Privacy Policy

Flatmates Nigeria Ltd ("Flatmates", "we", "us", or "our") operates the Flatmates.ng platform - a marketplace connecting people seeking residential accommodation with hosts and property agents in Nigeria.

Data Controller:

Flatmates Nigeria Ltd

Lagos, Nigeria

Email: privacy@flatmates.com.ng

Data Protection Officer (DPO):

Our designated DPO oversees compliance with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation (NDPR), and applicable international data protection law. Contact: dpo@flatmates.com.ng

This Privacy Policy applies to all personal data processed by Flatmates in connection with the Platform, including the website at flatmates.com.ng, our mobile applications, and related services.

We collect personal data in the following categories:

Identity and Contact Data

Account and Profile Data

Listing and Property Data (hosts)

Transaction and Financial Data

Communication Data

Technical and Usage Data

Location Data

We process your personal data only when we have a lawful basis to do so. The bases we rely on are:

Performance of a Contract (NDPA s.25(1)(b); GDPR Art. 6(1)(b))

Processing necessary to provide the Platform, process bookings, facilitate payments, and enforce our Terms of Service.

Legal Obligation (NDPA s.25(1)(c); GDPR Art. 6(1)(c))

Processing required to comply with Nigerian law, including the NDPA 2023, NDPR, FCCPC Act, tax obligations, and anti-money laundering requirements (MLPA 2022).

Legitimate Interests (NDPA s.25(1)(f); GDPR Art. 6(1)(f))

Processing for fraud prevention, Platform security, product analytics, improving our services, and direct marketing to existing users - where these interests are not overridden by your privacy rights.

Consent (NDPA s.25(1)(a); GDPR Art. 6(1)(a))

Processing for optional features such as marketing newsletters, location-based services, and personalised advertising. You may withdraw consent at any time without affecting the lawfulness of prior processing.

For processing of special categories of data (e.g., biometric or health data, if collected), we rely on explicit consent or legal obligation under NDPA s.30.

We use the personal data we collect to:

Core Service Delivery

Safety, Trust, and Verification

Legal and Regulatory Compliance

Communications

Product Improvement

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share data only in the following circumstances:

Between Platform Users

When a booking is initiated or confirmed, we share the name, profile photo, and contact details of both parties solely to facilitate the transaction. Hosts and renters may not use each other's contact information for purposes outside the Platform.

Sub-Processors and Service Providers

We engage carefully vetted third-party service providers acting on our instructions under data processing agreements. Key sub-processors include:

A current list of sub-processors is available at flatmates.com.ng/legal/sub-processors.

Legal Compliance and Protection

We may disclose personal data if required by Nigerian law, a court order, a request from a regulatory authority (e.g., NITDA, FCCPC, EFCC), or where necessary to protect the rights, property, or safety of Flatmates, our users, or the public.

Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of our assets, personal data may be transferred to the acquiring entity. We will notify you in advance by email and provide you with the opportunity to delete your account.

Flatmates Nigeria Ltd is incorporated in Nigeria and primarily processes data within Nigeria. However, some of our sub-processors operate infrastructure outside Nigeria (notably in the United States and European Union).

Where we transfer personal data outside Nigeria, we ensure appropriate safeguards are in place in accordance with the NDPA 2023 and NDPR, including:

By using the Platform, you acknowledge that your data may be processed outside Nigeria subject to these safeguards. You may contact our DPO for a copy of the applicable transfer mechanisms.

We retain personal data only for as long as necessary for the purposes stated in this Policy, or as required by law:

After the applicable retention period, data is securely deleted or anonymised. You may request early deletion of your data (see Section 8), subject to legal retention obligations we cannot waive.

You have the following rights in respect of your personal data. These rights apply under the NDPA 2023, the NDPR, the GDPR (where applicable to EU residents), and the CCPA (where applicable to California residents).

Right of Access - Request a copy of the personal data we hold about you, including the purposes of processing and any third parties it has been shared with.

Right to Rectification - Request correction of inaccurate or incomplete personal data.

Right to Erasure ("Right to Be Forgotten") - Request deletion of your personal data where it is no longer needed, where consent has been withdrawn, or where processing is unlawful. This right is subject to legal retention obligations.

Right to Restriction of Processing - Request that we temporarily stop processing your data while a correction or objection is being assessed.

Right to Data Portability - Receive your personal data in a structured, commonly-used, machine-readable format (JSON or CSV), and have it transmitted to another data controller where technically feasible.

Right to Object - Object to processing based on legitimate interests (including profiling) and to direct marketing at any time. We will cease that processing unless we can demonstrate compelling legitimate grounds.

Right to Withdraw Consent - Where processing is based on consent, withdraw it at any time via your account settings or by emailing privacy@flatmates.com.ng. Withdrawal does not affect the lawfulness of processing before withdrawal.

CCPA-Specific Rights (California Residents)

How to Exercise Your Rights

Submit a request to: privacy@flatmates.com.ng or via the "Privacy Requests" section in your account settings. We will respond within 30 days as required by the NDPA 2023 (extendable to 60 days for complex requests, with notice). We may need to verify your identity before processing your request.

Complaints

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with:

We use cookies and similar technologies (pixel tags, local storage, device fingerprinting) on the Platform. Cookies fall into the following categories:

Strictly Necessary *(cannot be disabled)*

Essential for the Platform to function - session tokens, security cookies, CSRF protection, and load-balancing identifiers.

Functional

Remember your preferences such as language, recently viewed listings, and whether you have dismissed onboarding prompts. Disabled by rejecting the cookie banner.

Analytics and Performance

Help us understand how users interact with the Platform (e.g., page views, session duration, error rates). Data is aggregated and not used to personally identify you. Disabled by rejecting analytics cookies.

Marketing and Personalisation *(consent required)*

Used to deliver relevant advertisements on third-party sites and to measure campaign effectiveness. Only activated with your explicit consent.

Managing Cookies

You can manage your cookie preferences at any time via the "Cookie Settings" link in the footer, or through your browser settings. Note that disabling certain functional cookies may limit Platform features.

We do not use third-party cookies for behavioural advertising without your prior consent.

The Platform is intended for users aged 18 and over. We do not knowingly collect personal data from individuals under 18 years of age.

If you are a parent or guardian and believe your child has provided personal data to us, please contact us immediately at privacy@flatmates.com.ng. We will delete the relevant data as soon as practicable.

In accordance with the Child Rights Act (as domesticated in relevant states), Flatmates will report any discovered attempt by a minor to circumvent age verification to the appropriate authorities.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction, including:

No security measure is 100% foolproof. If you discover a vulnerability, please report it responsibly to security@flatmates.com.ng - we operate a responsible disclosure programme.

The Platform may contain links to third-party websites and may integrate with third-party services (e.g., mapping services, social login providers). This Privacy Policy does not apply to those third parties.

We encourage you to review the privacy policies of any third-party services you use in connection with the Platform. We are not responsible for the data practices of third parties, even where we have integrated their services into the Platform.

We may update this Privacy Policy to reflect changes in our practices, the law, or our services. When we make material changes, we will:

Your continued use of the Platform after the effective date of a revised Policy constitutes your acceptance of the changes. If you do not accept the changes, you may close your account before the effective date.

For any privacy-related questions, requests, or concerns:

General Privacy Enquiries

Email: privacy@flatmates.com.ng

Response time: within 5 business days

Data Protection Officer

Email: dpo@flatmates.com.ng

Response time: within 30 days (for formal data subject requests)

Postal Address

Data Protection Officer

Flatmates Nigeria Ltd

Lagos, Nigeria

Supervisory Authority

Nigeria Data Protection Commission (NDPC)

Email: info@ndpc.gov.ng

Website: ndpc.gov.ng