Privacy notice
Effective [EFFECTIVE_DATE]. In plain words: what we collect, why, who sees it, how long we keep it and what you can do about it.
1. Who we are
RentApp is run by [COMPANY_LEGAL_NAME] (RC [RC_NUMBER]), [REGISTERED_ADDRESS] ("we", "us"). We run the platform where homes are listed for rent and short stays are booked. Our registration reference with the Nigeria Data Protection Commission (NDPC): [NDPC_REGISTRATION_OR_DPCO_REF].
The property manager or host you deal with (for example the firm that lists a flat, or the host of a short stay) decides for itself what it needs from you to let you a home or host you. For that data it is responsible alongside us, and it may have its own privacy notice.
Our Data Protection Officer: [DPO_NAME], [DPO_EMAIL], [DPO_PHONE].
2. What we collect
Just looking
Technical data that reaches our servers when you open a page: IP address, browser type, pages requested and time. We use it to keep the service secure and working. Homes you save and your compare list stay in your own browser and are not sent to us.
Applying to rent a home
Your full name, email address, phone number, intended move-in date and any message you write. This goes to the property manager who listed the home. If you are not signed in, we also email you a sign-in link so you can follow your application.
Being a tenant
Your email (used to sign you in by link), your name, and your lease and rent records: amounts, due dates, receipts and payment references. If you pay by card or bank transfer, the payment provider handles your card or bank details. We receive a payment reference and status, not your full card number.
Booking a short stay
Your name, email, phone number, dates, number of guests, and payment references. Your booking link includes a secret that lets you manage that booking. Keep it private.
Checking in to a short stay
Hosts may be required, or may choose, to keep a register of guests. At check-in the host's staff record, for each adult guest: full name, ID type and ID number, a photo or scan of the ID if taken, nationality, vehicle plate, and an emergency contact (name and phone). This is the most sensitive information we handle, so it is stored encrypted, shown masked by default, and every time staff reveal it they must give a reason, which is logged.
Contacting us or reporting a problem
What you send us, and your contact details so we can reply.
3. Why we use it, and our legal basis
- To provide what you asked for (process an application, make and manage a booking, take and receipt payments, run a tenancy). Basis: performing a contract with you, or steps you request before one.
- To keep the service safe (prevent fraud and abuse, rate limiting, bot checks, audit logs). Basis: our legitimate interests in a secure service, which we balance against your rights.
- To meet legal duties (guest registration where required, tax and accounting records, responding to lawful requests from authorities). Basis: legal obligation.
- Optional extras we ask you about first, such as property alerts you set up and any optional measurement or marketing storage we may add later. Basis: your consent, which you can withdraw at any time (see section 8).
We do not sell your personal data. We do not make decisions about you using only automated means.
4. Who we share it with
- The property manager or host you are dealing with, to deal with your application or booking.
- Flutterwave (payments): processes card and bank payments and refunds for rent and short stays.
- Cloudflare Turnstile (bot protection): a check on the short-stay booking form. It runs only on that form and may set its own cookies or read signals from your browser to tell people from bots.
- Google Fonts: every page loads its typefaces and icons from Google, so your IP address and browser details are sent to Google when a page opens.
- Carto (map tiles): pages that show a home on a map load map images from Carto, which sees your IP address and the area you view.
- Service providers that run RentApp for us: hosting ([HOSTING_PROVIDER]), email delivery ([EMAIL_DELIVERY_PROVIDER]) and private file storage for ID scans ([FILE_STORAGE_PROVIDER]). They may only use personal data on our instructions.
- Authorities and professional advisers where the law requires or to protect legal rights.
Some of these providers are outside Nigeria. Where personal data leaves Nigeria we rely on [CROSS_BORDER_TRANSFER_BASIS].
5. How long we keep it
| What | How long |
|---|---|
| Short-stay guest ID number and ID scan | Deleted automatically 365 days after check-in registration. The audit log that someone looked at it is kept, without the ID details. |
| Short-stay guest name, email, phone and booking record | [GUEST_CONTACT_RECORD_RETENTION_PERIOD] |
| Rental applications | [APPLICATION_RETENTION_PERIOD] |
| Payments, receipts and lease records | [FINANCIAL_RECORD_RETENTION_PERIOD] |
| Server logs | [SERVER_LOG_RETENTION_PERIOD] |
| Your privacy choice (cookie and browser storage) | Up to 180 days, then we ask again. |
When a period ends we delete the data or anonymise it, unless the law requires us to keep it longer.
6. Cookies and similar browser storage
RentApp does not use advertising or analytics trackers. It stores a small amount of data in your browser to work:
- Your sign-in (tenant or staff) so you stay signed in until it expires.
- Homes you save and your compare list, so they are still there when you come back.
- A short-stay booking secret, kept only for the tab you are using and cleared when you close it, and a payment checkout reference while you pay.
- Which guided-tour tips you have already seen.
- Your privacy choice, so we do not ask again straight away.
These are needed for features you use and do not depend on your choice below. If we ever add anything optional, it will not load until you have said yes.
7. How we protect it
Connections use HTTPS. Guest ID numbers are encrypted and ID scans sit in private storage that staff can only open through short-lived links. Staff see only the data their role needs and sensitive actions are logged. Booking secrets travel in the part of the link after the "#", which browsers do not send to servers. No system is perfectly secure; if there is a personal data breach that puts you at risk we will tell the NDPC within 72 hours and tell you without undue delay where the law requires it.
8. Your rights
Under the Nigeria Data Protection Act 2023 you can ask us to:
- tell you what personal data we hold about you and give you a copy (access);
- correct data that is wrong or incomplete;
- delete data we no longer need, or that we should not have;
- restrict or stop using your data, including where we rely on our legitimate interests (object);
- give you your data in a commonly used format, or send it to another provider (portability);
- stop relying on your consent, at any time, without affecting what we did before you withdrew it.
To use a right, email [DPO_EMAIL] and tell us which right and which booking, application or email address it concerns. We may ask you to prove it is you, and we reply within [RESPONSE_TIME_DAYS] days. For data a property manager or host holds, you can also ask them directly. We do not yet have an online form for these requests; email is the route for now.
You can change your cookie and storage choice here at any time:
You can review or change your choices about optional cookies at any time.
9. Complaints
If you are not happy with how we handled your data, please tell us first at [DPO_EMAIL]. You also have the right to complain to the Nigeria Data Protection Commission (NDPC), ndpc.gov.ng.
10. Children
RentApp is for adults. Bookings and applications must be made by someone aged 18 or over. Hosts may record the names of children travelling with a guest.
11. Changes to this notice
If we change this notice in a way that matters, we will update the date at the top and, where needed, ask for your choice again.