Nestova Real Estate Platform ("Nestova", "we", "us", or "our") is committed to protecting the privacy and personal data of every individual who interacts with our platform. This Privacy Policy governs the collection, processing, storage, and disclosure of personal information obtained through our website at nestova.ng, our mobile applications, and all associated digital services (collectively, the "Platform").

This Policy applies to all users of the Platform, including registered members, property seekers, property owners, real estate agents, developers, and visitors who browse without creating an account. By accessing or using the Platform, you acknowledge that you have read, understood, and consent to the terms described herein.

Nestova acts as both a data controller (determining the purposes of processing) and, in certain circumstances, a data processor (processing data on behalf of third-party principals such as real estate firms and independent agents listed on our platform).

We collect personal information only to the extent necessary to deliver our services effectively and securely. The categories of data we collect include:

2.1 Information You Provide Directly

• Account Registration: Full name, email address, phone number, password (encrypted), and profile photograph.
• Property Listings: Property address, photographs, descriptions, pricing details, and ownership documentation.
• Enquiries & Communications: Messages sent to agents or property owners, enquiry forms, and support requests.
• Identity Verification: Government-issued identification documents (NIN, International Passport, Driver's Licence) required for high-value transactions and agent verification.
• Payment Information: Bank account details, card information, and billing address, processed via our PCI-DSS-compliant payment partners.
• Newsletter & Marketing: Email address and preferences submitted via subscription forms.

2.2 Information Collected Automatically

• Device & Technical Data: IP address, browser type, operating system, device identifiers, and screen resolution.
• Usage Data: Pages visited, links clicked, search queries, session duration, and navigation paths within the Platform.
• Location Data: Approximate geographic location derived from IP address; precise location only if you grant explicit permission through your device settings.
• Cookies & Tracking Technologies: Data collected through cookies, web beacons, and similar technologies as described in our Cookies Policy.

2.3 Information from Third Parties

• Social login data from Google or Facebook when you choose to register via those platforms.
• Credit bureau and identity verification data from licensed third-party verification providers.
• Real estate market data, valuation indices, and property registry information from public authorities and licensed data partners.

We process your personal information for defined and legitimate purposes consistent with the nature of our real estate services. We shall not process your data in a manner incompatible with the purposes for which it was originally collected.

In accordance with the Nigeria Data Protection Act 2023, every instance of personal data processing carried out by Nestova is grounded in at least one of the following lawful bases:

• Contractual Necessity: Processing is required to perform the contract between you and Nestova, including the provision of account services, property listings, and transaction facilitation.
• Consent: Where you have freely, specifically, and unambiguously given consent — for example, for marketing communications or precise location access. You may withdraw consent at any time without detriment.
• Legal Obligation: Processing necessary to comply with our obligations under Nigerian law, including anti-money laundering (AML), Know Your Customer (KYC) requirements, and tax regulations.
• Legitimate Interests: Processing for purposes that are in our legitimate business interests and do not override your fundamental rights — such as fraud detection, security improvements, and platform analytics.
• Vital Interests: In exceptional circumstances, processing necessary to protect life and safety.

Nestova does not sell, rent, or trade your personal information to third parties for their own marketing purposes. We disclose your data only in the following limited and controlled circumstances:

5.1 Parties We May Share Data With

• Real Estate Agents & Developers: Contact information shared with listed agents or developers when you initiate an enquiry, in order to facilitate your property transaction.
• Service Providers: Trusted third-party vendors engaged to provide essential services on our behalf — including cloud hosting, payment processing, email delivery, analytics, and customer support tools — bound by strict data processing agreements.
• Legal & Regulatory Authorities: Where compelled by a court order, regulatory directive, or lawful request from the Nigeria Data Protection Commission (NDPC), Nigeria Financial Intelligence Unit (NFIU), or other competent authorities.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity, subject to equivalent privacy protections.
• With Your Explicit Consent: In any other circumstance where you have expressly authorised us to share your data.

We implement and maintain robust technical and organisational security measures designed to protect your personal data against unauthorised access, alteration, disclosure, loss, or destruction. Our security framework includes:

• End-to-end TLS/SSL encryption for all data transmitted between your device and our servers.
• AES-256 encryption at rest for databases containing sensitive personal information.
• Multi-factor authentication (MFA) for administrative access and available optionally for user accounts.
• Regular penetration testing and independent security audits conducted by certified cybersecurity professionals.
• Strict access controls ensuring only authorised personnel with a legitimate business need may access personal data.
• Incident response procedures enabling us to detect, contain, and notify affected individuals and the NDPC of any qualifying data breach within the timeframes stipulated by the NDPA.

Notwithstanding the above, no method of transmission over the internet or electronic storage is completely impenetrable. You are encouraged to use a strong, unique password for your Nestova account and to notify us immediately at [email protected] if you suspect any unauthorised activity.

We retain your personal data for as long as is necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, accounting, and reporting obligations.

• Active Account Data: Retained for the duration of your account and for up to 5 years following account closure, in accordance with Nigerian tax and financial record-keeping requirements.
• Transaction Records: Financial transaction data retained for a minimum of 7 years as required by the Companies and Allied Matters Act (CAMA) and applicable tax legislation.
• KYC & Identity Documents: Retained for 5 years after the conclusion of the business relationship, in line with NFIU and EFCC AML requirements.
• Marketing Data: Retained until you withdraw consent or unsubscribe, whichever is earlier.
• Server Logs & Analytics: Anonymised after 12 months and retained in aggregate form for statistical purposes only.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised unless a longer retention period is required or permitted by law.

As a data subject under the Nigeria Data Protection Act 2023, you are entitled to the following rights with respect to your personal data held by Nestova. We are committed to facilitating these rights promptly and without charge, except where requests are manifestly unfounded or excessive.

• Right of Access: You have the right to request a copy of the personal data we hold about you, along with information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data without undue delay.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary, where you withdraw consent, or where processing is unlawful — subject to our legal retention obligations.
• Right to Restrict Processing: You may request that we restrict processing of your data in specific circumstances while a dispute is being resolved.
• Right to Data Portability: You may request your data in a structured, commonly used, and machine-readable format for transfer to another controller.
• Right to Object: You may object to processing based on legitimate interests, including profiling and direct marketing, at any time.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng if you believe your rights have been infringed.

To exercise any of the above rights, please contact our Data Protection Officer at [email protected]. We will respond within 30 days of receipt of your request.

Our Platform may contain links to external websites, social media platforms, and third-party services that operate independently and are not governed by this Privacy Policy. We do not control and are not responsible for the privacy practices or content of such third parties. We encourage you to review the respective privacy policies of any external site you visit.

We currently engage the following categories of third-party service providers who may process data on our behalf under appropriate data processing agreements:

• Cloud Infrastructure: Hosting, storage, and content delivery network (CDN) providers.
• Payment Processors: Licensed Nigerian payment gateway operators and banks regulated by the Central Bank of Nigeria (CBN).
• Analytics Platforms: Tools used to measure Platform performance, user engagement, and conversion metrics in aggregated and anonymised form where possible.
• Email & SMS Service Providers: Platforms used to deliver transactional and marketing communications.
• Identity Verification Services: Providers licensed to carry out KYC and AML checks in compliance with Nigerian regulatory requirements.

The Nestova Platform is intended exclusively for use by individuals who are at least 18 years of age or the age of majority in their jurisdiction, whichever is higher. We do not knowingly collect, solicit, or process personal data from minors under the age of 18.

If we become aware that personal data has been submitted by or relating to a minor without verifiable parental consent, we will promptly delete such data from our systems. If you believe we may have inadvertently collected information relating to a child, please contact us immediately at [email protected].

We reserve the right to update this Privacy Policy periodically to reflect changes in our practices, legal obligations, or the features of our Platform. Any material changes will be communicated to you through one or more of the following methods:

• A prominent notice on the Nestova homepage or within your account dashboard.
• An email notification to the primary email address associated with your account.
• An in-platform notification upon your next login.

The "Last Updated" date at the top of this Policy indicates when the most recent revision took effect. Your continued use of the Platform following notification of changes constitutes your acceptance of the revised Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or the manner in which Nestova processes your personal data, please contact our Data Protection Officer: