1. Introduction

1.1 This Privacy Policy describes how Housing101 Proptech Solutions Limited ("Housing101", "we", "us", "our") collects, uses, discloses, retains, and protects personal data of Users of the eFRINO platform ("Platform"). It applies to Tenants, Landlords, Principal Agents, and any other person whose personal data we process in connection with the Platform.

1.2 This Policy is issued in compliance with the Nigeria Data Protection Act 2023 ("NDPA") and the regulations and guidance issued by the Nigeria Data Protection Commission ("NDPC").

2. Data Controller

Housing101 Proptech Solutions Limited is the Data Controller. Registered office: 5 Fameshe Kehinde Street, Ilasan, Lekki, Lagos State. RC: 8597579. Data Protection Officer: [email protected].

3. Categories of Personal Data Collected

3.1 Identity Data

• Legal name
• Date of birth
• Gender
• Photo identification
• BVN, NIN
• Contact telephone
• Email address
• Residential address
• Signature

3.2 Financial Data

• Bank account details
• Payment card information (tokenised through licensed payment processors)
• Transaction history on the Platform
• Income and employment information (Tenants)
• Property ownership and valuation information (Landlords)
• Caution Deposit balances and settlement records

3.3 Verification Data

• Credit reports
• KYC results
• Employment confirmation letters
• Payslips
• Bank statement analysis (via Mono or direct upload)
• Prior tenancy history (Tenants)
• Property documentation (Landlords)
• Agent licensing and POA documentation (Principal Agents)

3.4 Usage Data

• App and website interactions
• Search queries
• Listings viewed
• Applications made
• Messages sent through the Platform
• Dispute submissions
• Customer service interactions

3.5 Device and Technical Data

• Device identifiers
• Operating system
• IP address
• App version
• Network information
• Language and timezone settings

3.6 Location Data

Geolocation data with explicit User permission, used only for property search and listing features.

3.7 Property Content

Photographs, descriptions, pricing, and other content uploaded by Landlords or Principal Agents in connection with listings.

4. How We Collect Personal Data

• a. Directly from you when you sign up, complete your profile, list a Property, apply for a tenancy, send a message, contact support, or otherwise use the Platform.
• b. From third parties who help us verify your identity and assess credit, including FirstCentral Credit Bureau Limited, QoreID, VerifyMe, Mono, and similar licensed providers.
• c. From other Users (e.g., a Landlord receiving a Tenant's verified profile during application).
• d. Automatically as you interact with the Platform, through cookies, log files, and analytics technologies.

5. Lawful Bases for Processing

We process personal data on one or more of the following lawful bases under NDPA:

• a. Consent: where you have provided clear, affirmative consent for a specific purpose.
• b. Contract performance: where processing is necessary to deliver the platform services you have engaged us to provide, including Default Recovery Infrastructure as the consideration for flexible payment cadences and Caution Deposit administration through STL Trustees.
• c. Legal obligation: where processing is required by Nigerian law, including credit reporting obligations, anti-money-laundering rules, trustee-related regulatory obligations, and tax reporting.
• d. Legitimate interest: where processing is necessary for our legitimate interests in operating the Platform, preventing fraud, and improving our services, balanced against your rights.
• e. Public interest or vital interest: in narrowly defined circumstances such as responding to legitimate regulator requests or court orders.

6. Purposes of Processing

• Identity, employment, affordability, and credit verification of Users;
• Matching Tenants with Properties and facilitating tenancy execution;
• Rent collection, Caution Deposit administration through STL Trustees, dispute resolution;
• Default Recovery Infrastructure: credit bureau reporting and employer notification on sustained default;
• Insurance enrolment and administration (including tenant insurance, term life on monthly tenants, and third-party landlord insurance);
• Customer service, in-app messaging, and User support;
• Fraud detection, security monitoring, and Platform integrity;
• Compliance with applicable laws, regulator requests, and court orders;
• Marketing and Platform improvement (where consent or legitimate interest applies).

7. Sharing of Personal Data

7.1 We share personal data only as necessary for the purposes described in this Policy and only with parties bound by appropriate contractual or legal protections.

7.2 Categories of Recipients

• a. Other Users: Tenants and Landlords share verified identity and contact information with each other during the tenancy execution process. Verification outcomes are shared with Landlords without disclosing the underlying credit report content.
• b. STL Trustees Limited (Corporate Trustee): As trustee for the Tenant Caution Escrow Fund, STL receives Tenant identity, tenancy details, Caution Deposit balances and movements, dispute records, and Housing101 settlement instructions. STL's processing is governed by the Trust Deed between Housing101 and STL, and is subject to STL's own NDPA and SEC compliance obligations.
• c. Credit bureaus: FirstCentral and other licensed Nigerian credit bureaus, for both inbound verification and outbound reporting.
• d. Payment processors: Paystack, Monnify, and other licensed Nigerian payment infrastructure providers.
• e. Verification and KYC partners: QoreID, VerifyMe, Mono, and similar providers operating under data processor agreements.
• f. Insurance partners: Leadway Assurance Plc and other licensed insurers, for the administration of insurance products.
• g. Tenants' employers of record: in cases of sustained default, factual notification only.
• h. Regulators and authorities: NDPC, NAICOM, SEC, CBN, FIRS, courts, and law enforcement, where legally required.
• i. Professional advisers: legal counsel, auditors, and other advisers bound by confidentiality obligations.
• j. Successors: in the event of corporate transactions, subject to equivalent privacy protections.

7.3 We do not sell personal data.

8. International Transfers of Data

Personal data is primarily processed within Nigeria. Where data is transferred outside Nigeria, we ensure appropriate safeguards are in place, including standard contractual clauses, adequate-jurisdiction transfers, or other mechanisms approved by the NDPC.

9. Retention

• a. Active account data is retained while your account is open.
• b. After account closure, transaction records, tenancy agreements, payment records, Caution Deposit settlement records, and dispute logs are retained for a minimum of seven (7) years.
• c. Trust Fund records held by STL Trustees are retained per STL's regulatory retention obligations under SEC rules.
• d. Credit bureau submissions are retained as required by FirstCentral and Nigerian credit reporting regulations.
• e. Marketing data, where based on consent, is retained until consent is withdrawn or for a maximum of three (3) years from your last interaction.
• f. Audit logs of consent events, dispute review decisions, and Caution Deposit settlements are retained for a minimum of seven (7) years.

10. Your Rights

Under NDPA, you have the following rights:

• a. Right of access.
• b. Right of correction.
• c. Right of erasure (subject to legal and regulatory retention).
• d. Right of portability.
• e. Right to object to certain processing.
• f. Right to withdraw consent (where processing is based on consent).
• g. Right to lodge a complaint with us at [email protected] or with the NDPC.

Requests are responded to within thirty (30) days unless an extension is justified.

11. Tenant Default Recovery Provisions

11.1 Tenants authorise Housing101's Default Recovery Infrastructure as a unified mandatory consent at signup. This authorisation is granted on the basis of contract performance under NDPA Section 25(c).

11.2 Default Recovery Infrastructure includes credit bureau reporting (mandatory) and employer notification (also mandatory under the unified authorisation, with bounded scope and procedural protections).

11.3 Bounded scope of employer notification: factual default notification only, no credit reports or financial details, sent only to employer of record after notice protocol and 30-day cure period, with 24-hour advance notice to Tenant.

11.4 Tenants on monthly tenancies further acknowledge that Housing101 maintains a term life insurance policy on the Tenant's life with Housing101 as beneficiary, funded from Housing101 operating revenue.

12. Caution Deposit Administration

12.1 Caution Deposit balances are held in trust by STL Trustees Limited. Housing101 shares with STL the personal data necessary to administer the Trust Fund, including Tenant identity, tenancy details, Caution Deposit balances and movements, dispute records, and settlement instructions.

12.2 STL processes such data as a separate Data Controller subject to its own NDPA registration and SEC compliance obligations. The relationship between Housing101 and STL on data matters is governed by a Data Sharing Agreement forming part of the Trust Deed.

12.3 STL's second-level review of disputed Caution Deposit decisions requires access to dispute records, supporting evidence, and Housing101's reasoning. This processing is necessary for the performance of the trust arrangement and is on the contract performance basis.

13. Landlord Provisions

• a. Landlords authorise Housing101 to verify property ownership through public records and approved third-party providers.
• b. Property listing content uploaded by Landlords is published on the Platform and may be visible to all Platform Users.
• c. Landlords are responsible for ensuring property content does not include personal data of third parties without lawful basis.
• d. Third-party liability insurance funded by Housing101 on a Landlord's Property is administered with Leadway Assurance or other licensed insurers; the Landlord is the named beneficiary on the policy.

14. Principal Agent Provisions

• a. Principal Agents authorise Housing101 to verify their agency authority through the power of attorney or exclusive instruction documentation provided.
• b. Where Principal Agents process Landlord and Tenant data on the Platform on behalf of represented Landlords, they do so within the scope of agency and subject to NDPA obligations.

15. Cookies and Similar Technologies

The Platform uses cookies and similar technologies for authentication, security, performance analytics, and (where you consent) personalisation and marketing. You can manage cookie preferences through your device or app settings. The full Cookie Notice is available at housing101.ng/cookies.

16. Children

The Platform is not intended for use by anyone under eighteen (18) years of age. We do not knowingly collect personal data from minors.

17. Security and Breach Notification

• a. We implement appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, role-based access controls, audit logging, and regular security reviews.
• b. In the event of a personal data breach likely to result in risk to Users, we will notify the NDPC within seventy-two (72) hours of becoming aware of the breach and notify affected Users without undue delay.

18. Updates to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified to Users through the Platform and email, with affirmative re-consent required where new lawful bases or new processing activities are introduced.

19. Contact and Complaints

Questions, requests, or complaints may be directed to:

You may also lodge a complaint with the Nigeria Data Protection Commission (NDPC) at any time. Details at ndpc.gov.ng.