meet a legal or tax obligation.

Under the NDPA you may ask us to:

• give you a copy of the personal information we hold about you;
• correct information that is wrong or incomplete;
• delete your information, subject to records we must keep by law;
• restrict or object to how we use your information;
• provide your information in a portable format; and
• withdraw consent at any time, where we rely on consent. Withdrawing consent does not affect processing already carried out.

You can delete your account yourself at any time from Account Settings. Doing so immediately and permanently removes your account, your profile, your listings and the photographs and videos attached to them, your saved properties, your reviews and your support conversations.

You cannot delete an account while it is frozen, because that would put our enquiries out of reach; email us and we will explain. A banned account is not deleted on request: it, and the banned details, are deleted automatically one year after the ban, because the ban would otherwise have no effect. This is the one place we rely on our legitimate interest in preventing fraud over your right to erasure.

Some records do not carry your account with them and therefore remain after deletion: any ID photo and selfie you uploaded for verification (kept for one year, then deleted), sign-in records keep the email address or phone number used and the IP address, and where an administrator acted on your account, the record of that action is kept. We keep these to resolve disputes, to investigate fraud and to meet our own legal obligations. Ask us if you want to know what remains.

To exercise any other right, contact support@gidahaven.com. We will respond within the time the NDPA allows. If you are not satisfied with our response you may complain to the Nigeria Data Protection Commission.

Passwords are hashed. Sessions are held in signed, encrypted, HTTP-only cookies. Repeated failed sign-in attempts are blocked automatically. Access to administrative tools is restricted to staff accounts and administrative actions are recorded.

No service can promise perfect security. If a breach occurs that is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission and affected users as the NDPA requires.

The service is not intended for anyone under 18 and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.

We use strictly necessary encrypted session cookies to authenticate users, local storage to remember your interface preferences, and opt-in diagnostic metrics to maintain platform health. We do not use advertising trackers or cross-site surveillance cookies.

For a full catalog of identifiers, retention durations, and your rights to manage or revoke consent, please view our dedicated Cookie Policy.

If we change this policy we will update the effective date at the top of this page, and tell you where the change materially affects your rights. Continuing to use GidaHaven after a change means you accept the updated policy.

See also our Terms of Use, Cookie Policy and Boost & Spotlight Refund Policy.