Data Protection and Privacy Policy

Homie.ng (“We”, “Our”, “Us”, or “Homie”) operates a digital real estate marketplace that connects verified tenants, landlords, agents, and property inspectors. We are committed to protecting the privacy and confidentiality of the personal data you disclose to us.

This Data Protection and Privacy Policy (the “Policy”) explains our information collection and sharing practices in line with the Nigeria Data Protection Act 2023 and all applicable data protection laws in Nigeria (“Applicable Data Protection Laws”). Whether you provide personal data through our website, mobile application, or by other means (such as telephone, email, or support requests), we will strive to honour your privacy preferences and process your personal data in compliance with Applicable Data Protection Laws.

This Policy represents the minimum principles and standards applicable to Homie. Where a higher standard or principle of data protection is imposed by Homie or any applicable law, the higher standard or principle shall apply.

In this Policy, the following terms have the meanings set out below unless the context requires otherwise:

• Applicable Data Protection Laws — any statute, regulation, guideline, or governmental direction having the force of law relating to data protection in Nigeria, including the NDPA and NDPR.
• Data Subject — you, as a customer or user of Homie whose personal data is processed.
• NDPA — the Nigeria Data Protection Act 2023.
• NDPR — the Nigeria Data Protection Regulation 2019, as amended from time to time.
• Personal Data — any information relating to an identified or identifiable natural person, such as a name, identification number, location data, online identifier, or factors specific to physical, physiological, genetic, psychological, economic, cultural, or social identity.
• Processing — any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, alignment, restriction, erasure, or destruction.
• Sensitive Personal Information — data revealing race, health status, ethnic or social origin, religious or other beliefs, genetic or biometric data, political views, trade union membership, criminal records, property details, marital status, family details, sex, or sexual orientation. Homie does not intentionally collect sensitive personal information unless you voluntarily provide it or it is required for a specific service.

This Policy is based on the privacy and data protection principles and requirements under Applicable Data Protection Laws. It applies to all personal data processed by Homie and is part of our approach towards full compliance.

This Policy applies to all services you access on Homie, as well as our interactions with you, including our processing of your personal data. All personnel engaged with Homie are required to comply with this Policy.

This Policy outlines how we collect, use, and protect your personal data in our interactions with you and in accordance with Applicable Data Protection Laws.

We process personal data only where we have a lawful basis under Applicable Data Protection Laws. The main purposes and bases are:

• Providing access to our website and mobile application — legitimate interests in managing and running our business; your consent where required; or performance of a contract with you.
• Creating and managing your account and the features you request — performance of a contract with you.
• Publishing and managing listings, arranging inspections, processing applications, and supporting rental or property transactions — performance of a contract with you; legitimate interests in operating the marketplace efficiently.
• Responding to your inquiries via support services — your consent where required; performance of a contract; legitimate interests; or compliance with a legal obligation.
• Verifying identities, protecting users, preventing fraud, and enforcing our terms — legitimate interests; compliance with legal obligations.
• Sending service messages, security alerts, support replies, and, where permitted, product updates or marketing communications — your consent for marketing; legitimate interests or contract performance for service communications.
• Understanding how Homie is used, troubleshooting issues, and improving our products and services — legitimate interests in managing and improving the platform.
• Using cookies and similar technologies for sign-in, preferences, performance, and protection — your consent where required; legitimate interests.
• Meeting legal, regulatory, tax, accounting, and compliance obligations — compliance with a legal obligation.

Where processing depends on your consent, we will request and obtain that consent at the point of data collection. You may withdraw consent at any time. Processing carried out before withdrawal remains lawful based on the consent previously provided.

Homie processes personal data in accordance with these principles:

• Lawfulness, fairness, and transparency — we process personal data lawfully and explain our practices in this Policy.
• Purpose limitation — we collect data for specified, explicit, and legitimate purposes and do not process it in a manner incompatible with those purposes.
• Data minimisation — we collect only what is adequate, relevant, and limited to what is necessary.
• Accuracy — we take reasonable steps to keep personal data accurate and up to date, and to erase or rectify incorrect data without undue delay.
• Storage limitation — we retain personal data only for as long as necessary for the purposes set out in this Policy.
• Integrity and confidentiality — we implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage.

We collect personal data you provide directly to us and limited technical information automatically when you use Homie.

Information you provide may include:

• Account details such as your name, email address, phone number, password, and selected user role.
• Profile and identity information used to verify tenants, landlords, agents, and property inspectors.
• Property information, listing content, inspection details, applications, and documents you choose to upload.
• Payment and transaction information. Payment card details may be processed directly by our payment partners rather than stored by Homie.
• Messages, support requests, feedback, and other communications you send through the platform.

We also collect limited technical information automatically, such as your device type, browser, IP address, approximate location, pages viewed, and actions taken on the service.

We strive to minimise collection to what is necessary for the intended purpose. Where applicable and required by law, we will obtain your consent before collecting certain categories of personal data. Refusal to provide data necessary for a service may affect our ability to serve you effectively.

We share personal data only when needed to provide the service, follow your instructions, or meet a legal obligation. Recipients may include:

• Other Homie users when you publish a listing, submit an application, book an inspection, or communicate through the platform.
• Vetted service providers that support payments, identity checks, hosting, communications, analytics, and customer support.
• Professional advisers, regulators, law enforcement, or other parties where disclosure is required or reasonably necessary to protect rights and safety.
• A successor organisation if Homie is involved in a merger, financing, acquisition, reorganisation, or sale of assets.

We disclose personal data to third parties only where: the third party requires the information to provide contracted services; the disclosure is required by applicable law; your consent has been obtained; the third party has agreed to comply with required data security standards; and any applicable cross-border transfer restrictions are met.

Our service providers may use information only for the services they perform for us and must protect it appropriately.

As a data subject under Applicable Data Protection Laws, you have the right to:

• Request access to your personal data and receive a copy of the data we hold about you.
• Request correction or rectification of incomplete or inaccurate personal data.
• Request erasure of your personal data where there is no good reason for us to continue processing it, subject to specific legal exceptions.
• Object to processing based on legitimate interests where your situation gives rise to grounds relating to your fundamental rights and freedoms.
• Object to processing of your personal data for direct marketing purposes.
• Request restriction of processing in certain scenarios, such as where you contest the accuracy of the data or need the data to establish, exercise, or defend legal claims.
• Request transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format, where applicable.
• Withdraw consent at any time where processing relies on consent. Withdrawal does not affect the lawfulness of processing before withdrawal, but we may not be able to provide certain services.
• Ask us not to continue processing your personal data for marketing purposes.

You can update some details in your account settings or contact us to make a request. We may need to confirm your identity before completing it. Within one month of receiving your request, we will either respond or notify you if we require additional time.

You can opt out of promotional messages at any time. We may still send important service or security notices.

We retain personal data only for as long as it is necessary to fulfil the purposes for which it was collected, in line with applicable data protection regulations. Retention periods depend on:

• The specific reason the information was gathered, including whether it is required to initiate or defend legal proceedings.
• Statutory obligations that mandate retention of certain categories of data for a legally prescribed period.
• Whether data must be preserved due to ongoing legal action, a court directive, or a regulatory or law enforcement investigation.

When personal data is no longer required, we securely dispose of it or anonymise it.

Some service providers may process personal data in countries other than Nigeria. Where we share or transfer personal data across borders, we do so in accordance with Applicable Data Protection Laws and take appropriate safeguards to ensure its protection.

Safeguards may include ensuring that:

• Recipients operate under a law, binding corporate rules, contractual arrangements, code of conduct, or certification mechanism that guarantees an adequate level of protection; or
• Where such mechanisms are not available, transfers occur only with your explicit informed consent; where necessary for performance of a contract with you; where necessary for compelling public interest reasons; where required for the establishment, exercise, or defence of legal rights; or where necessary to protect your vital interests or those of another person.

We use reasonable technical and organisational safeguards designed to protect personal information against loss, misuse, unauthorised access, alteration, or disclosure. These may include access controls, confidentiality obligations for personnel, periodic security reviews, data backup procedures, incident response processes, and employee training on data protection.

No online service is completely secure. Please use a strong, unique password, safeguard your login credentials, and notify us promptly if you believe your account has been compromised.

If a data breach occurs that poses a significant risk to your rights and freedoms, we will notify you and the appropriate supervisory authorities in accordance with relevant legal requirements.

We may use automated decision-making and profiling processes to provide our services, such as using algorithms and data analysis to assess information you provide and improve how Homie works for you.

You have the right to object to the use of automated decision-making and profiling processes where applicable under Applicable Data Protection Laws.

Homie may use cookies and similar technologies to keep you signed in, remember preferences, understand product performance, and protect the platform. Cookies are text files containing small amounts of information downloaded to your device when you visit our website or use our application.

Cookies may be essential for platform function, analytics, personalisation, or, where permitted, advertising purposes. You can control cookies through your browser or device settings. Blocking essential cookies may prevent parts of Homie from working correctly.

We take measures to ensure that our use of cookies does not violate your privacy rights under the NDPA.

Homie is not intended for children under 18, and we do not knowingly collect their personal information. If you believe a child has provided us with personal information, please contact us so we can investigate and take appropriate action.

Our website or application may include links to third-party websites, plug-ins, and applications. Clicking those links or enabling those connections may allow third parties to collect or share personal data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave Homie, we encourage you to read the privacy policy of every website you visit.

We may update this Policy as Homie evolves or legal requirements change. We will post the revised Policy here and update the date at the top. If a change materially affects your rights, we will provide an additional notice where appropriate.

If you believe your data privacy rights have been violated, or you wish to report a complaint to the Nigeria Data Protection Commission (NDPC), you may contact the NDPC through:

• Address: No. 12 Dr Clement Isong Street, Abuja
• Helpline: +234 (0)9160615551
• Website: https://ndpc.gov.ng/