Sections
Privacy Policy
Last Updated: May 2026 | [email protected]
Introduction
StayAfrika Technologies Limited ("StayAfrika", "we", "our", "us") is committed to protecting the privacy and personal data of everyone who uses our platform. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the rights you have over your data.
This policy applies to all users of the StayAfrika platform, including guests, hosts, tenants, property managers, and visitors to our website at stayafrika.com.
By creating an account or using our services, you acknowledge that you have read and understood this Privacy Policy.
Who We Are
StayAfrika Technologies Limited is the data controller responsible for the personal information collected through the StayAfrika platform. We are registered in Nigeria and operate in accordance with the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023.
If you have questions about this policy, contact us at: [email protected]
Information We Collect
Information You Provide Directly
- •Account registration details: first name, middle name, last name, email address, phone number (WhatsApp), and password
- •Identity verification data: National Identification Number (NIN), NIMC slip, selfie photograph, and live facial scan
- •Business information: company name, CAC registration number, business address, and social media links
- •Listing information: property details, photos, videos, pricing, availability, and location
- •Payment information: bank account details for payouts and wallet top-up details
- •Communications: messages, support tickets, and automated message templates
- •Reviews and ratings submitted on the platform
Information Collected Automatically
- •Device information: browser type, operating system, device type, and screen size
- •Usage data: pages visited, features used, time spent, and click patterns
- •IP address and approximate location data
- •Cookies and similar tracking technologies
Information From Third Parties
- •Identity verification results from SISSL Verify
- •Business registration status from CAC database
- •Google account information if you choose to register with Google
- •Payment transaction confirmations from Paystack
How We Use Your Information
- •To create and manage your account on the StayAfrika platform
- •To verify your identity and comply with Nigerian legal requirements
- •To process bookings, payments, payouts, and refunds
- •To facilitate communication between guests and hosts
- •To display listings and enable search and discovery
- •To send transactional notifications and platform updates
- •To investigate disputes and protect community safety
- •To analyse platform usage and develop new services
- •To comply with applicable Nigerian laws and regulations
Legal Basis for Processing
Under the NDPA 2023, we process your personal data on the following legal grounds:
- •Contractual necessity: processing required to provide services you have signed up for
- •Legal obligation: processing required to comply with Nigerian laws
- •Legitimate interests: processing necessary for fraud prevention and platform security
- •Consent: where you have given explicit consent for marketing or optional data sharing
Data Retention
- •Account data is retained for as long as your account is active
- •Identity verification data is retained for the period required by Nigerian law
- •Transaction records are retained for a minimum of 7 years
- •You may request deletion of your account and associated data at any time
Data Security
We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or destruction, including:
- •Encryption of data in transit (HTTPS/TLS) and at rest
- •Role-based access controls limiting staff access to personal data
- •Regular security reviews and monitoring
- •OTP verification for sensitive account actions
No system is entirely secure. In the event of a data breach, we will notify you and relevant Nigerian authorities in accordance with the NDPA 2023.
Your Rights
Under the NDPA 2023, you have the following rights regarding your personal data:
- •Right to access: request a copy of the personal data we hold about you
- •Right to rectification: ask us to correct inaccurate or incomplete data
- •Right to erasure: request deletion of your personal data
- •Right to restrict processing: ask us to limit how we use your data
- •Right to data portability: request your data in a structured format
- •Right to object: object to processing based on legitimate interests
- •Right to withdraw consent: withdraw consent at any time
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
Children's Privacy
The StayAfrika platform is not intended for users under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via a prominent notice on the platform. Continued use of the platform after changes take effect constitutes your acceptance of the updated policy.
Contact Information
For privacy-related enquiries, please contact us:
Data Protection and Compliance
How StayAfrika handles sensitive data in line with Nigerian law
Regulatory Framework
- •Nigeria Data Protection Regulation (NDPR) 2019 — issued by NITDA
- •Nigeria Data Protection Act (NDPA) 2023 — the principal data protection legislation in Nigeria
- •Central Bank of Nigeria (CBN) regulations applicable to payment data
- •National Identity Management Commission (NIMC) Act — governing the use and handling of NIN data
Data Categories and Sensitivity Classification
Highly Sensitive Data (Restricted Access)
- •National Identification Number (NIN)
- •Biometric data (facial scans, liveness check results)
- •NIMC slip images
- •Bank account numbers and payment details
Access to this category of data is restricted to authorised personnel only and logged in the audit trail.
Personal Identification Data (Controlled Access)
- •Full legal name, date of birth, gender
- •Email address, phone number (WhatsApp)
- •Physical address and location data
- •Profile photographs
Operational Data (Standard Access)
- •Booking and transaction history
- •Listing details and property information
- •Review and rating data
- •Support ticket content
- •In-app communication records
Identity Verification Data Handling
- •NIN is transmitted securely to SISSL Verify for validation — StayAfrika does not store the raw NIN validation response beyond what is required for the verification decision
- •Facial scan data is used solely for liveness verification and is not stored as a biometric template after verification is complete
- •NIMC slip images are stored securely and accessible only to authorised Admin personnel for verification review
- •Verification data is retained for the minimum period required by NIMC regulations
Payment Data Handling
Payment processing is handled by Paystack, a PCI-DSS compliant payment processor. StayAfrika does not store full card numbers, CVV codes, or sensitive payment authentication data. We store only:
- •Transaction reference numbers
- •Payment status and amount
- •Paystack customer reference IDs
- •Bank account names and numbers for host payout purposes
Cross-Border Data Transfers
Some of our service providers (including DigitalOcean for cloud hosting and Google for location services) may process data outside of Nigeria. Where data is transferred internationally, we ensure appropriate safeguards are in place in accordance with the NDPA 2023.
Data Breach Response
In the event of a personal data breach, StayAfrika will:
- •Contain the breach and prevent further unauthorised access as soon as it is identified
- •Notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, where required by law
- •Notify affected users without undue delay where the breach is likely to result in high risk
- •Document the breach, its effects, and remedial actions taken
Data Protection Officer
StayAfrika has designated a Data Protection Officer (DPO) responsible for ensuring compliance with this policy and applicable data protection law.
Contact: [email protected]
Third-Party Processors
All third-party processors handling personal data on our behalf are required to comply with the NDPA 2023 and have a valid Data Processing Agreement (DPA) in place with StayAfrika. Current processors include:
- •Paystack
- •SISSL Verify
- •DigitalOcean
- •Resend
NDPR Compliance Statement
Nigeria Data Protection Regulation (NDPR) 2019 & Nigeria Data Protection Act (NDPA) 2023
Our Commitment
StayAfrika Technologies Limited is committed to protecting the privacy and personal data of all users in accordance with the Nigeria Data Protection Regulation (NDPR) 2019 issued by the National Information Technology Development Agency (NITDA) and the Nigeria Data Protection Act (NDPA) 2023, the principal data protection legislation in Nigeria. We operate under the regulatory oversight of the Nigeria Data Protection Commission (NDPC).
What This Means for You
- ✓Your personal data is collected and processed lawfully, fairly, and transparently
- ✓We only collect data that is necessary for the services we provide
- ✓Your data is stored securely with appropriate technical and organisational safeguards
- ✓You have the right to access, rectify, delete, and port your personal data at any time
- ✓We conduct regular data protection audits as required under the NDPR framework
- ✓A designated Data Protection Officer (DPO) oversees our compliance obligations
- ✓Third-party data processors engaged by StayAfrika are bound by Data Processing Agreements (DPAs)
Your Rights Under the NDPR/NDPA
As a data subject, you are entitled to the following rights under Nigerian data protection law:
- •Right to be informed about how your data is being collected and used
- •Right of access to your personal data held by StayAfrika
- •Right to rectification of inaccurate or incomplete personal data
- •Right to erasure ("right to be forgotten") in certain circumstances
- •Right to restrict processing of your personal data
- •Right to data portability in a structured, machine-readable format
- •Right to object to processing based on legitimate interests or direct marketing
- •Right to withdraw consent at any time where processing is based on consent
How to Exercise Your Rights or File a Complaint
To exercise any of your data protection rights, you may contact our Data Protection Officer at [email protected]. We will respond to your request within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC):
Nigeria Data Protection Commission (NDPC)
Website: https://ndpc.gov.ng
The NDPC is the regulatory body responsible for enforcing data protection laws in Nigeria.
Data Protection Officer
StayAfrika has designated a Data Protection Officer (DPO) who is responsible for ensuring compliance with the NDPR and NDPA. For any data protection enquiries:
StayAfrika Technologies Limited
Email: [email protected]
Location: Nigeria
Related Pages