1. Introduction

This Privacy Policy explains how QShelter Limited (‘Qshelter’, ‘we’, ‘our’, or ‘us’) processes personal data collected through this platform, managed in partnership with the Federal Government of Nigeria and SPV Limited under the MREIF program in compliance with the Nigeria Data Protection Act (NDPA) 2023, and the security controls established under our Information Security Management System (ISMS).

By accessing or using our platform, you acknowledge that you have read, understood, and agree to this Privacy Policy.

2. Definitions

• "Personal Data": Any information relating to an identified or identifiable natural person, including but not limited to name, contact details, identification numbers, financial or payment data, IP address, and usage data.
• "Processing": Any operation or set of operations performed on personal data, whether automated or manual, including collection, recording, organization, storage, adaptation, retrieval, use, disclosure, and deletion.
• "Data Subject": Any individual whose personal data is collected or processed by QShelter.
• "Data Controller": The entity that determines the purposes and means of processing personal data; in this case, QShelter Limited.
• "Data Processor": Any third-party or service provider who processes personal data on behalf of QShelter Limited.
• "Consent": Any freely given, specific, informed, and unambiguous indication of the Data Subject's wishes by which they signify agreement to the processing of their personal data.
• "Cookies": Small text files or similar technologies stored on your device to help the website remember your preferences, track usage, and enhance functionality.
• "NDPA": The Nigeria Data Protection Act 2023.
• "DPO": Data Protection Officer, responsible for monitoring compliance with this Privacy Policy and applicable data protection laws.

3. Children's Data

Our services are not intended for individuals under the age of 18. QShelter does not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child, we will take steps to delete it promptly.

4. Data Controller and Contact Information

5. Personal Data We Collect

We may collect the following categories of data:

• Identity and Contact Data: Your name, email address, phone number, and password.
• Financial and Payment Data: Account details, payment or transaction records where applicable.
• Technical Data: IP address, browser type, device identifiers, operating system, and usage logs.
• Usage and Profile Data: Search queries, properties viewed, user preferences, survey responses, and communication history.
• Marketing and Communication Data: Email preferences, interests, and engagement with promotional messages.
• Verification documents: including property title documents, government-issued identity documents, proof of address, and other supporting documentation required for property transactions or program eligibility.

6. How We Collect Your Data

We collect your data through the following channels:

• Information you provide directly: when you create an account, complete forms, upload documents (e.g., ID, proof of address, property documents), submit applications, request services, or contact our support team.
• Information we collect automatically: through cookies and similar technologies, including IP address, device and browser details, session data, interaction logs, pages viewed, and general usage analytics.
• Information from third-party partners: including payment processors, ID verification vendors, lenders, property developers, background-checking services, and publicly available records, to verify identity, process requests, or prevent fraud.
• Information from service providers/processors: such as hosting providers, analytics tools, or communication platforms that process data on our behalf under strict data processing agreements.
• Information obtained through integrations or APIs: when you link external services (e.g., identity providers or banks), we collect the information exchanged to enable those integrations.
• Information from social media and referral sources: including profile information shared by social platforms when you engage with us, or contact details provided through referrals.
• Information collected for security and compliance: such as access logs, authentication attempts, fraud-monitoring signals, and audit trails required by law or regulation.

We may combine information collected from different sources to provide services, verify identity, enhance security, comply with legal obligations, and improve platform performance.

7. How We Use Your Data

We process your personal data for the following purposes:

• To provide and manage our services — including property listings, search results, transactions, and account access.
• To maintain and improve our platform — analyzing usage patterns, fixing issues, and enhancing user experience.
• To communicate with you — including updates, newsletters, and customer support responses.
• To personalize user experience — tailoring recommendations, features, and promotions to your interests.
• To comply with legal obligations — tax, accounting, fraud prevention, and data protection compliance.
• To protect the platform from fraud and abuse — detecting suspicious activity, preventing unauthorized access, and safeguarding other users.
• To enforce our Terms and Conditions — ensuring compliance with contractual obligations and platform rules.

We only process personal data where a lawful basis exists — consent, contract performance, legal obligation, or legitimate interest.

8. Legal Basis for Processing

Under NDPA, our processing is based on one or more of the following:

• Consent: For marketing communications and non-essential cookies.
• Contract: To deliver services you requested or to fulfill a transaction.
• Legal Obligation: To comply with statutory or regulatory requirements.
• Legitimate Interest: To secure, improve, and operate our platform effectively.

9. How We Share Data

We may share your personal data only as necessary with:

• Service providers and partners who support platform operations, hosting, analytics, and payments.
• Professional advisors (e.g., auditors, consultants, legal counsel).
• Regulatory and law enforcement authorities where required by law or to protect our legal interests.

All third-party processors are bound by confidentiality and data protection agreements consistent with this Policy. We do not sell or rent your personal data.

Our website or platform may contain links to third-party websites or services. QShelter is not responsible for the privacy practices or content of these external sites. We encourage you to read the privacy policies of any third-party sites you visit.

10. International Data Transfers

Where data is transferred outside Nigeria or the EEA, such transfer will be done:

• To countries or entities with adequate data protection safeguards; or
• Under Standard Contractual Clauses (SCCs) or other approved mechanisms recognized by the Nigeria Data Protection Commission (NDPC) or European Commission.

11. Data Retention

We retain personal data only for as long as necessary for the purposes outlined above or as required by applicable law.

At the end of each retention period, personal data is securely deleted, anonymized, or archived.

12. How We Store Your Data

We store your personal data using secure cloud-based and on-premise systems that comply with industry and regulatory standards. Depending on the type of data, your information may be stored in one or more of the following environments: secure cloud infrastructure providers, encrypted databases and storage systems, backup and disaster recovery servers, access-controlled internal systems, and audit-logged environments.

We ensure that your data is stored only within environments where appropriate technical and organizational safeguards are implemented, including encryption, access control, monitoring, and data minimization practices.

13. Data Security

We maintain a robust Information Security Management System (ISMS), including:

• Encryption of data at rest and in transit.
• Strict access controls and user authentication.
• Regular security testing and vulnerability management.
• Incident response and breach notification procedures.

14. Data Breach Notification

If a personal data breach occurs that poses a risk to individuals' rights or freedoms, we will:

• Notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware; and
• Inform affected individuals where there is a high risk of harm.

15. Your Data Protection Rights

Under the NDPA 2023, you have the right to:

• Access and obtain a copy of your personal data.
• Request correction of inaccurate or incomplete data.
• Request deletion of your personal data ("right to be forgotten").
• Restrict or object to processing of your data.
• Withdraw consent at any time without affecting prior lawful processing.
• Request portability of your data in a machine-readable format.
• Object to automated decision-making or profiling.

16. Exercising Your Rights

To exercise your rights, please contact our Data Protection Officer using the details provided above. We will respond to verified requests within one (1) calendar month, as required under the NDPA.

17. Right to Lodge a Complaint

If you are unsatisfied with how your data has been handled, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) or through any accredited Data Protection Compliance Organization (DPCO).

18. Regulatory Reference

This Policy recognizes the Nigeria Data Protection Act (NDPA 2023) as the prevailing data protection law in Nigeria and acknowledges the Nigeria Data Protection Commission (NDPC) as the supervisory authority responsible for data protection oversight.

19. Updates to This Policy

We may update this Privacy Policy from time to time. Updated versions will be published on our website with the effective date shown above. Material changes will be communicated directly to users where legally required. You are encouraged to review this Policy periodically.

20. Arbitration Notice

IMPORTANT: BY USING QSHELTER'S SERVICES, YOU AGREE THAT ANY DISPUTES OR CLAIMS ARISING FROM THE USE OF OUR PLATFORM WILL BE RESOLVED THROUGH FINAL AND BINDING ARBITRATION ON AN INDIVIDUAL BASIS, IN ACCORDANCE WITH APPLICABLE LAW.

21. Cookies and Tracking Technologies

We use cookies and similar technologies to operate our website, enhance security, improve performance, and analyze user interactions. These technologies may collect information such as device details, IP address, usage patterns, and preferences. For full details on the types of cookies we use and how you can manage them, please refer to our Cookie Policy.

Non-essential cookies require your consent, which you can withdraw at any time.