Privacy Policy

OgaLandlord is a property management platform run by [To be supplied: Registered company name], a company registered in Nigeria with registration number [To be supplied: CAC RC number], whose registered office is at [To be supplied: Registered office address].

When we are the data controller. We decide how and why your data is used for your own OgaLandlord account: signing up, signing in, billing, security and our messages to you.

When we are the data processor. Landlords, property managers and agencies use OgaLandlord to manage their properties, tenants, leases and payments. For that data, the organisation that holds the account is the data controller. We process it on its behalf to provide the service. If you are a tenant or guarantor and want to use your rights over that data, you can contact the organisation directly or contact us and we will pass your request on.

Data Protection Officer

Our Data Protection Officer is [To be supplied: Data Protection Officer name]. You can reach them at [To be supplied: Data Protection Officer email].

Registration with the Nigeria Data Protection Commission: [To be supplied: NDPC registration details].

Account and profile

• Your name, email address, phone number and the type of account you register for.
• Your password. We never store the password itself, only a one-way bcrypt hash of it.
• The organisations you belong to and your role in each one.
• Profile details you choose to add: photo, date of birth, gender, a short bio, address, city, state, country, postal code, nationality, and an ID document type and number.
• Whether and when your email address and phone number were confirmed.
• If you turn on two-factor authentication: the secret for your authenticator app and hashed backup codes.

Identity verification (KYC)

If you choose to verify your identity, you give us your National Identification Number (NIN) or Bank Verification Number (BVN). We send it to our verification provider, Smile ID, together with your first name, last name, date of birth and phone number. We keep:

• a masked copy of the ID number for each verification attempt;
• the response Smile ID sends back about the check;
• your verification status, the date you were verified and Smile ID's job reference.

Tenancy and property data

Landlords, managers, agents and tenants add data while using the service, including:

• properties, apartments, rent amounts, expenses and owner statements;
• tenant details: name, email, phone numbers, ID type and number, emergency contact, occupation and employer;
• guarantor details: name, contact details, relationship to the tenant, address, employer details and ID type and number;
• leases, rent payments, invoices and receipts;
• maintenance issues and the photos attached to them;
• rental applications: employment, income range, household details, previous landlord, references and supporting documents;
• agent profiles, referrals and commissions;
• reviews and ratings, and trust scores worked out from verifications and reviews;
• marketplace enquiries, saved listings and saved searches.

Files you upload

Files are kept in object storage. There are two kinds:

• Shared by link: property photos and profile photos. Anyone who has the link to one of these files can open it. Do not put identity documents or other sensitive information in these uploads.
• Private: maintenance issue photos, tenant and application documents, and personal data exports. These are only available through the platform, to people allowed to see them.

Payment data

Card payments are made on Paystack's payment pages. Your full card number and security code go to Paystack, not to us. From Paystack we keep:

• the transaction reference, amount, currency, status and the payer's email;
• for saved cards: the Paystack authorisation code used to charge the card again, the card type, the last four digits and the expiry month and year;
• for payouts: the bank, account number and the account name confirmed with Paystack.

Device and security data

• Device sessions. When you sign in we record the device: a random device identifier held in the ol_device cookie, a short device name worked out from your browser (for example “Chrome on macOS”), your IP address, your browser's user agent, and when the session started, was last used and was ended. See our Cookie Policy.
• Audit logs. We record important actions: sign-ins (including failed ones), changes to records, exports, and requests that were refused. Each entry holds who acted, what changed, when, the IP address and the user agent. Passwords, tokens, NINs, BVNs and ID numbers are masked in these entries.
• Request logs. Our servers log each request: the address requested, the result, the time taken, the IP address, the user ID and the user agent. Email addresses and phone numbers are replaced with pseudonymous references before a log line is written.
• Attempt counters. To slow down password guessing and spam, we count recent attempts per IP address or per user for a short time.
• Marketplace views. When someone views a listing we store a hashed (not readable) form of the IP address, the device type, the user agent and where the visit came from.

Communications

• Messages we send you by email, SMS, WhatsApp or in the app, and records of whether they were delivered and read.
• Your notification settings: which channels you want, quiet hours and time zone.
• Answers you give when you cancel a subscription.

The Nigeria Data Protection Act 2023 says we must have a lawful basis for each use of personal data. The table shows what we use data for and the basis we rely on.

Automated checks

A landlord can set screening criteria for an apartment. When you apply, your answers are checked against those criteria automatically and the result is shown to the landlord. The decision to approve or reject an application is made and recorded by a person at the landlord's organisation, who must give a reason for a rejection.

We do not sell personal data. We share it only as described here.

Service providers

• Paystack processes card and bank payments, subscriptions, bank account checks and payouts.
• Smile ID checks NIN and BVN details when you verify your identity.
• Termii sends SMS messages, such as phone verification codes.
• 360dialog or Twilio deliver WhatsApp messages when WhatsApp notifications are switched on. The platform uses one of the two.
• An email delivery provider sends our emails.
• Hosting and storage providers run our servers, database and file storage.

The current list of providers is: [To be supplied: Named email, hosting and storage providers].

Other users

Data is shared inside the organisation you belong to, according to each person's role and permissions. Tenants see their own lease, payments, issues and documents. Agent profiles, reviews and marketplace listings you publish can be seen by the public.

When the law requires it

We may share data with regulators, courts or law enforcement when the law requires it, or to protect the rights and safety of our users or the public.

Some of our service providers may store or process data outside Nigeria. When that happens, we only transfer personal data in a way the Nigeria Data Protection Act 2023 allows, for example to a country with adequate protection or under contract terms that protect your data.

Countries where data is processed: [To be supplied: Hosting locations and transfer safeguards].

Each type of record has a retention policy. A daily job applies the platform-wide policies. Policies that delete, archive or anonymise records which may matter legally run in a counting-only mode until legal counsel approves them. These are the defaults:

Other data is kept for as long as the account is open, and after that for as long as the law requires. An archive is checked to be complete and readable before the original records are removed.

A personal data export can be downloaded for 7 days, up to 3 times. After that the link stops working.

Under the Nigeria Data Protection Act 2023 you have the right to:

• Access the personal data we hold about you.
• Rectification: have wrong or incomplete data corrected.
• Erasure: have your data deleted when there is no good reason to keep it.
• Restriction: ask us to limit how we use your data.
• Portability: get your data in a common, machine-readable format.
• Objection: object to uses based on legitimate interests.
• Withdraw consent at any time, where we rely on consent.
• Not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you.
• Complain to the Nigeria Data Protection Commission.

How to use your rights

• Correct your details yourself. Edit your profile on the profile page. Tenants use the tenant portal profile page.
• Download a copy of your data. Landlord, manager and team accounts can request an export in JSON or CSV on the data management page. You can choose to include your profile, leases, payments, issues, notifications and activity history. You can request one export per day.
• Anything else. For erasure, restriction, objection or any other request, or if you cannot use the pages above, write to our Data Protection Officer or use our contact page. We may need to confirm who you are before we act. We will reply within [To be supplied: Response time for rights requests].

Passwords are stored as bcrypt hashes. Each sign-in is tied to a device session that can be ended at any time. Sensitive changes need your password again. Every organisation's records are kept apart from every other organisation's, and access inside an organisation follows each person's role. Important actions are written to an audit log.

Read more on our Security page.

OgaLandlord is built for landlords, property managers, agents and tenants. It is not meant for children. If you believe a child's personal data has been added to OgaLandlord, contact us and we will deal with it.

We may update this policy when the service or the law changes. We will change the “Last updated” date at the top of this page. If a change is significant, we will tell account holders before it takes effect.

• Company: [To be supplied: Registered company name]
• Address: [To be supplied: Registered office address]
• Data Protection Officer: [To be supplied: Data Protection Officer email]
• Privacy questions: [To be supplied: Privacy contact email]

You can also reach us through our contact page.